Your classroom, your data, your call

🔒 Keeping accounts secure

• Encrypted connections: the site is only served over HTTPS, so everything between your browser and us is encrypted.
• Passwords are never stored: we keep only a salted scrypt hash, so even we can't see your password.
• Secure sign-in: login cookies are HTTP-only, sign-in sessions last at most 30 days, and we store only a hash of each session. Resetting your password signs you out everywhere else.
• Payments by Stripe: card details go straight to Stripe, a PCI DSS Level 1 certified payment provider. We never see or store card numbers.
• Protection against abuse: rate limits on sign-in and generation, protection against cross-site request forgery, and cleaning of AI-drawn diagrams so they can't run code in your browser.
• Your resources are private: only you can see the resources in your account.
• Two-step sign-in: anyone can turn on a 6-digit code from an authenticator app as well as their password (set it up here). It's required for school admins and for the Lessonsmith owner, and schools can require it for all their staff. The app's secret is stored encrypted, with the key kept apart from our database, and each code works once. A password reset never skips it.
• A security log: sign-in security changes, admin actions and school settings are recorded, so school admins and we can see who changed what. It never holds pupil data.
• Attack detection that stays calm: the site checks for real attacks every two minutes (wrong two-step codes, admin keys guessed from unknown devices), with the date and time of every attempt. Ordinary clicks and page loads are never treated as attacks, so a real one stands out. Serious incidents reach us straight away, once; we resolve each one with a note of what was done, and security logs are exported to secure offline storage and then deleted from the live servers.
• Safety settings for schools: each school completes a safety setup when its licence starts (a safeguarding contact, the data processing agreement, who must use two-step sign-in, and what teachers may share with pupils), reviewed every year. We can pause every pupil activity at once if we ever need to.

🛡️ Your data rights

We follow UK GDPR. is the data controller for teachers' account data, registered with the Information Commissioner's Office (ICO registration number ZC282059).

• Stored in the EU: your account, resources and school data are held on servers in Frankfurt, Germany, close to UK schools and protected by UK and EU data protection law.
• We collect very little: your email address, your hashed password, the briefs you write and the resources you create. That's it.
• No pupil data: the service is for teachers. Please don't enter pupils' full names or anything else that identifies a child. Report comments are written from first names or initials only.
• No ads, no tracking: we use one essential cookie to keep you signed in. No advertising or analytics cookies, and we never sell data.
• You're in control: delete any resource at any time, or ask us to delete your account and everything in it.
• Who helps us run the service: Render (hosting, in the EU), Anthropic (the AI that writes resources), Google Cloud (AI pictures, in a UK or EU region), Stripe (payments) and Resend (account emails). Anthropic, Stripe and Resend are based in the United States, with safeguards such as the UK International Data Transfer Addendum.

Full details are in our privacy policy.

🤖 Responsible AI & safeguarding

• AI tools are for teachers: pupils never use our AI resource tools. Teachers check every resource before it reaches a classroom.
• Safe content for pupils: in Revision Forge and AI Labs, pupils see Lessonsmith's own content. Anything a teacher writes for pupils is checked first (no links, contact details, social media or unsuitable language), and pupils can report a task with one button, which hides it from everyone until we've checked it. How it works.
• Age-appropriate by default: every request tells the AI the year group, curriculum and class, and asks for accurate, inclusive, age-appropriate content. Requests that aren't about teaching are turned away.
• A checklist on every resource: each one ends with "Before you use this", reminding you to check facts, curriculum fit and timing.
• Sources you can check: with web research turned on, resources list the pages they used.
• Safety filters: our AI provider, Anthropic, runs its own safety systems on every request.
• AI pictures: staff can make pictures for slides and worksheets. Every description is checked first (no real people, children in photos, brands, characters or unsuitable subjects), Google's safety filters are set to their strictest, and pictures are labelled as AI-generated. Teachers can also choose from a ready-made library the Lessonsmith team has made and checked. Pupils never make pictures: they only see pictures from a library the Lessonsmith team checks, and any pupil can flag one, which hides it at once. A flagged picture is checked by the Lessonsmith team and, on a school licence, by the class teacher or a school admin; then the school's safeguarding lead confirms before it's used there again. Schools can switch pictures off.
• Your content isn't used to train AI: resources are generated through Anthropic's commercial service, which doesn't use customer content to train its models.

🧑‍🏫 Staff accounts for adults; pupils by school authorisation

Lessonsmith accounts are for teachers and school staff aged 18 or over. Pupils can use our free learning resources without logging in. Signing in with a school login needs authorisation: pupils can sign in with their school account only when their school has authorised pupil sign-in on a whole-school licence, and pupil logins are blocked otherwise. We keep pupils out of staff accounts in layers:

• A clear declaration: everyone confirms they're a teacher or education professional aged 18 or over before using the app, whether they sign up with an email, Google or Microsoft. We record when they confirmed.
• Pupil addresses refused: addresses that look like pupil accounts, such as @students.… or @pupils.…, can't sign up, and can't be added to a school licence. A school can ask us to block its own pupil domain too.
• Invite-only school licences: only the school's admins can add staff to a school licence.
• Pupil domains blocked: once a school lists its pupil email domains, an account on those domains (other than staff on the school's licence) is signed out and can't log in. A pupil using the staff sign-in buttons is sent to pupil sign-in instead, which only works if their school has authorised it.
• Teacher planning tools are staff-only: the lesson and resource builders, planning packs, schemes of work, curriculum maps and the KS3 planner open only for a signed-in teacher or adult in education, or staff on a whole-school subscription. Pupil sessions, class codes and tokens can't open them.
• Suspension: if an account looks like it belongs to a pupil, we suspend it straight away and sign it out everywhere.
• Nothing for pupils to do here: there's no chat, no messaging between users and no pupil profiles.

Pupils without a login: AI Labs. In a lesson their teacher supervises, pupils can join AI Labs with a class code to train a simple machine learning model. They get a random nickname instead of an account, give no name or email, and their pictures and sentences never leave their device. For schools, AI Labs stays off until a school admin switches it on and accepts the safeguarding responsibilities; if a school doesn't switch it on, it isn't available there and those terms don't apply.

For school IT teams, two settings add a further layer:

• Google Workspace for Education: keep pupil accounts set as under 18. Google then blocks third-party apps for them unless you allow them, so you can allow Lessonsmith for staff only.
• Microsoft 365: in Entra ID, require admin approval for apps, or assign Lessonsmith to your staff groups only.

Spotted a pupil account, or want your pupil domain blocked? Email us and we'll act the same day.

📄 Agreements for schools (DPA)

Schools and trusts that buy a licence for their staff often need a Data Processing Agreement (DPA) for their Data Protection Officer. We're happy to provide one, along with answers to your DPO's questions.

Revision Forge and class tokens (Schedule 5). When a school adds Revision Forge Plus, the DPA covers it: the school is the controller and Lessonsmith is its processor. Processing is limited to running revision for the school's pupils. Data: class tokens, random nicknames, class labels, last-used dates and progress (Smith Coin codes and counts): pseudonymised, with no pupil names, emails or free text, because class lists are matched to tokens on the teacher's own computer. No advertising, profiling or sharing; UK and EU data centres; deletion on request, after a year unused, or within 30 days of the school leaving. We'll help with your DPIA and pupil privacy notice. Practice tests (also under Schedule 5): pupils' answers are end-to-end encrypted on their device for their teacher's browser; we hold only the sealed envelope until the teacher collects it (then delete it), or 24 hours after the session ends. Marking is kept in the teacher's browser. Marked papers go back sealed with each pupil's random return code and are deleted once collected. AI suggestions for marking are off unless the school switches them on; when used, only the question, mark scheme and one anonymous answer go to Anthropic, which doesn't keep or train on them. The A-level add-on uses exactly the same data under the same schedule: it changes which subjects open, not what is processed. Model answers are fetched by question ID only, and pupils' answers stay on their device.

Safeguarding controls and joining (Schedule 7). Pupil-facing content is Lessonsmith's own, or written by a teacher on a school's licence and checked before pupils see it (teachers without a school can set Lessonsmith's own questions only): links, contact details, messaging and social media apps, grooming-style requests and unsuitable language are refused (the refusal is logged without the text). Pupils can report any task with one button: it is hidden from all pupils at once, reviewed by Lessonsmith, and shown in the school's safeguarding log for its DSL. The short /join page only looks up a live class code and passes the pupil to that session; it stores nothing, codes expire with the session, teachers can lock joining and remove any nickname they don't expect, lookups are rate-limited, and pupils' own friends' groups can't be reached from it. Teachers' saved papers hold questions and mark schemes only, no pupil data, and are deleted with the teacher's account. These controls support your duties under Keeping Children Safe in Education and your online safety policy; they don't replace your school's own filtering and monitoring.

Pupil sign-in (Schedule 8, optional). Off unless a school admin switches it on, lists the school's own pupil email domains (public email services are refused) and confirms the domains are the school's, that pupils and parents will be told, and that the school manages the accounts. Pupils then sign in with their school Google or Microsoft account: Google must confirm the account belongs to the school's Workspace domain, and Microsoft must sign in through the school's tenant. No pupil account is created and no name or email is stored: a pupil session holds only a hashed random key, the school and an end time (8 hours). It opens the Revision Forge subjects the school has, and nothing staff-only. Switching it off, the licence ending or our emergency pause ends every pupil session at once. Pupil addresses can't make staff accounts. The school is the controller and we're its processor, as for the rest of Revision Forge.

Class rewards (Schedule 9, optional). Off unless a school admin switches them on and confirms that the school's reward, healthy-eating, allergy and safeguarding policies apply, that rewards go to whole groups fairly, and that staff check coins and give rewards in person. Teachers then set short item names (for example "a bag of sweets") for Silver, Gold or Platinum on a live Revision Forge session. Every pupil in the session sees the same rewards; nothing is offered to one pupil. Reward text passes our safety screen (no links or contact details). We hold the reward text with the session (deleted with it) and each nickname's coin level (0 to 4) so the teacher can see who has reached a level. Lessonsmith never handles payments, gift cards, delivery or pupils' details, and records nothing about who received a reward. Teachers without a school can't offer rewards.

Chime and sparkles. A sound and animation made in the pupil's browser when they get an answer right. Pupils can turn either off in the accessibility settings (kept in that browser only), and teachers can keep them off for a whole session. Nothing is recorded.

Progress on pupils' devices (Schedule 6). Smith Coin progress is made and kept in the pupil's browser, not on our servers, so Lessonsmith doesn't process it. By default it lasts for the browser tab only and is cleared on a refresh or a fresh visit, so shared school devices don't pass one pupil's progress to the next. A pupil can choose "Remember my coins on this device" on a device that's only theirs: it keeps just the coin codes (no names, no typed work) in that browser for 30 days after last use, and "Forget" deletes them straight away. We recommend schools tell pupils not to turn it on on school or shared devices; schools that manage their browsers can also clear site data when a session ends. This storage is only used for the feature the pupil asks for, never for tracking or advertising.

Pupil coins from a school (Schedule 10). Coins let pupils carry their work between lessons and devices without an account. For each coin we hold a random code, a random nickname, a serial number, the class or year label the school chose (for example 7-ABC), progress and when it was last used: no names, emails or dates of birth. Schools can make coins by year group or class with no pupil information at all; the spreadsheet that matches card numbers to pupils is made and kept on the school's own computer. If the school uses pupil sign-in, a school email is turned into a one-way keyed fingerprint and the address is thrown away; a pupil's first sign-in picks up a free coin for their year, and the fingerprint is held for up to 15 minutes while they choose. Staff at the school can reprint lost cards, and each reprint is logged. Coins are deleted with the school's groups, when the school frees them, or after a year unused. The school is the controller and Lessonsmith is its processor.

Security monitoring, incidents and breach reporting (Schedule 11). To protect the service we record security events (sign-in security changes, wrong two-step codes, admin actions) with the staff member's email address, and attack counts against short visitor codes, never IP addresses. No pupil data is in these logs. Incidents are graded from 1 to 6, with the date and time of each attempt; only very serious ones (levels 5 and 6) alert Lessonsmith at once, and at level 6 the service can be paused and everyone signed out to protect schools' data. Security logs are reviewed, exported to secure offline storage and then deleted from the live service; otherwise security events are deleted after 400 days and activity counts after 30. Security support is provided by our security partner (see About us) under a written contract and confidentiality terms, using Lessonsmith's own secure desk virtual machines, so school data isn't copied to their own devices. If a personal data breach affects a school's data, we'll tell the school without undue delay, with what we know, what we've done and how to reach us, so it can decide whether to report to the ICO within 72 hours, and we'll help with that report and with telling anyone affected.

Request a DPA or email

❓ Common questions