AI and privacy

The skepticism is earned

When a school hears "AI platform," a reasonable administrator hears something else: another vendor accumulating a warehouse of student records, governed by a privacy policy that can change, staffed by people who can err, and attractive to anyone with a subpoena or an exploit. Two decades of educational technology have taught districts that data, once collected, tends to outlive every promise made about it. The skepticism is not a public-relations problem to be managed. It is a design requirement to be satisfied.

Trust the structure, not the intentions

Most privacy assurances in education software are contractual: we will not sell your data, we will not share it, we will delete it on request. These promises matter, but they share a weakness. They all presume the vendor holds the data and asks you to trust what it does with it. The stronger guarantee is structural: a system that never holds the sensitive thing in a usable form cannot misuse it, cannot leak it, and cannot be compelled to produce it. You do not have to trust the intentions of a company that structurally cannot mishandle data it does not have.

That is the standard Prism was built against. Analytics run on opaque, per-class pseudonyms rather than names. The mapping from pseudonym to real name lives in a vault encrypted in the teacher's own browser, with a key derived from the teacher's password. Prism stores the ciphertext and cannot decrypt it. For districts using Google Workspace for Education, Microsoft 365 Education, or another single sign-on provider, student email addresses never reach Prism's servers at all; the platform sees only the opaque subject identifier the district's own identity provider issues. If the database were published in full tomorrow, it would contain no attributable student record. The same logic answers the subpoena scenario and the breach scenario, because both an attacker and a court order can only obtain what the system actually holds. The complete technical treatment, written for district counsel and security review, is at Student Privacy Architecture.

What the AI sees, and when

The common fear about classroom AI deserves a precise answer rather than a soothing one. The fear is that the AI watches students. In Prism, the AI operates at two moments, and neither looks like surveillance.

The first moment is design time, when a teacher drafts a lesson. The model receives the teacher's learning objective, the standards to cover, and the source material the teacher supplied. It receives no roster, no names, no grades, and no scores, because none of that exists at design time; the lesson has not met a student yet. Each request is isolated, and the data-processing agreement with the model provider prohibits training foundation models on any of it.

The second moment is reading time, when a student highlights a phrase and asks for a definition, a summary, or a diagram. The model receives the highlighted text, the lesson's title and objectives, and a window of surrounding text. It does not receive the student's name, the class roster, or anything from other lessons. The help is scoped to the page the student is on, which is also why it is good pedagogy: the answer is the one their teacher would give, grounded in the lesson rather than the open internet.

The adaptive machinery between those two moments, the triggers that insert a reteach page or offer a hint, runs on pseudonymous evidence: answer patterns, timing, mastery estimates. It is personalization without identity. The system knows that student stu_xb7q3m1lo9k4 has not yet mastered two-step equations. It does not know, and cannot know, who that is. Only the teacher's unlocked device can resolve the name.

Analytics without a warehouse

A fair question follows: if the platform refuses to hold identities, what do teachers and school leaders actually get? The answer is everything the identified systems promise, and in some cases more. Mastery estimates update in real time from every answer, using Bayesian Knowledge Tracing, a model with three decades of classroom validation. Teachers see which standards a whole class needs retaught, which is the actionable view a gradebook cannot produce. School leaders see rollups by class, department, and standard. Parents hear something more useful than a number: not "an 82," but Advanced on quadratics, Proficient on polynomials, Developing on rational expressions. Every one of those views is computed on pseudonyms. Names attach only at the moment of display, on the teacher's device, after the teacher unlocks their vault.

Your data, and your exit

Privacy also includes the freedom to leave. Schools retain full ownership of their curriculum, lessons, and records. A school that chooses to leave receives a complete, machine-readable export, with no lock-in and no exit fees. This is less a feature than a discipline: a vendor that plans for your exit has fewer incentives to hoard what you gave it.

The belief worth retiring

The belief that adaptive learning requires surveillance, that a school must trade its students' identities for personalization, was an artifact of how the first generation of systems happened to be built. It was never a law of nature. The learning science that powers adaptivity operates on evidence of understanding, not on identity, and a system designed from that observation can deliver research-grade instruction while holding nothing a breach or a subpoena could turn into a student file. Schools should demand that standard, from us and from everyone else.

For the pedagogy this architecture makes possible, see AI in the classroom.