Privacy and security
Photographs of children's work are not training data
These are the questions worth asking of any tool that photographs children's work. The answers are on this page, not buried in a policy.
Is my child's work used to train your models?
No. Requests go out with provider retention switched off, and nothing is used for training — ours or anybody else's.
Who can see the photographs?
Only signed-in members of your own household or school. Images sit in private storage with no public link, and every query is scoped so one class never sees another's work.
What does the model actually get told?
The page, plus first names, nicknames and numbers for that one class. Never a diagnosis, never a scoring card's reason, and never another child's page in the same request.
Does a machine decide the grade?
No. Every score is a draft you confirm, and written answers are never scored by a model at all.
How long is it kept?
You set the period — two years to start with for a household, 180 days for a school. Work you've finalized is kept past it, which is what makes a portfolio. Deleting your account deletes the photographs and the scores with them.
What happens if the photograph is poor?
Nothing is graded. You're asked to look at the picture yourself rather than let a bad scan cost a student points.
Who can change a score, and can I tell?
Teachers and administrators. Assistants can photograph and match but not confirm, finalize or discard. Every change is recorded with who made it and when.
Can a paper be deleted?
Yes. A teacher or administrator can throw one away — the photographs go with the row, and the deletion is recorded. A finalized grade has to be unfinalized first, deliberately, because it is a record.
Storage and access
Photographs are held in private storage with no public link. Access is granted per household or school, and read through queries scoped to that one class.
Audit
Who confirmed a key, who edited a score, who marked a paper final, who discarded one — all recorded, and visible to an administrator.
Schools
A data processing agreement is part of a school quote. Tell us what your district needs signed and we'll work to it.
Asking us something
A person answers. If a question here isn't answered plainly enough, that's a fault in this page and worth telling us about.
How long it is kept
You set a retention period: 180 days by default for a school, two years for a homeschool, and anything from one day to ten years. A daily job deletes photographs and scores older than that.
Finalized work is kept past it. That is on by default, and it is the setting that matters if you are building a portfolio: a paper you have finalized stays, and a paper you graded but never finalized is deleted on schedule like everything else. Two years is what Florida §1002.41 asks a home-education family to keep, and it is why a household starts there rather than at 180 days.
Deleting a student deletes their submissions and images with them. Exports you have already downloaded are yours and are not touched by any of this.
A single paper can be thrown away without waiting for a retention date, by a teacher or an administrator; an assistant cannot. The pages leave storage with the row and the deletion is recorded. A finalized grade has to be unfinalized first — two deliberate acts rather than one, because a finalized grade is a record.
What US law asks
FERPA (20 U.S.C. § 1232g) binds schools that receive funding from the US Department of Education. Most homeschools and many private schools are not covered by it at all. Where it does apply, a service like this one handles education records as a school official under 34 CFR § 99.31(a)(1): the school keeps direct control, the records are used only for the educational purpose the school asked for, and they are not redisclosed. That is how this is built.
COPPA covers personal information collected from a child under 13. No child signs in here and nothing is collected from one. An adult types the names and an adult holds the camera; the photographs are of work, not of faces. A child's name is stored because a parent or a teacher entered it, and it is deleted when they delete the student.
A person makes every grade. Virginia and Connecticut have both told schools that an AI system must not decide a final grade on its own. Nothing here does: every score arrives as a draft for a teacher to confirm, and written answers are never scored by a model at all.
Who else touches it
Cloudflare — Workers for the application, D1 for the database, R2 for the photographs, and Email Routing for sign-in links. Hosted in the United States.
xAI, reached through Cloudflare AI Gateway, reads a page image and returns what it can make out. Requests are sent with provider-side retention switched off, so the images are not kept there and are not used to train anything.
There is nobody else. No analytics service, no advertising network, no third-party embeds.
A school that needs a data processing agreement can ask for one from School settings once you are signed in. It is drafted and signed by people, not generated; what is on this page is what the software already does, and that is the factual half of one.
This page describes how the software behaves. It is not legal advice. If your school is covered by FERPA, GDPR or a state student-privacy law, those obligations are still yours.