What Aiyori holds is the record of children’s learning.
Here is how it is protected: the principles and the main mechanisms. Settings that could help someone misuse the service are deliberately left out. We do not write that something is done when it is not.
Basic principles
- Collect little. Students can use Aiyori without an email address. For date of birth, we hold only the year and month.
- Limit who can see. A student’s information can be seen only by the student, their guardians and the classroom’s teachers.
- Do not keep it forever. Files such as photos, videos and voice recordings are deleted automatically after 365 days.
- No advertising, no tracking. Neither the app nor the web contains components for analytics or advertising.
Login
- Teachers and guardians
- Log in with a 6-digit code sent to your email address. There are no passwords, so an account cannot be taken over through a reused or leaked password.
A code expires after a short time, and issuing a new code makes the old one unusable. - Students
- Log in with three things: the classroom code, an ID and a PIN. PINs are stored only in a form that cannot be reversed. Neither Aiyori nor the teacher can read a PIN.
- Guarding against brute force
- After repeated wrong attempts, login is blocked for a set time. The number of codes that can be issued is also limited.
Whether the classroom, the ID or the PIN is wrong, the response is the same, so it gives no clue. - Not revealing who is registered
- The screen does not change depending on whether an email address is registered.
- How codes are stored
- For verification codes and invite codes, only a converted value that cannot be reversed is stored. The original code cannot be learned from the database.
After you log in
- Login expiry
- A login is re-checked at short intervals. If it is not used for a long time, it ends automatically.
- If a login is misused
- If there is a sign that login information has been misused, every login on that device is invalidated.
- Screen lock
- Teacher and guardian screens can be protected with Face ID, Touch ID or the device passcode (on from the start).
- Preventing forged requests
- For any operation that writes data, we check that the request comes from Aiyori’s own screens (CSRF protection).
Separation between classrooms
Many classrooms use one system, so keeping each classroom’s data apart is what we weigh most heavily.
- How it works
- Separation by classroom is built into the foundation of the software. Another classroom’s data stays out of reach without relying on how each individual screen or feature is written.
- How it looks from another classroom
- A request for another classroom’s student or assignment gets the same response as “does not exist”. It does not even reveal whether the item exists.
- How we check
- Automated tests that check nothing is visible across classrooms run every time the code changes.
Who can see what
| Role | Can see | Cannot |
|---|---|---|
| Student | Assignments handed out to them, their own submissions and scores, and messages with the teacher | See other students’ information (except word card nicknames and times, when the teacher chooses to show them). There are no screens about money. |
| Guardian | For the children linked by invite code: assignments, submissions, scores, the learning record and messages with the teacher | Write in the messages. See other children’s information. |
| Classroom teacher | Assignments, submissions, messages and tuition for the students in their own classroom | See other classrooms’ information. |
| Added teacher | Same as the classroom teacher | Classroom settings, closing the classroom, inviting teachers and payments. |
Encryption
- In transit
- Everything between a device and Aiyori is encrypted with HTTPS (TLS). Connections to the database and to file storage are encrypted too, and unencrypted connections are refused.
- At rest
- The database and file storage are encrypted in full at rest, using a strong, widely used method.
- Names and email addresses
- On top of encrypting the storage as a whole, names, email addresses and similar fields are encrypted one by one inside the application before they are stored. They cannot be read by looking at the database alone.
Files and video
- Sending and receiving
- Photos, PDFs, voice and video travel over a time-limited route that only that person can use. The route expires after a short time.
- Checked on every open
- Every time a file is opened, we check whether that person is allowed to see it right now.
- Storage
- Set so that nothing can be viewed directly from outside. There are no public URLs.
- What is accepted
- Only files of the set formats and sizes are accepted. They are checked again on the server after they arrive.
- Lesson videos
- For each playback, we check that this viewer may watch this video. The video itself cannot be fetched without that permission.
- Lesson videos stay in Aiyori
- Videos uploaded by teachers are delivered without any outside video site. There are no ads and no recommended videos. Only when a teacher hands out a YouTube video is the YouTube player embedded, with the setting that does not use cookies.
Retention and deletion
- Deleted after 365 days
- Files such as photos, videos, voice recordings and PDFs are deleted automatically 365 days after upload. Once past the limit, a file cannot be opened even before the deletion job runs.
- What stays
- Scores, comments, answers to questions and text messages. Lesson videos that the teacher set to “Keep as teaching material”.
- After withdrawal
- Submissions, messages, the learning record and the name are erased after 30 days.
- After a classroom is closed
- All students are withdrawn, and the whole classroom is erased after 30 days.
- Deleting it yourself
- Teachers and guardians can delete their own accounts after confirming with a code sent by email.
Protecting children
- Guardian consent
- Students under 16 cannot hand in photos, video or voice, or exchange one-to-one messages with the teacher, until a guardian agrees. Consent is recorded and can be withdrawn later on the web.
- Guardians can see the messages
- Guardians can read all of the messages between their child and the teacher. They can also turn the messages off.
- Students are not connected to each other
- There is no feature for a student to contact another student.
- Leaving Aiyori
- Before a link to another site opens, the destination is shown for confirmation. Children under 13 are told to open it “together with a grown-up at home”.
- Live lesson links
- Only Zoom, Google Meet, Microsoft Teams and Whereby links are accepted.
- Reporting
- Anything that worried or upset someone can be reported to Aiyori from the screen. The teacher is not told about the report.
- No talk of money
- Invoices and payments do not appear on student screens.
- Notification text
- So that you can tell which child and what it is about, a notification includes the child’s display name and the assignment title. It never includes message text, scores, the teacher’s comments or tuition amounts. Guardians and teachers can turn off names and titles in Settings. Tuition reminders never include a name.
Advertising and tracking
- We show no ads. We do not sell data. (YouTube may add ads to YouTube videos handed out by a teacher.)
- No outside components (SDKs or tags) for usage analytics or advertising are in the web version or the iPhone and iPad app. The iPhone and iPad app is built only with Apple’s standard frameworks.
- The only information sent to outside companies is the email address needed to send email (Amazon Web Services) and the text of words needed to create the read-aloud audio for word cards (Google). The text of the words contains no student information. When a teacher imports Google Forms, the teacher’s browser reads the forms directly from Google; neither the Google account details nor the form responses reach Aiyori.
Records and monitoring
- Audit log
- Grading, returning work, registering, suspending and withdrawing students, resetting PINs, guardian consent, recording payments and similar actions are logged with “who did what, and when”. The log is append-only and is not rewritten.
- Actions by Aiyori
- Actions that Aiyori takes on a classroom or its data are kept in the same log, with a reason.
- Logs
- Operational logs do not contain message text, email addresses or codes.
- Monitoring
- The system is monitored at all times, and we are alerted when something is wrong.
- Backups
- The database is backed up automatically every day, and backups are kept for a set period. It is set so that it cannot be deleted by mistake.
Where it runs
- Data location
- Japan (Amazon Web Services, Tokyo Region).
- Database
- Placed where it cannot be reached directly from the internet. Only Aiyori’s own programs can connect to it.
- Programs
- Run with only the permissions they need. They do not run with administrator privileges.
- Updates
- If a new version has a problem, the previous version is restored automatically.
- Checks on every change
- Every time the code changes, type checks and automated tests run (including classroom separation, consent and deletion).
Payment information
- Aiyori does not store card numbers. It has nowhere to store them.
- With card payment, card details are held directly by the payment provider (Stripe), and tuition goes directly to the teacher’s account. We never hold tuition.
If something goes wrong
- The steps to take when information has leaked, or may have, are decided in advance.
- We stop the cause and notify the teachers of the affected classrooms within 24 hours.
- As the law requires, we report to the Personal Information Protection Commission and notify the people concerned and their guardians.