Safety & the teacher gate
Nothing a student reads comes from software alone. Here is the machinery behind that sentence.
The gate
Every reply is read and approved by the teacher before it prints. This is enforced by the server: in our database, a letter cannot reach the approved state except through the teacher's own signed action. There is no bulk approval, no auto-approval, and no deadline that approves anything by itself.
No channel
Students have no accounts. The classroom writing station is write-only — it sends letters and shows nothing back. Replies exist on paper, handed out by the teacher. A student can never chat with the AI, and no feature we ship will ever open that channel.
Screening before the teacher
Every student letter is screened before any reply is drafted, by our own child-specific classifier — letter text is never sent to an outsourced moderation service. When a letter needs care, the reply is constrained or paused; a serious concern stops drafting entirely and surfaces to the teacher alongside the school's own safeguarding protocol, which the teacher records at setup.
If something goes wrong
If a breach ever touches class data, families are notified through the school within 24 hours. Consent comes first, not after: the permission kit and consent ladder go home before the first letter cycle begins.