Updated 7 September 2026

What we keep, and for how long

This page says what this software keeps about students and teachers, where it lives, and when it goes away. It is written to be read by a student, by a parent and by a teacher — with no contract language in it.

One thing first: this software is installed and operated by each school on its own server. The data sits on that server, which belongs to the school. The school is who deletes it.

In the editor, on the teacher's computer

The editor collects nothing about students.

Projects, images and settings are kept in the browser on that computer, in a local database (IndexedDB). They pass through no server of ours.

If the teacher connects Google Drive, and only then, the files they choose are copied to their own Drive account. Nothing is sent without that connection.

On the school's server

This is where student data lives. Here is the real inventory.

A student's name, email and password in a saved class. The password is hashed with bcrypt and is readable by nobody, not even by whoever administers the server. There is no deadline: this stays until the teacher deletes the class.

Answers, scores and feedback from a session. When the session's window runs out — between 48 hours and 14 days, depending on what the teacher picked — the session is archived, not deleted. It stays on the server until the teacher deletes that session. There is no way to delete several at once: it is one at a time.

When the server runs on a MariaDB database, deleting a lesson deliberately keeps the results and corrections rows — they let the school study how the year went, and they no longer carry the file they belonged to. When the server runs on JSON files, deleting a lesson deletes everything. The school knows which mode it runs in; the difference is real, which is why it is written here.

Photographs of paper answers, and drawings, are stored with the lesson, not with the session. They survive "clear answers" and they survive deleting the session. They go only when the lesson goes.

Tour groups — the student's name, the time they stood at each stop, and the answers they gave in the guides — are deleted automatically 30 days after the last visit. It is the only automatic deadline on this server.

The audit log records who did what in administration: creating accounts, deleting lessons, deleting classes. It is deliberately kept even after the account it refers to is deleted — erasing the trail of a deletion would defeat the trail. Only an administrator can clear it, and clearing it clears all of it.

AI usage counters record how many characters went out and came back, per teacher and per model. They never keep the text. There is no way to delete them from inside the application.

Screen sharing is never recorded. It passes between devices while it is happening and is stored nowhere.

In the Android tour app

The app keeps the server address and the chosen profile on the phone. It keeps no credentials.

Bluetooth and location are used only to detect that the phone is near a beacon. The location is never sent anywhere. What reaches the server is only "was at stop N, at this time".

Artificial intelligence

This software uses AI to help the teacher write. There are four things worth knowing.

A comment shown to a student as "Teacher's comment" may have been drafted with AI help. The teacher reads it and signs it, and the responsibility is theirs — but the words may not be entirely theirs. That is why this paragraph exists.

There is an instant mode, off by default, in which the AI's wording goes to the student as soon as it is ready, without the teacher reviewing it answer by answer. With that mode on, the comment a student reads was not reviewed before it arrived.

Descriptive assessment goes to the AI under false names. Each student is sent as "Student 1", "Student 2", and the text is paired back up on the teacher's own computer. One honest exception: the free-text note on behaviour records goes exactly as the teacher wrote it — if they typed a name in there, the name goes.

If the school configures an external AI provider, the student's answer or the photograph of their sheet leaves this server for that provider. There are also local providers — models that run inside the school itself — which avoid this entirely. Which one is configured is the school's choice, and it is worth asking them which.

A right to human review. No decision about a student is made by the AI alone: the teacher decides. Any student or parent can ask the school to have a comment or an assessment reviewed by a person, and can ask to be told how that text was arrived at.

Asking to see, correct or delete

Talk to the school that hosts this server. It is responsible for the data, it holds the administration accounts, and it is the one the law puts under a duty to answer.