Set up your school workspace
A practical guide to secure SMS and official WhatsApp school announcements.
Start safely in demo mode
Demo sending is clearly labeled and never charges a provider account. Use it to test imports, recipient exclusions, personalized previews, scheduling, failures, retries, and reports before connecting live channels.
Connect an approved SMS gateway
- Create and fund a Twilio messaging account. Verify Tanzania destination permissions and sender ID support with the provider.
- In the backend Secrets panel, add
TWILIO_ACCOUNT_SIDandTWILIO_AUTH_TOKEN. - Enter your provider-approved sender in Settings. Record non-replyable approval only if the provider confirms it.
- Optionally enter your provider’s price per segment. Unicode messages and longer personalized messages can require multiple segments.
- Send to an authorized test number first. History retrieves provider message IDs and delivery reports; acceptance is not delivery.
Adapter reference: Twilio Messages resource, api.twilio.com. Other gateways can replace the SMS adapter without changing the composer.
Connect official WhatsApp Business
- Set up a Meta business account, WhatsApp Business Account and registered business phone. Verification, approved templates and paid services may be required.
- Add
META_ACCESS_TOKEN,META_APP_SECRETandMETA_VERIFY_TOKENin backend Secrets. - Save your phone-number ID, business account ID and supported Graph version in Settings.
- Submit BODY-only announcement templates in Meta. Use positional parameters matching your app variables in order. Link each official template name in Message templates.
- Register the deployed
whatsappWebhookfunction URL with Meta and subscribe to delivery statuses. Signature verification is mandatory. Incoming messages are ignored. - Record recipient consent and maintain opt-outs. Template approval is verified by Meta before queuing.
Official API host: graph.facebook.com. This app never automates personal WhatsApp Web.
Secure backend and scheduled delivery
Set HELLEN_ENCRYPTION_KEY to a randomly generated 64-character hex string (32 bytes). It encrypts job payloads, result records and webhook reports. Keep this key in backend Secrets and retain it securely; changing it makes old job reports unreadable.
Every live send requires server-verified school authorization. Batches run through background jobs with signed, expiring grants. Scheduling is supported up to 30 days. History refresh merges job results; a completed task does not prove delivery.
Workspace data uses private account-scoped built-in key-value storage, not Supabase. Each account has its own records. A shared school database and larger-scale durable workflow require a database connection.
A managed relational database is a Pro feature. You can instead connect your own Supabase project for free from the Database panel. Staff accounts and invite-only sign-up settings also require a paid platform plan.
Privacy and release checklist
Before using real parent information, have your school’s responsible officer review Tanzania’s personal-data requirements and provider policies. Confirm controller/processor registration with the Personal Data Protection Commission, lawful basis and notices, children’s data safeguards, cross-border processing, retention, access/deletion requests and opt-out procedures. This app is not a legal-compliance certification.
Regulatory reference: PDPC Tanzania, Personal Data Protection Act 2022 and controller/processor registration guidance. Verify requirements with the Commission or qualified local counsel.
Install on Android
Open the published HTTPS app in Chrome and use “Install app” or “Add to Home screen”. The shell can load offline after a previous visit; authentication, private records and sending need an internet connection.
Application checks
Run the app’s phone validation, recipient deduplication, class selection, consent, personalization and segment calculation checks. These checks never send messages or contact a provider.
Frequently asked questions
Can parents reply?
Parents may reply through their normal SMS or WhatsApp apps. Hellen Parent Messenger does not have an inbox or manage incoming replies. A provider-approved alphanumeric SMS sender ID may be non-replyable; an ordinary phone number is not.
Does delivered mean read?
No. Delivered is a provider delivery confirmation, not a read receipt. WhatsApp read events are not presented as read status by this app.
Which features cost money?
Live SMS and WhatsApp services may incur provider fees. Staff username accounts and invite-only signup restrictions need a paid platform plan. A managed relational database requires Pro, while connecting your own Supabase is available on every plan.
Are demo changes saved?
Demo changes remain in the current browser session only and never contact providers. Signed-in private workspace changes are saved in built-in storage. Download a backup to retain or transfer records.