Updated 26 September 2026

What we keep, and for how long

This page says what this software keeps about students and teachers, where it lives, and when it goes away. It is written to be read by a student, by a parent and by a teacher — with no contract language in it.

One thing first: this software is installed and operated by each school on its own server. The data sits on that server, which belongs to the school. The school is who deletes it.

In the editor, on the teacher's computer

The editor collects nothing about students.

Projects, images and settings are kept in the browser on that computer, in a local database (IndexedDB). They pass through no server of ours.

If the teacher connects Google Drive, and only then, the files they choose are copied to their own Drive account. Nothing is sent without that connection.

On the school's server

This is where student data lives. Here is the real inventory.

A student's name, email and password in a saved class. The password is hashed with bcrypt and is readable by nobody, not even by whoever administers the server. There is no deadline: this stays until the teacher deletes the class.

Answers, scores and feedback from a session. When the session's window runs out — between 48 hours and 14 days, depending on what the teacher picked — the session is archived, not deleted. It stays on the server until the teacher deletes that session. There is no way to delete several at once: it is one at a time.

When the server runs on a MariaDB database, deleting a lesson deliberately keeps the results and corrections rows — they let the school study how the year went, and they no longer carry the file they belonged to. When the server runs on JSON files, deleting a lesson deletes everything. The school knows which mode it runs in; the difference is real, which is why it is written here.

Photographs of paper answers, and drawings, are stored with the lesson, not with the session. They survive "clear answers" and they survive deleting the session. They go only when the lesson goes.

Tour groups — the student's name, the time they stood at each stop, and the answers they gave in the guides — are deleted automatically 30 days after the last visit. It is the only automatic deadline on this server.

The audit log records who did what in administration: creating accounts, deleting lessons, deleting classes. It is deliberately kept even after the account it refers to is deleted — erasing the trail of a deletion would defeat the trail. Only an administrator can clear it, and clearing it clears all of it.

AI usage counters record how many characters went out and came back, per teacher and per model. They never keep the text. There is no way to delete them from inside the application.

Screen sharing is never recorded. It passes between devices while it is happening and is stored nowhere.

In the Android tour app

The app keeps the server address and the chosen profile on the phone. It keeps no credentials.

Bluetooth and location are used only to detect that the phone is near a beacon. The location is never sent anywhere. What reaches the server is only "was at stop N, at this time".

Artificial intelligence

This software uses AI to help the teacher write. There are four things worth knowing.

A comment shown to a student as "Teacher's comment" may have been drafted with AI help. The teacher reads it and signs it, and the responsibility is theirs — but the words may not be entirely theirs. That is why this paragraph exists.

There is an instant mode, off by default, in which the AI's wording goes to the student as soon as it is ready, without the teacher reviewing it answer by answer. With that mode on, the comment a student reads was not reviewed before it arrived.

Descriptive assessment goes to the AI under false names. Each student is sent as "Aluno 1", "Aluno 2" (Portuguese for "Student 1", "Student 2"), and the text is paired back up on the teacher's own computer. One honest exception: in the free-text note on records, the names of class students the server knows are replaced with "Aluno N" (or with "[nome]" when the student was absent or the name is not enough to tell who it is); any other name the teacher typed there goes as written.

If the school configures an external AI provider, the student's answer or the photograph of their sheet leaves this server for that provider. There are also local providers — models that run inside the school itself — which avoid this entirely. Which one is configured is the school's choice, and it is worth asking them which.

A right to human review. No decision about a student is made by the AI alone: the teacher decides. Any student or parent can ask the school to have a comment or an assessment reviewed by a person, and can ask to be told how that text was arrived at.

Visit statistics (only if this installation turns them on)

Whoever hosts the editor or the server can turn on Google Analytics to learn how many people visit them. An installation that does not turn it on sends nothing to Google, and the server schools download and install comes with it off.

On the server, it only runs on the teacher and administration pages — the entry page, My page, the lesson monitor, the admin console, the help and these legal pages. Never on the lesson and tour pages students open.

No cookie is stored until you press "Accept". The first visit shows a bar with "Accept" and "Decline". Until you answer, and after "Decline", Google only receives a cookieless signal that the page was opened, with no way to recognise the same person on a later visit.

What Google receives: the page visited, the page you came from, the browser and device type, the language, the screen size and the approximate region, inferred from the network address. With "Accept", also a random identifier kept in a cookie, used to count repeat visits. It receives no names, emails or session codes, and nothing typed into the pages. The data stays with Google, which handles it under its own rules, and the host only sees aggregate counts.

Changing your mind: the "Cookie preferences" button shows the bar again — in the editor, under Help, Privacy tab; on the server, at the end of this page. The choice is kept in the browser, and clearing the site's data in the browser clears it too.

Asking to see, correct or delete

Talk to the school that hosts this server. It is responsible for the data, it holds the administration accounts, and it is the one the law puts under a duty to answer.