Privacy

Learners are recorded as class labels, such as A3. The app does not ask for student names and gives no way to enter them: a class list downloads as a spreadsheet with a blank name column for the teacher to fill in and keep themselves, and there is nowhere to upload it back. Nothing else about a student is asked for either: no email address, student number, date of birth, or home contact details.

A class set up before this may still hold names its teacher entered at the time. Those are visible only to that teacher, on their own screens and printouts, and everything below applies to them unchanged.

A student’s name never reaches the AI. Every prompt, export and generated draft is written about the label, and an automated test fails the build if any code that builds a prompt reads the name. Photos of student work a teacher keeps are never sent to the AI either.

Drafts that will eventually mention a child — report-card comments, notes home — are written with placeholder tokens. A real first name is only ever added by the teacher, in their own browser, and is never stored with the draft.

Parent and guardian contact information is never stored. The app drafts and logs communication; sending it happens in the teacher’s own channels.

Where students interact directly — a quiz, for example — they scan a card the teacher hands out and type a word only they chose. The word is kept as a hash that nobody can read back. There are no student accounts, and nothing a student does is recorded as audio or video.

A teacher account is an email address and a password. The email is used to sign in, to confirm the address, and to reset the password — nothing else. No email ever carries anything about a class, a learner, or a piece of student work.

Plans, assessment records, and any evidence of student work a teacher chooses to record are private to that teacher’s account and served only behind their sign-in. An administrator of this instance cannot open another teacher’s class.

The site sets a session cookie to keep you signed in. There is no advertising and there are no third-party analytics or trackers.

When an account is closed, everything that describes a student is deleted after three months. The teacher can still sign in during that time to take their own records with them.

Plans and comments are drafted with the help of a large language model (Anthropic’s Claude), called from the server under commercial terms that do not permit training on the data. Prompts carry curriculum text and the teacher’s planning context. A draft about one learner carries that learner’s label and the teacher’s own notes about their learning — never their name, a photo of their work, or their voice. Every draft is reviewed and finalized by the teacher, who remains the author of record.

Every prompt the app sends can also be copied and read by the teacher before it goes anywhere. An instance can be run with no AI at all.