Security

Your data

• Encrypted everywhere. Every connection uses HTTPS, and the database and file storage are encrypted at rest.
• Only our server can reach it. Your browser never talks to the database directly. Every table has row-level security switched on with no access for browser keys, and the storage for your uploads is private, opened only through short-lived links for your own files.
• Every request is checked. Pages and API routes confirm who you are with the sign-in server on every request, not just from a cookie, so a removed account loses access immediately.
• No raw SQL from user input. All database access goes through parameterised queries, and automated checks reject code that would build queries from text.

Your account

• Passwords are at least 10 characters, and are stored only as bcrypt hashes by our sign-in provider. We can never see them.
• New accounts confirm their email address before they can sign in.
• Repeated failed sign-ins are rate-limited.
• Password resets use one-time links that expire.

Payments

Payments are handled entirely by Stripe, which is certified to PCI Service Provider Level 1. Card details are entered on Stripe’s own pages and never touch our servers. We keep only your plan, its status and Stripe’s customer id.

AI and generated visuals

• Lessons are generated through Anthropic’s API using a server-side key; the key never reaches your browser. Anthropic doesn’t train its models on data sent through its commercial API.
• Interactive components the AI writes for a lesson run in a sandboxed frame with a strict content security policy: no network access, no access to your account, and no way to read the rest of the page. Each one is checked before it’s shown, and its contents are verified by hash every time it loads.

How we work

• Secrets live only in server-side environment variables, never in code or the browser.
• Spending limits on every account, and on the app as a whole, stop runaway or abusive use.
• Automated tests guard access rules, database permissions and the sandbox on every change.

See the privacy policy for what we collect and which services process it.

Reporting a vulnerability

If you think you’ve found a security problem, please tell us privately: sign in and use Send feedback in the app, with steps to reproduce it. We’ll acknowledge your report within three working days and keep you updated while we fix it.

While investigating, please use only your own accounts, don’t access or change other people’s data, and don’t degrade the service for others. We won’t take action against research done in good faith within these limits.