Privacy

Jotty is five small classroom tools — Litmus, Scribe, Chalk, PeerLoop and Inkspill — built and run by me, Ben Davies, a teacher in Victoria, Australia. There is no company behind it, no investors, and no staff. This one policy covers all five apps; where they differ, the table below says so.

You can reach me about anything on this page through the help form.

When a teacher runs a session, the school decides what is asked, whether students put their names to it, and what happens to the results. The school is responsible for that decision, and for having the standing consents that schools already hold.

My job is to hold that data and hand it back — nothing more. I do not decide what a class is asked, I do not combine data across schools, and I do not use anyone’s classroom data for a purpose of my own.

If your school needs this stated as a formal arrangement before it can approve the tools, get in touch and I will put it in writing.

Every app collects a teacher account — an email address, a display name, and either a password or a Google sign-in. What is collected from students varies, and the differences matter:

A note on Scribe and Chalk

Scribe saves student writing continuously so a teacher can watch a draft develop, and it flags when a chunk of text is pasted in rather than typed. Chalk records whether a student’s tab is in focus while they are responding. Both of these are visible to the teacher running the session, and students should be told that before they start. Neither is a judgement — a pasted quote and a copied essay look the same to the app, and the teacher is the one who reads it.

A note on PeerLoop accounts

PeerLoop is the one app where students sign in, because peer review needs to know reliably who wrote what. A teacher types a class roster of first names, and each student sets a PIN on first use. The sign-in address behind that is generated by the app from a random slot ID — it is never a real email address, never shown to the student, and cannot be used to contact or identify anyone outside the class.

A note on Inkspill

Inkspill is a live quiz game. Students join with a game code and a nickname, and play as a small ink-blob character. Behind the scenes each student gets an anonymous sign-in so that a refresh does not knock them out of the game, but no name, email address or other detail is attached to it. Everything from a game — nicknames, characters, answers and scores — is deleted automatically within 24 hours. A teacher who wants to keep the results can download them as CSV when the game ends.

Inkspill teachers also write question sets, with their own images if they want them. A set is private unless the teacher chooses to share it, and a shared set is shown to every Inkspill teacher with the name of the teacher who made it. Teachers can report a shared set they think is wrong or inappropriate; the teacher who made it is not told who reported it. Uploaded images are only ever handed to people signed in to Inkspill, never through a public link.

One set uses images from past VCAA exams. Those are shown only to teachers signed in with a Victorian school staff address, and to their students while a game is running.

For each game, Inkspill keeps a usage record: which set was played, how many rounds, and how many students and answers there were. It holds no nicknames and nothing about any individual student.

Chalk has one feature that sends student work outside the apps entirely. A teacher can ask for an analysis of the responses a class has just given, to help them pick the one worth unpacking. The work goes to Anthropic, the company behind Claude, and is processed on their servers in the United States.

It is worth being precise about this one, so here is exactly what happens.

It only happens if a teacher asks

Nothing is sent automatically. A teacher presses a button, having first been shown a warning that says where the work is going — a warning they can turn off for themselves once they have read it, and turn back on from their account page. Students cannot trigger it, and never see the result. Litmus, Scribe, PeerLoop and Inkspill have no such feature at all.

Names do not go

Before anything leaves the browser, each student’s name is replaced with a placeholder — Student_1, Student_2, and so on. The list matching those placeholders back to real names stays on the teacher’s device and is never sent. When the analysis comes back it refers to Student_3, and the teacher’s own browser puts the name back. Anthropic receives the responses, the question the class was asked, and nothing that says who wrote what.

The limit of that, stated plainly

Swapping out the name field cannot clean up what is written inside an answer. If a student types their own name, or a classmate’s, into their response, that text is sent as written. For most tasks that never comes up, but it is a real limit rather than a theoretical one, and a teacher weighing this feature against their school’s policy should know about it.

What Anthropic does with it

Anthropic does not use work submitted through their API to train their models. They delete what is sent to them within 30 days; content their systems flag as violating their usage policy can be held longer. Those are their terms rather than mine, and they are the ones who keep them.

What comes back is kept

The analysis itself — a score, a couple of tags and a short reason for each student — is saved into the Chalk session alongside the responses, with the real names restored. So a Chalk session a teacher has run an analysis on holds a machine’s assessment of each student’s answer as well as the answer. That sits in Melbourne with the rest of the session, and is visible to the teacher who ran it. Deleting the session deletes it.

Student work in Litmus, Scribe, Chalk and PeerLoop lives in Google Cloud Firestore in the australia-southeast2 region — Melbourne. Inkspill’s question sets, reports, usage records and settings are in Firestore, and its images in Firebase Storage, both in the australia-southeast1 region — Sydney. Apart from the exceptions below, none of it leaves the country in the ordinary running of the apps.

There are six exceptions, and I would rather name them than bury them:

• Chalk’s live annotation and presence data is held in Google’s Realtime Database in asia-southeast1 — Singapore. This covers the response being annotated on the board, student names in the live participant list, and the typing and focus signals above. Google does not offer an Australian region for this particular product, which is why it sits where it does. The permanent record of a Chalk session is still in Melbourne.
• Inkspill’s live games run in the same Realtime Database product, so they are in asia-southeast1 — Singapore — for the same reason. That covers student nicknames, characters, answers and scores while a game is on, all deleted within 24 hours. Inkspill’s teacher records — each teacher’s name and email address, and the list of games they are running — are kept there too, because the game needs them to decide who may run one.
• Inkspill’s hourly clean-up runs on Netlify, on servers in the United States. It reads games older than a day only in order to delete them.
• PeerLoop’s PIN reset runs on a server in us‑central1 — Iowa, USA. It handles a student’s internal account ID at the moment a teacher resets a PIN. No classroom work passes through it.
• Sign-in itself is handled by Google’s authentication service, which is global rather than region-pinned. For teachers that means an email address; for PeerLoop students, the generated address described above; for Inkspill students, an anonymous ID with nothing attached.
• Chalk’s AI analysis sends student responses to Anthropic in the United States, but only when a teacher asks for one, and never with names attached. The section above sets out what goes and what does not.

Messages sent through the help form, or through the Help link inside Inkspill, are handled by Netlify and stored on their servers in the United States, as well as being emailed to me. That is why the form asks you not to put student names in it.

• The teacher who ran the session, and only their own sessions.
• Other students in the same class, where the app is built to do that — the one response chosen in Chalk, peer review in Scribe and PeerLoop, and nicknames, characters and scores during an Inkspill game. Inkspill never shows other students anyone’s answers.
• Other teachers, only in Inkspill, and only for a question set its teacher has chosen to share — the set, its images and the teacher’s name. Never anything from a game.
• Me. I can reach the data in order to run and fix the apps. Scribe and Inkspill have admin views that show usage across every teacher account; Inkspill’s also lists each teacher’s name and email address, and the shared sets other teachers have reported. I use it to see how the tools are being used and to find sessions that have broken — not to read anyone’s class work for interest.
• Google, as the company hosting the databases, under their own terms as a processor.
• Netlify, which hosts the sites, stores help-form messages, and runs Inkspill’s clean-up, under their own terms as a processor.
• Anthropic, but only for the responses in a Chalk session a teacher has asked to have analysed, only without names, and only for as long as their terms allow. Nothing from Litmus, Scribe, PeerLoop or Inkspill ever reaches them.

Nobody else. Beyond the three companies named above, all acting as processors under their own terms, there is no other party with access, paid or otherwise.

Sessions and student responses are kept until a teacher deletes them. Nothing expires on its own. A teacher can delete an individual session or question set at any time from their dashboard, and deleting a teacher account deletes every task, session and student response created under it.

Inkspill works the other way round for students. A game, with every nickname, character and answer in it, is deleted automatically within 24 hours of starting, whether or not the teacher comes back to it. The usage record described above, which holds no names, is kept.

Inkspill question sets are kept until their teacher deletes them. Deleting an Inkspill account removes any game still running, every set the teacher made (shared ones leave the library), every image they uploaded, and their teacher record. If any of that fails, the account itself is left in place so the teacher can try again, rather than leaving things half-deleted. Copies another teacher made of a shared set belong to that teacher, pictures included, and stay.

Two things outlive an Inkspill account. The usage records described above stay, but they hold no names, and once the account is gone nothing links them to the teacher. A report a teacher made about someone else’s set, which includes their email address, stays until I delete it, which I will if asked. Separately, deleting a single set, rather than the whole account, leaves its images in place; I clear them on request.

If your school needs data cleared at the end of a term or a year, tell me and I will do it.

There is no analytics, tracking or advertising code of any kind on the pages students use. No third party is told that a student visited, and nothing follows them off the site.

Teacher-facing pages use Google Analytics so I can see which parts of the tools are actually being used and where they are failing. It records the usual things — page, browser, approximate location from IP address — and it is never joined to any student data.

Inkspill has no analytics of any kind, on teacher pages or student ones.

• Sell, rent or share data with anyone.
• Show advertising, or profile anyone for it.
• Use student work to train AI models — mine or anybody else’s. Chalk’s optional analysis sends work to Anthropic to be read and answered, not to be learned from, and their terms say the same.
• Ask students for an email address, a phone number, or a date of birth.
• Contact students. Ever, for any reason.
• Track anyone across other websites.

Every app exports its session data as CSV from the teacher dashboard, so you can keep your own records without going through me. In Inkspill that download is on the results screen at the end of a game, and it is only there until the game is deleted the next day.

For anything else — a parent asking what is held about their child, a school wanting a class or a year cleared, or a correction to something stored — use the help form and I will deal with it within 30 days, usually much sooner. Requests about a particular student should come through the school, since I have no way to verify who a student is.

Everything is served over HTTPS. Database rules restrict each teacher to their own sessions, and restrict students to writing their own response and nothing else — in Inkspill, their own answers and score, and the power-ups they send to other players. Teacher passwords are handled by Google’s authentication service and are never stored by me or visible to me.

These are tools built by one teacher, not audited enterprise software. I have taken the care I would want taken with my own students’ work, but you should weigh that when deciding what to use them for.

If this policy changes in a way that affects what is collected or who can see it, I will say so on this page and change the date below rather than editing quietly.