Keystone
What we hold, and what you can do about it
Keystone is used by children, so the rules that matter here are the ones about children. This page is the plain version. Last updated 24 October 2026.
What a child gives us
- A first name, chosen by their parent. Not a surname.
- A username and password, chosen by their parent. The username is not an email address, on purpose.
- A grade, so the curriculum knows where to start.
- Their work: which topics they have explained, quiz answers, teach-back transcripts, and anything they type into the “what didn't click” box.
We do not collect a child's email address, date of birth, photograph of them, location, phone number, contacts, or anything from a school system. The one picture Keystone ever handles is a photo of a homework page, only if you allow it (below), and it is read and then discarded, never stored. We do not use advertising, and there are no third-party trackers or analytics on this site.
Consent, before anything happens
A child cannot sign in until their parent has given consent, and the parent gives it in separate pieces, one checkbox each, because they carry different risks, and go to different companies:
- Storing their work. Required. Without it there is no progress to keep, and enrolling would be pointless.
- The AI tutor. Optional, and genuinely separable. See the section below.
- Answering out loud. Optional, and off unless you turn it on. It is separate from the AI tutor because the audio goes to a different company. See below.
- PIP reading its questions aloud. Optional, and off unless you turn it on. The question text goes to OpenAI to be turned into speech.
- Your child's week plan. Your child can plan their week, with PIP or on their week board: which days to study, a topic for each, and a short note of what is already on (“robotics”). It stays in Keystone; Keystone never connects to a calendar. You see it on your page, and an AI assistant you link to Keystone can read it, for example to copy it into your own calendar when you ask. Planning uses no AI and sends nothing anywhere.
- Talk with PIP, live (Keystone Plus). Optional, off unless you turn it on, and only with the AI tutor. A spoken conversation: your child's voice goes live to OpenAI's realtime model, which answers out loud. Keystone never receives or keeps the audio. It receives the written words only to check them for anything worrying and to count minutes, and keeps neither. Because the call is live, PIP hears the words before Keystone can check them; if something worrying is said, the call ends, a fixed safe reply shows, and you are told the kind of thing it was.
- Homework photos. Optional, off unless you turn it on, and only with the AI tutor. Lets the homework helper read a photo of a worksheet. See below.
- The weekly summary. Optional. Whether the parent page shows you this week's summary, including a sentence your child wrote. It is emailed only if you also turn on the Sunday letter, below.
Before a family is approved, we confirm that the person signing up is the child's parent, usually on a short video call, and we record how and when that happened. We also record who consented, when, the exact wording they agreed to, and the internet (IP) address the consent came from, as a record of who agreed. It can be shown back to you. You can withdraw consent at any time and it takes effect immediately.
What leaves our systems, and where it goes
If you turn on the AI tutor, the words your child writes to Keystone's AI are sent to a third-party model provider (today, Anthropic's Claude models, reached through OpenRouter) to be answered or assessed, along with the topic they are studying. That covers questions to PIP, their teach-back explanations and PIP's follow-up questions, speeches given to the speech coach, Labs tasks and their answers (Keystone Plus), homework problems they type and their messages to the homework helper, and messages to the study coach. Their name, username and your email are removed before anything is sent, and PIP addresses them with a placeholder that is filled in on your device.
With the AI tutor on, the parent page's weekly “thoughtful next step” is written by the same provider from that week's counts and topic names only (days worked, answers right, mistakes fixed, the topics involved). Your child's words, answers and name are not sent for it, and it is asked at most once a week. The moments, moods, goals and evening routine you note on the parent page stay in Keystone and are never sent.
If you let PIP read aloud, the sentences PIP says (not anything your child said) are sent to OpenAI to be turned into speech.
Lessons are read aloud by Phonon, a small voice model that runs on your own device. The words it says are turned into speech on the device and are not sent anywhere. The first time Read aloud is pressed, the browser downloads the model and its voice (about 65 MB) from Hugging Face, which sees an ordinary file download and nothing about your child. Where Phonon can't run, or if it is turned off for that browser on the read-aloud lab page, the device's own voice is used instead.
If you turn on answering out loud, the recording goes somewhere else again. The microphone runs through your browser's own speech feature, so the audio is sent to whoever makes that browser, Google in the case of Chrome, and comes back as text. That is a different company from the one answering questions above, which is why it is a separate choice rather than part of the same one. Keystone never receives the recording and never stores it. Only the text your child can see on screen reaches us, and it is treated like anything else they typed.
If you connect an outside AI assistant to Keystone from the parent page, that assistant can read your child's progress, plans and open misconceptions, read-only, until you revoke it there. Nothing goes to an assistant you have not connected. Once an assistant reads something, it has left Keystone: that company keeps and uses it under its own privacy rules, which may include saving the conversation or, unless you turn it off, using it to train its AI. Keystone still removes your child's name before anything is read.
If you turn on the Sunday letter, a summary of your child's week is emailed to you, through our email provider. See the next section.
Nothing else about your child leaves our systems. Lessons and quiz questions are written in advance and shipped with the site, so reviewing and answering questions sends nothing anywhere. Declining any of these leaves Keystone working: lessons show, questions can be typed, and nothing is scored differently for a child who types instead of speaks.
The Sunday letter, by email
The parent page can email you a short letter about each child's week. It is off unless you turn it on, with “Email me the Sunday letter” on the parent page, and you can preview it there first.
- What it holds: the same week as the parent page's summary, in words: where your child is, the latest check with PIP switched off, mistakes fixed, teach-backs, the times PIP coached instead of answering, the week's work, and one thing to do. Your child's first name is in it.
- What it leaves out: answer keys, other children, full conversations, and ids. Your child's own words (one sentence from a teach-back) go in only if you also turn on “Include the child's own words in the email”.
- Who it goes to: one email per child, every Sunday afternoon, to the address you signed in with, and only for a child whose weekly summary is on.
- How it is sent: through our email provider, which delivers it to your mailbox. Once it is in your mailbox, your email service holds a copy too.
- How to stop it: untick “Email me the Sunday letter” on the parent page, or turn off the weekly summary for a child, and the emails stop.
If you request early access
The form on the home page keeps your name, your email, your child's grade and any note you add. Nothing about your child beyond their grade, and nothing from your browser. It is used only to write back to you about a place in the family alpha: no newsletter, and it is never shared. Ask us and we delete it.
Your rights, and how to use them
- See everything. Export a complete copy of your child's record as a file, from the parent page, along with a readable summary of it.
- Correct it. Change their name, grade and term agenda at any time.
- Delete it. Remove the child. We archive first so an accidental deletion is recoverable, then permanently erase every document on request.
- Withdraw consent without deleting, which stops further collection.
- See who looked. Each child has an access log showing who read or changed their record. Open it on the parent page, under “Who looked at” your child's record.
Who can see a child's work
The child, the parent who created them, and an administrator. Other families cannot: each child's record is stored separately and every request is checked against who owns it. Siblings in the same household have separate accounts and cannot see each other's work.
If a child writes something worrying
If a child writes to PIP that they want to hurt themselves, or that someone is hurting them, PIP does not answer with AI. It shows fixed, reviewed words: tell a trusted adult, call or text 988, call 911 in danger, and, for someone hurting them, Childhelp at 1-800-422-4453. That message is not sent to any AI service. For self-harm or distress, your dashboard shows a safety note with the time and the kind of message, never the child's words, so you know to check in. For a message about someone hurting them, no note is shown to anyone in the household, because the person may be at home. Keystone is not a crisis service and no one monitors these messages as they happen.
If you allow homework photos, a photo your child takes or chooses in the homework helper is made smaller on your device and sent once to the same model provider (Anthropic's Claude, through OpenRouter) to be read. Keystone does not store the photo. It keeps only the problems read from it and the conversation that follows. A worksheet can show a name, a teacher or a school, so the reader is told never to copy those, and your child is asked to photograph just the problems. When “Take a photo” opens the camera, the camera picture stays on your device until your child chooses to use it.
How long we keep it
Only as long as it is needed, with these limits, which Keystone applies automatically every day:
- A child's whole record is kept while your family uses Keystone. If neither your child signs in nor you visit for twelve months, it is archived, and erased thirty days later unless you restore it.
- Homework sessions, Labs tries and safety notes are kept for twelve months, then deleted. The homework helper also keeps no more than the twenty most recent sessions, and never a photo.
- Usage and cost records (counts of AI use per month) are kept for thirteen months.
- The access log keeps its most recent two hundred entries.
When you remove a child, their record is archived first so an accidental removal can be undone, and archived records are erased automatically thirty days after removal: every document that belongs to them, including any question reports and notes they sent. Choosing Erase on the parent page instead deletes all of it straight away.
Where this is honest about limits
Keystone is a small program run by a family, not a certified vendor. It has not been through a third-party privacy audit, it has no COPPA safe-harbor certification, and it should not be adopted by a school on the strength of this page. What it does have is a deliberately small collection surface and a policy that matches the code.
Questions, or a request to see or delete a record, go to the parent page.