Privacy & trust

Student names stay with you

Students join with a class code and a device-local nickname, without an account or email. Scholar stores a numbered label, locked access codes and submitted work. Your roster names and optional email addresses are encrypted on your computer before the locked copy is saved. Unlocked names stay only in the open page’s memory. Your passphrase and Recovery Kit never go to Scholar. If you lose both, we cannot recover the names.

No advertising trackers in the app

We do not install advertising pixels, analytics trackers or session replay. A teacher’s sign-up source tag may be stored on that teacher’s account to count which lesson or ad brought them here. It is not a student identifier and is not sent to advertising companies. Hosting still processes ordinary requests and operational error reports; “no trackers” does not mean no hosting logs.

Focus safeguard

During practice, writing and exit tickets, Scholar can notice when a student leaves the lesson page (after a short grace period) or pastes a large block of text. It records only the event type and time — never the screen, keystrokes, or anything outside the page. Teachers choose per class: off, notify, or lock after three leaves (the teacher can unlock). Students see a gentle reminder to keep their own thinking on the page.

Voice mode

When a teacher turns on “Teach for me”, Scholar turns the lesson’s spoken scripts into audio. Scripts contain lesson content only; they pass the same name filter before any voice service sees them. ElevenLabs receives only that lesson text — never student data. Audio is saved once per script and voice and replayed from storage. A teacher may add their own ElevenLabs key; it is stored encrypted, never shown again, and used only for that teacher’s narration. If natural voices are unavailable, the device’s built-in voice reads the script on the device.

Scholar Quest

Quest rounds use the lesson’s own questions. Scholar records only the class, the numbered device label, the skill, whether each answer was right, and earned points. There is no chat, no purchases, no ads and nothing outside the class. Leaderboards are off by default; when a teacher turns one on, it shows numbered class labels, and each student sees their own nickname only on their own device. The server never stores nicknames.

Lesson import

Teachers can upload Word, PowerPoint or PDF files, or pick files from their own Google Drive. Google access uses a short-lived “only files you pick” permission in the teacher’s browser; Scholar never receives a long-term Google token. File text is name-filtered before AI conversion, and the original file is not kept — only the converted lesson and, for Drive files, a link back.

AI without account identity

AI requests do not contain account IDs, emails, roster mappings or access codes. Before sending lesson or submitted text, a conservative filter removes detected names and contact details. Detection is not perfect: do not paste personal details. Provider storage is disabled in requests; this is not an independently verified zero-retention or no-training guarantee. Our AI usage records contain only feature, model, token counts when available, time taken and success—not prompts or answers. Provider agreements still require review before launch.

Teacher account protection

We strongly recommend an authenticator app for teachers. Owner access requires a verified authenticator sign-in, including owners who have not enrolled yet. Once enabled, it is required to read protected classroom data or run protected actions. Signed-in pages sign out after 15 minutes without activity. This is a browser-enforced timeout, not a hosted server-session or refresh-token inactivity expiry. The available hosting controls do not let this app configure a 15-minute server-side inactivity cutoff. Our password sign-in form allows five attempts per account in 15 minutes and 30 per network. These are additional app-form limits, not a replacement for hosted sign-in protections; direct hosted sign-in endpoints cannot be given a stricter quota by this app. An open roster key also locks after 15 minutes without activity.

Access records

An append-only access log records gradebook opening, exports, deletion requests and sharing changes. It is separate from anonymous company metrics. Teachers can access their own records; company staff may access records for security. No roster names or work content are written to this log. Access records are retained for two years. AI-usage and translation records are retained for 90 days; a daily cleanup removes older records.

Export and deletion

Teachers can export CSV, JSON and student-work PDFs, regardless of account access. PDFs are generated on your computer. Removing a student deletes their work. Class and account deletion have a 7-day undo period; after that, daily cleanup removes class and account application data, including class-owned lessons and child records. Authentication account removal uses a separate authenticated daily callback that must be published to run. Cleanup can run up to 24 hours after the undo deadline. Archived classes default to removing student work after 12 months, unless you switch retention off. Inactive free-account cleanup is currently OFF; it will require warning emails before activation.

What backups really cover

Lovable Cloud documents one daily database backup and up to roughly 14 days of retained daily snapshots. That is the documented retention window, not a guaranteed deadline for erasing a particular deleted record. We cannot promise “deleted data leaves all backups within 14 days” or verify this project’s snapshot inventory here. Database backups do not include stored files. Restoring an older snapshot can restore previously deleted database records; deletion must be reapplied after a restore. We will confirm a contractual deletion deadline before making a stronger promise.

Service providers

Lovable Cloud provides hosting, classroom storage and teacher sign-in. The Lovable AI Gateway and its model provider process scrubbed lesson content. Google and Apple may handle teacher sign-in when selected; Google also handles Drive picking when a teacher uses it. ElevenLabs (voice) receives scrubbed lesson scripts for narration. We do not sell student data or display student ads.

Before launch

Provider retention terms, the final school agreement and legal review remain outstanding. This page describes implementation and known limits, not an independent security certification. Scholar is provided by theveteraneducators AI LLC (Nyclogic AI™).