Security

Last updated: October 18, 2026

Your family trusts Owlbert with children's schoolwork, so here is, in plain words, how we protect it and where the limits are. We would rather tell you what we do not do than overpromise.

The short version

Owlbert's servers process your scans to read them, then lock them so only you can open them. While a scan is being read, our server can see it. After that, the photo or PDF, the text we read from it and our written feedback are stored locked to a key that belongs to your family, and our server can no longer open them. Locking scans this way is rolling out family by family: until your family has set up its key, your scans stay on our server and we can read them.

What is protected, and when

Your content (scan images and PDFs, what we read from them, written answers, our feedback that quotes them) is what we lock after reading. Only your devices can open it again.
Learning data (which skills your child practised, whether answers were right, points, time, reports) stays readable by our server, because Owlbert needs it to plan practice and build reports. This includes the practice questions we write that are modelled on mistakes in the homework.
Your account (name, email) is stored in our database. Passwords and PINs are stored only as one-way hashes.
Our own secrets (service keys, API keys you add) are encrypted at rest and are never shown again in full.

What we send to the AI model

We add no names, email addresses or family identifiers to what we send. We refer to "the student".
Anything written on the homework itself, such as a name, school or teacher, is visible to the model, because the model reads the page. If that matters to you, cover it before you scan.
We do not keep the prompts or the model's replies in our logs; we log only counts and timing.
Reading is done by Anthropic's Claude (United States). Under Anthropic's API terms, data sent through the API is not used to train their models. If you add your own Anthropic key, your key and Anthropic's terms for it apply.

Who else handles data

These companies act for us as processors:

Anthropic: reads scans and grades written answers.
Fly.io: runs the app and database (United States).
Cloudflare: receives homework you email in, and passes it to us. It sees that email while it is in transit.
Resend: sends our emails (verification links, confirmations, reports).

What this does not protect against

Locking protects your scans if our database or our backups are stolen later. It does not protect against someone who has taken over our running service, or against us, the operators: in a web app, the party that serves the code could change the code. While a scan is being read, and when you ask us to "read again", our server can see it.
Deleted data lingers briefly in backups. Our backups are encrypted and we keep them up to 14 days, so a deleted scan can exist in an encrypted backup for up to 14 days before it ages out.
If you lose your password, your recovery phrase and every signed-in device, locked scans cannot be recovered by anyone, including us (unless you turned on the optional recovery help, which works only after a 72 hour delay that every parent is told about). Practice, progress and reports continue to work.
No system is perfectly secure. We reduce the risk; we cannot promise it is zero.

Protecting your account

We require you to confirm your email address before you can open the parent area or upload scans.
You can turn on two-step login with an authenticator app (Account, then Security). It is optional and we recommend it. You get 10 one-time recovery codes.
Passwords need at least 10 characters. We check new passwords against known breaches without sending the password itself (only a short fingerprint prefix leaves our server).
After 10 wrong passwords in 15 minutes we pause login for that account and device. Wrong PINs are rate-limited too, so children cannot guess the parent PIN.
Signing in with Google or Apple only joins an existing account whose email has been verified.

How the service is protected

Everything travels over HTTPS, and browsers are told to insist on it.
Pages are served with a strict content policy and standard browser protections, and the app cannot be embedded in other sites.
Sign-in, uploads and other writes are rate-limited.
Database backups are encrypted before they are written, with a key that is not stored with them.
We check our dependencies for known vulnerabilities and scan our code for accidentally committed secrets on every change.
Logs are scrubbed of emails, names and tokens.
The administration interface only answers requests from approved networks.

Keeping and deleting data

You can delete a child, or your whole account, in the parent portal (Account). Deleting your account removes your family's data, and backups roll off within 14 days. You can download your family's data at any time from the same page.

Reporting a problem

If you think you have found a security problem, please email bml.admin0@gmail.com with the subject "Security". Tell us what you saw and how to reproduce it. We read every report, and we will not take action against people who report in good faith.