How we handle a child's data
— collection, encryption, retention, deletion
Avatar Coach uses a camera, so the first question any school asks is what leaves the room. This page states plainly what is collected and what is not, where it is stored and how it is protected, and when it is deleted.
Face photos are never stored
A child's face photos and video never reach the server — not one byte. Face recognition finishes inside the browser on the classroom whiteboard, and what travels to the server is seven numbers.
The browser locates facial landmarks in the camera image and computes a seven-dimensional distance vector, normalized by the distance between the eyes. It is not something a person could look at and identify a child from; it exists only to compare against the children already registered in that class.
Not being a photo does not make it casual. Because the vector has to be compared back for sign-in, it cannot be replaced with a one-way hash. Protection therefore comes from encryption and access control. Guardian consent before registration is a required operational step.
What is collected, and what is not
| Collected | Not collected |
|---|---|
|
Name, entered by the teacher Face feature vector (seven numbers) Session records — activity, level, success rate, duration Trial records — success, prompts, response time Behavior incidents a teacher logs directly |
Face photos or video — never sent to the server Audio recordings — never stored National ID numbers, addresses, contact details Location data Anything about other apps or files on the device |
The same holds for camera-based activities such as mirror play and expression matching. Posture and expression are judged inside the browser; the video does not leave the device.
There is a facility for storing numeric features for research and improvement, but it is off by default, and even when enabled it stores values computed from coordinates, never imagery. Turning it on is a decision made with the institution.
How it is stored — encryption and access control
- Encrypted at rest — face feature vectors are not stored in the clear. The encryption key lives in a server environment variable rather than in code, and a deployment check refuses to start production without it.
- Only behind teacher sign-in — every API touching a child is reachable only after a teacher signs in. An unauthenticated request cannot get near child data.
- Scoped to the teacher's own class — a teacher can view and match only students in their own class. Another teacher at the same school does not see them.
- Protected in transit — production is HTTPS only, and any state-changing request carries both session authentication and token verification.
- Where it lives — data is hosted on servers in the Republic of Korea.
How a child enters an activity is a selection, not an authentication. The teacher signs in first; from that screen the child taps their own tile or is recognized by face. Children do not have accounts.
When it is deleted
- Retention — for as long as the child is enrolled and using the product. Deleted on graduation, transfer, end of use, or withdrawal of consent.
- Deleting the profile deletes the biometric data — removing a student profile automatically removes the face credential with it. Code enforces this so that a half-deleted state, where the profile is gone but the vector remains, cannot occur.
- Deleting only the face data — a class can keep the student's records and remove just the face data. That child is then excluded from face matching and enters by name tile.
- Withdrawal of consent — the steps above run immediately on request.
What reaches the AI
Report text is written by a generative model, but a child's real name is never sent to it. Names are substituted before the request and restored only in the finished document. Substitution runs in two layers — at aggregation and again immediately before the request — and it also scans free text a teacher typed. The behavior is pinned by regression tests, so if a later change breaks it, the tests fail.
What goes to the model is a substituted name and numbers: success rates, prompt counts, response times. Face vectors, photos, and video never reach it. The safeguards are described in full on the IEP behavior report page.
If you are evaluating the product
- Guardian consent — required before face registration. It should state what is collected (a seven-dimensional vector; no photo retained), the purpose (sign-in), retention, deletion, the right to withdraw, and a contact. Use your institution's standard form.
- Face recognition is optional — you do not have to use it. Running with name tiles alone collects no biometric data at all. Roughly half of our current classrooms do exactly that.
- Camera placement — position the whiteboard camera so other children do not fall inside its field of view. The video is not stored, but it is visible on screen.
- Account handover — when a teacher changes, move the account permissions too. Access scope is attached to the account.
Frequently asked questions
No. You can run entirely with name tiles, in which case no biometric data is collected.
No. Photos and video are never transmitted. Only the seven numbers computed in the browser are stored, and they are encrypted.
No. Access is scoped to the teacher's own class, and data is never mixed between institutions. We do not share data externally or use it for marketing.
Their data becomes subject to deletion. Removing the student profile automatically removes the face credential with it.