Security and privacy
Where student data lives, and what we will not do with it.
Written for the person at a district who has to sign something. No marketing in this page.
Where the data is
Every record the platform creates lives in the database of the WordPress site running it. Words, cards, review history, hooks, classes, assignments and grades. There is no separate cloud service holding a copy.
What leaves the building
By default, nothing. There is one exception and it is opt in: if an administrator configures hook generation with an API key, then when a learner presses generate, the single word being worked on, its meaning and the target language are sent to that provider. No name, no email, no class, no review history, no identifier.
- Generation is off until a key is added
- A per person daily cap and an account wide monthly cap are both enforced
- The built in sound-alike engine writes hooks with no external call at all, so a district can run the whole product with generation switched off and lose no core function
What we will never do
- Sell or share student data with anyone
- Serve advertising, to anybody, ever
- Put third party trackers on a page a student loads
- Use student work to train anything
What a student sees about other students
Nothing. There is no class leaderboard and no student to student visibility. A teacher sees their own class. An administrator sees counts, not content.
Accounts and access
- Authentication is WordPress authentication, so your existing password policy, two factor plugin and session settings all apply
- Teacher permissions are a capability, granted deliberately, not a self serve toggle
- Every write goes through a nonce checked API and every database query is prepared
Retention and deletion
- Review logs older than four hundred days are pruned automatically, which keeps a year of reporting and no more
- A learner can export everything they own as JSON at any time
- Deleting an account removes its records; removing a student from a class removes only the class link
What we do not have
No SOC 2, no ISO 27001, no third party penetration test. We are new and those cost real money. What we do have is a small, auditable system where every one of the claims above can be checked in the code by your own staff. If a certification is a requirement for your district, say so on the quote form so it can be weighed properly.
Ask the awkward questions
A straight answer now is cheaper for both of us than a procurement surprise later.