What actually happens to student data.
Every claim below describes something implemented in the shipping app. Where a protection has a limit, the limit is stated rather than smoothed over.
Where the data lives
Teacher │ voice or tap ▼ iPhone / Apple Watch │ speech transcribed on device, audio never written to disk ▼ Observation you confirm │ encrypted outbox (AES-GCM), survives being offline ▼ Our server over TLS │ alias + measurements only ▼ Progress reports and draft narratives
Split by design
The identifying detail and the measurements are deliberately kept apart.
| Stays on your device | Reaches our server |
|---|---|
| Full name | The alias you chose |
| Class and grade | Measurements and dates |
| Case manager | Goals and observations |
| Your private notes | Your account email |
Device-side detail is encrypted with AES-GCM under a key held in the iOS Keychain as device-only, so it is not readable from a backup restored onto another device.
The limit worth understanding: the alias is yours to choose, and it is stored on our servers. If you type a child's real first name, that first name is on our servers. Use initials or a code and the data we hold cannot be resolved to a person without the device.
Voice
Speech is transcribed on the device where iOS supports it — the app explicitly requests on-device recognition rather than accepting the cloud default. Audio is never written to disk and never uploaded. What leaves the device is the number you confirmed, not a recording and not a transcript.
On older hardware without on-device support, iOS may fall back to Apple's speech service. That is Apple's processing, not ours, and we still receive only the confirmed number.
AI that cannot make things up
Draft narratives are generated on our own server by deterministic code. There is no language model, and no student data is sent to OpenAI, Anthropic, Google or any other AI provider — because nothing is sent to any third party at all.
Every quantitative claim in a draft carries the identifiers of the observations behind it, so you can check the arithmetic. A draft is never a final narrative until a person approves it.
Protections in place
- Encrypted at rest on the device — AES-GCM, device-only Keychain key.
- Encrypted in transit — TLS enforced; the app disables insecure
connections outright (
NSAllowsArbitraryLoads = false). - Account isolation — every query touching your data is scoped by account, so one teacher's roster cannot be read by another.
- Offline first — observations are captured locally and sync later, so a dropped network does not cost you data.
- Optional biometric lock — require Face ID when the app returns to the foreground.
- Deletion you control — delete a student, all student data, or your entire account from inside the app. Account deletion removes the records, not just the login.
What we do not claim
No SOC 2 report. No HIPAA attestation. "FERPA certified" is not a thing that exists — FERPA compliance depends on how a district uses a product and what agreement is in place, which is why district use needs a signed agreement rather than a badge on a website.
This product is designed with student-data privacy in mind and the controls above are real. Anything beyond that, ask and you will get a straight answer: [email protected].
Reporting a vulnerability
Email [email protected] with enough detail to reproduce it. You will get a human reply, and I will tell you when it is fixed. Please do not test against other people's accounts.