Privacy & trust

Student names stay with you

Students join with a class code and a device-local nickname, without an account or email. Scholar stores a numbered label, locked access codes and submitted work. Your roster names and optional email addresses are encrypted on your computer before the locked copy is saved. Unlocked names stay only in the open page’s memory. Your passphrase and Recovery Kit never go to Scholar. If you lose both, we cannot recover the names.

No advertising trackers in the app

We do not install advertising pixels, analytics trackers or session replay. A teacher’s sign-up source tag may be stored on that teacher’s account to count which lesson or ad brought them here. It is not a student identifier and is not sent to advertising companies. Hosting still processes ordinary requests and operational error reports; “no trackers” does not mean no hosting logs.

Focus safeguard

During practice, writing and exit tickets, Scholar can notice when a student leaves the lesson page (after a short grace period) or pastes a large block of text. It records only the event type and time — never the screen, keystrokes, or anything outside the page. Teachers choose per class: off, notify, or lock after three leaves (the teacher can unlock). Students see a gentle reminder to keep their own thinking on the page.

Voice mode

When a teacher turns on “Teach for me”, Scholar turns the lesson’s spoken scripts into audio. Natural (ElevenLabs) voices are not switched on in Scholar today, so the device’s built-in voice reads the script on the device and nothing is sent to a voice service. If we switch natural voices on, we will add ElevenLabs to the service providers below first; scripts would contain lesson content only, pass the same name filter, and never include student data.

Scholar Quest

For now, Scholar Quest shows its cast of fictional characters only. There is no game to play, so no Quest answers, points or rankings are recorded. A 3D adventure is coming; before anyone can play it, this page will say exactly what it records. There is no chat, no purchases and no ads.

Lesson import

Teachers can upload Word, PowerPoint or PDF files today; picking files from their own Google Drive is coming soon. Google access uses a short-lived “only files you pick” permission in the teacher’s browser; Scholar never receives a long-term Google token. File text is name-filtered before AI conversion, and the original file is not kept — only the converted lesson and, for Drive files, a link back.

AI without account identity

AI requests do not contain account IDs, emails, roster mappings or access codes. Before sending lesson or submitted text, a conservative filter removes detected names and contact details. Detection is not perfect: do not paste personal details. We use Anthropic’s commercial API, and Anthropic’s handling of API data is governed by its commercial terms; we do not claim zero retention or no training beyond those terms. Our AI usage records contain only feature, model, token counts when available, time taken and success—not prompts or answers. Provider agreements still require review before launch.

Teacher account protection

We strongly recommend an authenticator app for teachers. Owner access requires a verified authenticator sign-in, including owners who have not enrolled yet. Once enabled, it is required to read protected classroom data or run protected actions. Signed-in pages sign out after 15 minutes without activity. This is a browser-enforced timeout, not a hosted server-session or refresh-token inactivity expiry. The available hosting controls do not let this app configure a 15-minute server-side inactivity cutoff. Our password sign-in form allows five attempts per account in 15 minutes and 30 per network. These are additional app-form limits, not a replacement for hosted sign-in protections; direct hosted sign-in endpoints cannot be given a stricter quota by this app. An open roster key also locks after 15 minutes without activity.

Access records

An append-only access log records gradebook opening, exports, deletion requests and sharing changes. It is separate from anonymous company metrics. Teachers can access their own records; company staff may access records for security. No roster names or work content are written to this log. Access records are retained for two years. AI-usage and translation records are retained for 90 days; a daily cleanup removes older records.

Export and deletion

Teachers can export CSV, JSON and student-work PDFs, regardless of account access. PDFs are generated on your computer. Removing a student deletes their work. Class and account deletion have a 7-day undo period; after that, daily cleanup removes class and account application data, including class-owned lessons and child records. Authentication account removal uses a separate authenticated daily callback that must be published to run. Cleanup can run up to 24 hours after the undo deadline. Archived classes default to removing student work after 12 months, unless you switch retention off. Inactive free-account cleanup is currently OFF; it will require warning emails before activation.

What backups really cover

Our database provider (Supabase) takes daily backups. Backups follow our database provider’s standard plan retention. That is the provider’s retention window, not a guaranteed deadline for erasing a particular deleted record. Database backups do not include stored files. Restoring an older snapshot can restore previously deleted database records; deletion must be reapplied after a restore. We will confirm a contractual deletion deadline before making a stronger promise.

Service providers

Cloudflare hosts Scholar, delivers its pages and runs the daily privacy cleanup. Supabase stores classroom data and runs teacher sign-in (United States, us-east-1). Anthropic processes filtered lesson content. Google may handle teacher sign-in when selected; Google also handles Drive picking when a teacher uses it. Scholar loads no third-party fonts, analytics or advertising scripts. We do not sell student data or display student ads.

Before launch

Provider retention terms, the final school agreement and legal review remain outstanding. This page describes implementation and known limits, not an independent security certification. Scholar is provided by theveteraneducators AI LLC (Nyclogic AI™).