Security program

Effective 2026-11-02. How Teach Me protects children's and families' information. Questions or a security problem to report: [email protected].

Who is responsible

Sati Hillyer, who runs Teach Me, is responsible for this program: putting it in place, checking it works, and fixing what does not.

Collect less

The less we hold, the less can leak. We do not collect children's last names, birthdays, photos, voice, location, contacts or school names. Children never type an email address or a password. Test photos are read and discarded, never stored.

Safeguards

Passwords and PINs are stored only as one-way hashes (PBKDF2 with SHA-256, 100,000 rounds, salted per account). Nobody, including us, can read them.
Sign-in uses a signed cookie that scripts cannot read, sent only over encrypted connections. Repeated wrong passwords and PINs are slowed down and locked out.
Encryption: the app is served only over HTTPS. The database is encrypted at rest by Cloudflare and is not reachable from the internet; only the app's own code can query it.
Access: only the operator can open the admin console. It needs a long secret key and locks after repeated failures. The operator looks at family records only to run the service, answer a parent or fix a problem. Accounts that can reach production (Cloudflare, GitHub, Anthropic, Resend) use two-step sign-in.
Keys and secrets are kept in Cloudflare's encrypted settings, never in the code.
AI: hints send no personal information. Text typed into Ask has names, emails, phone numbers, links and addresses removed before it is sent. Ask and test photos need a parent's separate consent, and for children under 13 a one-time check that the person agreeing is the parent.
Changes: every change to the app runs an automatic test suite (thousands of checks, including privacy and accessibility checks) and goes live only if all of them pass.

Service providers

We use only the providers named in the privacy policy. Each gets only what it needs for its part and may not use it for anything else. Before adding a provider that would receive children's information, we check its security and privacy terms and update the privacy policy first.

Checking and updating

At least once a year, and after any incident or major change, we review what we hold, who can reach it, and whether these safeguards still fit. We fix what the review finds.
Deleted and expired data is removed by an automatic daily job; see the data retention policy.

If something goes wrong

Stop it: lock the affected access, rotate keys, take the feature offline if needed.
Find out what happened, which families were affected and what data was involved.
Tell affected parents and students by email as soon as we can, and within the time the law requires, with what happened and what they can do.
Fix the cause and record what we changed.