Privacy, in plain language.

1. Information we handle

Pictures in assessment papers

PNG/JPEG pictures you choose are compressed on your device and embedded in the paper. They remain in this browser until you save or share them. Saving a personal draft or downloading JSON includes the pictures; sending it to school stores them with the paper and its versions. The app does not send uploaded pictures to Google for image recognition. Do not upload children’s photographs, personal records or pictures you do not have permission to use. Earlier school versions and downloaded backups retain their embedded pictures.

2. Why we use it

We use this information to generate the assessment you request, let you save and reopen work, verify and manage accounts, apply school permissions, create and validate invitations you choose to share, support review and approval, prevent abuse and investigate faults.

The app does not automatically email school invitation links. A principal chooses whom to invite and shares the generated link. Account verification emails are handled by Supabase’s configured email service. Delivery is restricted during the pilot until a production sender is configured.

No advertising or marketing analytics tools are installed in the current TermQuill application. School activity records describe workflow events; they are not a score of teacher quality. Principals can search and download loaded activity records, which can include staff email addresses. A print-request record identifies the requested copy and version, but does not prove a print completed. Verification requests and decisions remain with the school records under the retention limitations below.

3. Who can see school information

• Principals can oversee the school’s departments, members, invitations, papers and activity records.
• Department heads can see and review papers in their assigned department.
• Teachers can work on their own papers and read the approved copies shared with their department. A teacher cannot approve their own paper.
• Technical administrators, including the operator and authorised infrastructure providers, may have administrative access needed to operate, maintain or support the service. Application permissions do not make data invisible to database administrators.

School principals can submit a public school reference and an explanation of their authority for an independent operator check. Creating a workspace does not verify ownership. New invitations require a verified school; pre-existing invitations keep their original validity rules. Verification is an identity check, not accreditation or a security certification. Creating an account alone does not give access to another school. Shared access depends on current school membership and department. Schools should only invite appropriate colleagues and avoid sharing invitations publicly.

Students cannot create student accounts or submit assessments in the current pilot. TermQuill is intended for adult educators preparing learning materials.

4. Services used to run TermQuill

Google provides hosted AI generation using Gemma through its API. The notes, past-question references, topic instructions and settings you send for generation are processed there. Topic mode uses model knowledge without browsing and produces answer rationales rather than verified source quotes. Saving or sharing a paper retains its topic brief and rationales alongside the questions. Google’s data use depends on the service and billing configuration. Its unpaid-service terms allow use of submitted content and outputs for service/model improvement, including human review; paid-service terms describe different treatment. We have not verified the billing configuration of every request. Do not assume zero retention or that content cannot be used for model improvement. See Google’s API terms.

Supabase provides authentication and the school database. The current database is hosted in US East (Northern Virginia). Provider operations may involve other locations. See the Supabase privacy policy.

Vercel hosts the website and server endpoints and processes operational request/log information. See the Vercel privacy notice.

These providers have their own retention and operational practices. This policy does not promise a particular provider deletion deadline or legal hosting arrangement. Schools should review their requirements before putting institutional information into the pilot.

5. Cookies and information on your device

School sign-in uses essential session cookies named lp_access and lp_refresh. They are HttpOnly and same-site, and use the Secure flag in production. The access cookie lasts up to one hour; the refresh cookie is set for up to seven days and may be renewed when the session refreshes. Sign out clears the app’s session cookies.

Browser local storage holds personal drafts and the last selected school. Personal drafts remain until you remove them or clear browser data. Other people using the same browser profile may be able to open them.

Browser session storage may temporarily hold a paper you choose to transfer to a school, or an invitation awaiting acceptance. A successful paper upload removes the transfer copy from session storage. This storage is normally limited to that tab’s session.

Downloaded backups and printed or saved PDF files are outside the app’s storage. Clearing browser storage or removing a member does not delete those files. This pilot does not add advertising or optional analytics cookies.

Location, only when you choose it

Device location is optional. School location and Find schools request a single position only after you choose their location button and your browser permits access. Browser/device location can use GPS or network signals, can be inaccurate, and does not prove school ownership. You can enter coordinates manually. There is no background location watching or location history feature.

Nearby searches: your precise search point stays in the current page’s memory and is not saved to your account or browser storage by TermQuill. The page sends a bounding area based on a coarse grid, roughly a tenth of a degree, to the TermQuill directory service. Approximate search areas, IP addresses and request metadata may be processed by hosting providers. Forget my search location clears the point from the page; browser location permissions are managed separately in your browser. Search points are not sent to the AI provider.

School points: a principal reviews and confirms a school point before saving. This sends the coordinates, town/area, source, optional device-reported accuracy and visibility choice to the school database. Current authorised school members can see the saved point; only the principal can change it. Do not save a personal home or temporary device location as your school. Activity records log location actions and versions, without copying coordinates into the application’s audit details.

Public directory: listing is off by default and requires an independently verified school identity plus the principal’s explicit opt-in. Public results contain the school name, town/area and coordinates rounded to three decimal places, approximately 100 metres. Anyone can read and copy these results. Rounding does not make a school anonymous. The listed point is supplied by the school, not independently GPS-certified. Staff accounts, email addresses, notes, papers and full stored point precision are not included in directory results.

Maps: TermQuill uses external OpenStreetMap marker links instead of loading third-party map tiles automatically. Choosing one sends that school or preview point to OpenStreetMap and opens its website; the link does not include your nearby-search position. Their site handles that visit under its own policies. Imported marker links are parsed locally and are not fetched by the app.

A principal can turn off listing or remove the saved point from School location. Removal deletes the active location record and directory entry, while action records and provider backups may remain. Copies previously obtained by others cannot be recalled. Other school-record retention limitations below still apply.

6. How long information stays

There is currently no automatic expiry schedule for school records or accounts. Papers, earlier versions, reviews and school activity records stay in the school database unless removed through an administrative process. Saving a new version preserves earlier versions; it does not overwrite them.

Invitations expire after seven days, but their history may remain. Removing a member stops their workspace access and preserves school papers and activity records. It does not automatically erase their account or previously downloaded copies.

The app does not currently offer self-service account or school-paper deletion. For a request to access, correct, export or delete stored information, follow the contact steps below. We may need to confirm your identity and authority, coordinate with the school, or explain why a record needs to be retained or de-identified. Provider logs and any provider-managed backup copies are governed by their own systems and policies; we do not promise immediate erasure from every system.

Account and workspace boundaries

Sign-in is required for working tools and assessment generation. Public visitors can explore a read-only sample. Your name and self-described occupation are stored with your account profile; occupation does not grant school permissions. School membership and roles come from authorised school setup or email-matched invitations.

Personal lesson notes can be saved to your private account in Supabase and loaded on other devices. Drafts and saved questions currently remain in this browser under an account-specific key. Personal cloud lessons are not accessible to school managers through the app unless you deliberately share their contents in school work. This browser storage is not encrypted: other people with access to the browser profile or its developer tools may read it. Sign out on shared devices, keep backups private and clear local browser data when appropriate.

Cloud lessons require an internet connection. Unsaved editor text is not an offline backup. Removed cloud lessons are recoverable for seven days; expired items are cleared on the next library change. Active cloud lessons do not expire automatically. Backups of active notes exclude recently removed items. Earlier anonymous browser work is never automatically assigned to an account. You can explicitly copy your own earlier work through My workspace. Original copies remain until removed using browser data controls. Do not claim another person’s work.

Educator access review

Working tools require approved educator access, verified membership of an independently verified school, or a separately recorded platform-operator exception. Email verification and occupation choices alone do not verify professional status. The educator request records your professional name, role, school or organisation, subjects or responsibilities, education levels, teaching context and optional public reference. The platform operator reviews this information; requests are not sent to schools automatically. Corrections and resubmission are supported. Do not provide government identification, student records, private credentials or confidential examination material.

Requests, reviewer decisions and review notes remain in the database for access administration until handled through the privacy-request process. Operator access is not an educator or school accreditation. Cloud storage is not end-to-end encryption: authorised platform operators and hosting providers administer the service. School managers have no app permission to browse personal cloud libraries.

7. Your choices and pilot limits

• Use a signed-in personal workspace without creating or joining a school.
• Avoid generation if you do not want your notes sent to the AI provider. You can explore the hand-authored sample instead.
• Keep a paper on your device, or explicitly choose Send to school when you want it stored and shared there.
• Download an editable backup. Delete a personal draft from My drafts or clear the site’s browser data when appropriate.
• Ask your principal to correct school membership or revoke an unused invitation. Contact the operator for requests the app cannot perform itself.

Do not submit student names, contact details, health information, personal grades, identity records, confidential live exams or other sensitive records. This is an educator preparation pilot, not a student records system or a certified compliance platform.

We use access checks, verification, secure session settings and restricted database access. No service can promise absolute security. We have not claimed an independent security certification, school accreditation or compliance with every institution’s legal requirements.

8. Questions, requests and changes

Paul Ayoade David is the operator responsible for TermQuill. For a privacy request, start through TermQuill project support and ask for a private contact route. You can ask your school principal to coordinate this first contact.

GitHub issues are public. Keep that first message minimal. Do not include passwords, verification links, student information, lesson notes or other private records. Identity checks and any sensitive follow-up should take place through a private channel arranged with the operator. A dedicated private privacy-contact address is not yet published for this pilot.

We will update this page when the service’s data handling changes. Check the date at the top for the current version. This policy describes the implemented pilot; planned features will require their own review before launch.