Keystone
What we hold, and what you can do about it
Keystone is used by children, so the rules that matter here are the ones about children. This page is the plain version. Last updated 30 August 2026.
What a child gives us
- A first name, chosen by their parent. Not a surname.
- A username and password, chosen by their parent. The username is not an email address, on purpose.
- A grade, so the curriculum knows where to start.
- Their work: which topics they have explained, quiz answers, teach-back transcripts, and anything they type into the “what didn't click” box.
We do not collect a child's email address, date of birth, photograph, location, phone number, contacts, or anything from a school. We do not use advertising, and there are no third-party trackers or analytics on this site.
Consent, before anything happens
A child cannot sign in until their parent has given consent, and the parent gives it in three separate pieces because they carry different risks:
- Storing their work. Required. Without it there is no progress to keep, and enrolling would be pointless.
- The AI tutor. Optional, and genuinely separable. See the section below.
- The weekly summary. Optional. Whether you are shown what your child wrote.
We record who consented, when, and the exact wording they agreed to, so it can be shown back to you. You can withdraw consent at any time and it takes effect immediately.
The one thing that leaves our systems
If you turn on the AI tutor, then what your child types as a question is sent to a third-party model provider to be answered, along with the topic they are studying. Their name, username and progress are not sent.
Nothing else about your child leaves our systems. Lesson content itself is written in advance and shipped with the site, so ordinary use sends nothing anywhere. If you decline the AI tutor, Keystone still works: lessons show, but live questions are turned off.
Your rights, and how to use them
- See everything. Export a complete copy of your child's record as a file, from the parent page.
- Correct it. Change their name, grade and term agenda at any time.
- Delete it. Remove the child. We archive first so an accidental deletion is recoverable, then permanently erase every document on request.
- Withdraw consent without deleting, which stops further collection.
- See who looked. Each child has an access log showing who read or changed their record.
Who can see a child's work
The child, the parent who created them, and an administrator. Other families cannot: each child's record is stored separately and every request is checked against who owns it. Siblings in the same household have separate accounts and cannot see each other's work.
How long we keep it
For as long as the child is enrolled. When you delete them, the archive is recoverable for thirty days and then removed. The access log keeps the most recent two hundred entries and discards older ones.
Where this is honest about limits
Keystone is a small program run by a family, not a certified vendor. It has not been through a third-party privacy audit, it has no COPPA safe-harbour certification, and it should not be adopted by a school on the strength of this page. What it does have is a deliberately small collection surface and a policy that matches the code.
Questions, or a request to see or delete a record, go to the parent page.