Is Learnaway a keylogger?

No. A keylogger records the characters you type. Learnaway records only the timing and type of events and the length of pastes, never the characters themselves.

Do you store what students write?

Only the final submitted text, so the teacher can read the work. Intermediate drafts aren't sent to our servers; they autosave locally in the student's own browser.

What do you store by default?

Only the final text and the analysis results. The minute-by-minute timing of the writing process is scored on our server in memory and then discarded. It isn't saved unless a school turns on Process Replay.

What does the premium Process Replay store?

When a licensed school opts in for an assignment, we retain the content-free timing timeline so a teacher can replay how the work was written: typing rhythm, pauses, and paste sizes. It still never includes the characters typed, and students are always told what's recorded.

How is the data you store kept secure?

Everything is encrypted in transit and at rest, every database table is protected by Row-Level Security so teachers only ever see their own classes, and licensed schools get EU data residency, configurable retention, and a Data Processing Agreement.

Is timing data personal data under GDPR?

We treat all telemetry as personal data and minimise it by design. Licensed schools receive a Data Processing Agreement and can configure how long data is retained.

Privacy & trust

No keylogger. We record timing metadata only, never the characters a student types.

Trust is the whole product. Learnawayis built so that a school's data protection officer, a parent, and a student can all see exactly what happens, and what doesn't.

What we collect

Event types (keystroke, paste, tab-switch) and their timestamps
Timing deltas between events (how fast, how much pausing)
The length of pasted text (a number, not the text itself)
The final submitted text, so your teacher can read your work

What we never collect

The individual characters or keys you press
The content of anything on your clipboard
Your screen, camera, microphone, or other tabs
Anything at all once you close the page (no background tracking)

Fair by design

We ignore writing style, so we don't penalise non-native or unusual writers.

GDPR-first

EU data residency available; configurable retention; right to deletion.

DPA-ready

Licensed schools get a Data Processing Agreement for procurement.

Students always know.Every submission page carries a plain-English notice explaining what's recorded and why, before a student writes a word. Students never see a score. All signals go to the teacher, who makes the final judgement.

What we store by default, and what changes with Process Replay

By default we keep only the final work and the analysis results. The writing process is scored on our server and then discarded. Licensed schools can opt in, per assignment, to retain a content-free timeline (still never the characters typed).

By default (every account)

We score the writing process on our server, in memory, then throw the process stream away. Only the result and the final work are kept.

Stored

The final submitted text, so the teacher can read the work
The analysis results: the risk signal plus the plain-English explanation tags and the numbers behind them
Minimal metadata: word count, submission time, device input type

Never stored

The characters a student types or pastes (we are not a keylogger)
Clipboard contents, screen, camera, microphone, or other tabs
The minute-by-minute timing timeline (used to score, then discarded)

Process Replay (premium, opt-in)

Licensed schools can opt in, per assignment, to retain the content-free timing timeline so a teacher can replay how a piece was written. Students are always told.

Stored

Everything from the default tier, plus…
The timing timeline: when keystrokes, pauses, pastes and tab-switches happened
Paste sizes (a number of characters) and their position in the timeline

Never stored

Still never the characters typed or pasted (the replay shows rhythm, not words)
No intermediate drafts of the text are reconstructed or saved

Security of the data we do store

Minimising what we collect is the first line of defence. Here's how we protect what remains.

Encrypted in transit and at rest

All traffic uses TLS, and stored data is encrypted at rest (AES-256) by our managed Postgres provider. Nothing student-related travels or sits in the clear.

Row-Level Security on every table

Access is enforced in the database itself, not just the app. Postgres Row-Level Security policies cover every table, so a teacher can only ever read submissions for assignments they own.

Least-privilege access

Students submit through a write-only path and can never read work back. Teachers see only their own classes. The wide-access service role is used only for narrow, audited server tasks like billing sync.

EU data residency available

Licensed European institutions can have their data hosted in the EU, keeping student records within the appropriate jurisdiction.

Configurable retention and deletion

Licensed institutions set their own retention window and can request deletion of all student data at any time. Free-tier data is deleted on request.

Transparent sub-processors

We use a small set of vetted infrastructure sub-processors (hosting, database, transactional email) and list them on request. Learnaway never sells data or shares it for advertising.

Breach notification without undue delay

Under our Data Processing Agreement, we commit to notifying the institution of any personal-data breach without undue delay so they can meet their own obligations.

Privacy FAQ

Is Learnaway a keylogger?: No. A keylogger records the characters you type. Learnaway records only the timing and type of events and the length of pastes, never the characters themselves.
Do you store what students write?: Only the final submitted text, so the teacher can read the work. Intermediate drafts aren't sent to our servers; they autosave locally in the student's own browser.
What do you store by default?: Only the final text and the analysis results. The minute-by-minute timing of the writing process is scored on our server in memory and then discarded. It isn't saved unless a school turns on Process Replay.
What does the premium Process Replay store?: When a licensed school opts in for an assignment, we retain the content-free timing timeline so a teacher can replay how the work was written: typing rhythm, pauses, and paste sizes. It still never includes the characters typed, and students are always told what's recorded.
How is the data you store kept secure?: Everything is encrypted in transit and at rest, every database table is protected by Row-Level Security so teachers only ever see their own classes, and licensed schools get EU data residency, configurable retention, and a Data Processing Agreement.
Is timing data personal data under GDPR?: We treat all telemetry as personal data and minimise it by design. Licensed schools receive a Data Processing Agreement and can configure how long data is retained.