Student data stays private, protected and in the school’s control

AI and your data

AI writes each shelf’s study material from the book, once, before any student sees it. While students study, it does one more job: it reads a student’s written answer (an explanation, a summary, a lesson they “teach”) and gives a guiding question back.

• No training. Anthropic doesn’t train its models on inputs or outputs from its commercial API (Anthropic). Search uses Amazon Bedrock embeddings of book text only; Bedrock doesn’t use that content to improve its models (AWS). Pictures are drawn by OpenAI’s image API from our own generated descriptions, never student data; OpenAI doesn’t train on API data by default (OpenAI). We don’t train models either.
• No identity. Requests carry the book’s text and the answer, never who wrote it. Emails, phone numbers and similar details a student types are removed before the answer is sent.
• Answers aren’t kept. We store the score and timing of each answer, not what the student wrote.

What teachers see

Teachers make a class for one shelf and share a join code. Before joining, a student sees exactly what will be shared and must agree. The teacher then sees, for that shelf only:

• The student’s name and email
• Minutes studied each day and when they last studied
• Chapters mastered and mastery-check scores
• Which study methods are working for them, and class-wide trends

Teachers never see what a student wrote, or anything from other shelves. Each time a teacher opens the dashboard or downloads it, we log it, and the student can see that log on their account page.

FERPA

When a school uses The Learning Library, student progress is part of the student’s education records. We act as a “school official” under the school’s direct control:

• We use student data only to provide the service to the student and their teacher, never for anything else.
• We don’t disclose it to anyone else, except the providers listed below that run the service for us, or where the law requires it.
• Students, parents and eligible students can review, download and delete the records at any time.
• Every teacher view of a student’s progress is recorded.
• When a school asks, we delete its students’ data.

COPPA and younger students

• We ask each new learner’s age group before storing anything about how they study.
• Under 13 (and under 16, to meet the stricter rules in the EU and UK), nothing is stored until a parent or guardian approves by email. Until then students can still read shelves, use flashcards and print tests.
• We collect only what Learn needs to work: answers’ scores and timings, never more.
• Parents can see, download or delete their child’s history, and can withdraw consent, by emailing us or from the child’s account page.
• No ads, no behavioural tracking, no sharing with third parties for their own purposes.

Security

• Encrypted in transit: HTTPS everywhere, with HSTS.
• Encrypted at rest: the database, its backups, and uploaded files.
• Private by default: uploaded books are never public; file storage blocks all public access.
• Least privilege: each part of the system has only the permissions it needs; passwords and keys live in a secrets manager, never in code.
• Audit log of every teacher view and export of student progress, and every export or deletion of a student’s data.
• Backups every day, kept for 7 days.
• Rate limits on uploads, AI use and class codes.
• Sign-in with Google or a one-time email link: we never store passwords.

SOC 2. We run on Amazon Web Services, whose data centres are SOC 2 audited, and our controls follow the SOC 2 Trust Services Criteria. We have not yet completed our own SOC 2 audit, and we won’t say we have until an independent auditor’s report exists.

If something goes wrong, we’ll tell affected schools and users promptly, and within 72 hours of confirming a breach of their data.

How long we keep data

• Learning history: until the student deletes it or their account.
• Class sharing: until the student leaves or the teacher deletes the class.
• Deleted accounts: removed from the live database at once, and from backups within 7 days.
• The audit log keeps ids and times only, no content, so the record survives the deletion it records.

Who runs the service for us