Why we're not a keylogger: our privacy architecture

When people first hear that Learnaway analyses how a student types, a reasonable worry follows: does that mean you're logging every key they press? It's the right question to ask of any tool that watches the writing process, and the answer is no. We never record the characters a student types or pastes. Not by policy alone, but by design: the system is built so the content physically can't reach it.

Timing, not text

Our capture code receives the timing and type of each event (a keystroke happened, a pause of 800ms, a paste of 420 characters, the window lost focus) and nothing else. When a paste fires, the function that handles it takes a single number: the length. The pasted text is never passed in, so there's nothing to store or leak. A keylogger records what you wrote; we record only the rhythm of writing it.

We store the least we can

Minimising collection is only half the story; the other half is retention. By default, we don't even keep the timing timeline. The writing process is scored on our server in memory to produce the signal a teacher sees, and then the process stream is discarded. What's saved is the final text (so the teacher can read the work) and the analysis results.

Schools that want to replay how a piece was written can turn on Process Replay, per assignment. Even then, the replay is content-free: it shows the rhythm of writing (typing bursts, pauses, paste sizes), never the words appearing. Students are always told what's recorded before they write.

Protecting what remains

For the data we do keep, the safeguards are concrete: encryption in transit and at rest, Row-Level Security enforced in the database so a teacher can only ever read their own classes' work, EU data residency for licensed European schools, configurable retention, and a Data Processing Agreement. The institution is the data controller; we're the processor, acting only on its instructions.

Why this matters for fairness

Not being a keylogger isn't just a privacy nicety: it's what makes the signals fair. Because we ignore the words entirely, we can't penalise a student for an unusual or non-native writing style, the exact failure mode that got text-based AI detectors pulled from universities. Reading the process, not the prose, is better for privacy and better for students.