How access is controlled
- Every screen requires a signed-in account, and each account has one role.
- Database rules are enforced on the server: a student can read only their own records, plus class-wide content such as topics and exam dates.
- Leaderboards are served by a restricted database function that returns only names and XP totals for your own class.
- Roles are stored separately from profiles, so a user cannot promote themselves.
- Uploaded notes and profile pictures live in private storage served via signed links.
Keys and credentials
The app's browser code contains only the public, publishable API key that is designed to be visible and is powerless without a valid session and matching database rules. Private credentials — the service key, AI keys and messaging keys — are stored as server-side secrets and are used only inside server code. They are never bundled into the app you download.
Account protection
- Passwords are stored hashed by the authentication service, never in plain text.
- Passwords found in known public breaches are rejected at signup.
- Anonymous sign-in is disabled; write requests are protected against cross-site abuse.
- Automated endpoints, such as the weekly test job, require a secret key to run.
Report a problem
If you believe you have found a security or privacy problem, please report it to the school principal or your class teacher instead of sharing it publicly, and include what you did and what you saw. Please do not access, alter or download other people's data while testing.