Security

Accounts and authentication

Sign-in is handled by Firebase Authentication. We never see or store your password — it is verified by Google’s infrastructure, not ours. If you sign in with Google, no password reaches us at all. Sessions use signed tokens that expire and refresh automatically.

API keys stay on the server

Our AI provider key and Firebase Admin credentials exist only in the server environment. They are never included in the JavaScript sent to your browser and never written into the database, so there is no path by which a user — or an attacker reading our client code — can extract them. Every AI request is proxied through our own API route, which applies authentication, quota, and validation checks before the provider is contacted.

Database and storage rules

Firestore and Cloud Storage are governed by explicit security rules enforced by Google, not by our application code. Those rules mean that even a direct request with a valid token cannot read or write another user’s data:

• Worksheets are readable and writable only by the account that owns them.
• Published worksheets are world-readable, which is the point of publishing, but still writable only by their owner.
• Ownership is immutable — a worksheet cannot be reassigned to another account by editing it.
• Uploads are restricted by file type and size, and land in a folder scoped to your account.

Abuse prevention

• Firebase App Check with reCAPTCHA attests that requests come from our real app, blocking scripted abuse of the API.
• Rate limiting caps how quickly any account can call expensive endpoints.
• Per-account quotas bound AI generation. If generation fails after quota was consumed, it is refunded automatically.

Content safety

Every piece of user-supplied text is sanitised before it is rendered, so a worksheet cannot carry executable code into another user’s browser. AI output is re-validated against a strict schema on the server before it reaches your canvas — we do not trust the model to return well-formed data. Images imported from the web are fetched server-side over HTTPS only, with redirects refused, size limits enforced, and internal network addresses blocked, so the import feature cannot be turned against our own infrastructure.

Transport and hosting

All traffic is served over HTTPS. The application runs on Vercel’s infrastructure, and data is stored in Google Cloud through Firebase. Both maintain their own certified physical and network security programmes.

What we ask of you

• Use a strong, unique password, or sign in with Google.
• Keep student personal information out of worksheets and AI prompts. No technical control substitutes for this one.
• Sign out on shared or classroom computers.

Reporting a vulnerability

If you believe you have found a security flaw, please tell us through the help center and mark it as a security report. We ask that you give us a reasonable chance to fix the issue before disclosing it publicly, and that you do not access or modify other users’ data while investigating. We will not pursue action against researchers who act in good faith under those conditions.

Honest limits

No online service is perfectly secure, and we will not pretend otherwise. What we can say is that the controls above are implemented and in force, that credentials are kept off the client, and that we will tell affected users promptly if a breach ever puts their data at risk.