Keyless and private by design: your data stays on your device

Accountless from the start

There's no login. Public learning pages open directly, and the things you create — saved topics, study progress, uploaded projects, teacher lesson plans — are stored on your device using your browser's local storage, not on our servers.

That means your study history is yours. Clear your browser data and it's gone; there's no profile of you sitting in a database somewhere. It also means there is no password to leak, no session to hijack, and no export request to file, because there is nothing on our side to export.

It's worth noticing how much of the usual friction this removes. No verification email before you can try anything. No pricing tier gating a feature you wanted to evaluate. No onboarding flow collecting your role and your company size. You open a page and the tool works, which is how software used to feel and mostly no longer does.

Files you upload never leave the browser

When you upload a PDF, EPUB, or Word document, the parsing happens in your browser. The file is read as bytes, unpacked and extracted locally, and handed to a worker that builds the study set — all inside the page. The same is true for video: transcription runs entirely on your device with a model served from our own origin.

This is enforced by more than intention. The site's content-security policy keeps network connections to its own origin and a short list of named sources, so there is no path for a document you opened to be posted somewhere else, whether by us or by anything running on the page.

What actually gets stored, and where

Concretely, on your device and nowhere else:

• Your library of saved projects and the extracted study sets built from them.
• Flashcard schedules and quiz results, held in a local study-progress record.
• Uploaded documents and the text parsed out of them.
• Teacher lesson plans, including your edits, reordering and hidden sections.
• Preferences: theme, reduced motion, and your cookie choices.
• The speech model, once you have explicitly chosen to download it.

Ads and analytics you control

Analytics and advertising are the two categories you control in cookie preferences, and switching one off means the script is not merely inactive, it is never fetched. Which way they start depends on where you are: in the EEA, the UK, and Switzerland nothing loads until you opt in, because that is what the law there requires and we would rather follow it than route around it. In regions that use the opt-out model instead, they load by default and stop the moment you untick the box. A choice you save is honoured everywhere.

The site is free to use, and being honest about how that is paid for matters more to us than a tidy privacy claim. What we will not do is fund it with your study data, which is exactly the asset a keyless, local-first design makes it impossible for us to collect. The architecture is the guarantee here, not the intention: a promise not to misuse data you hold is worth considerably less than not holding it.

What outbound requests do exist

Local-first does not mean offline. When you open a Wikipedia topic, your browser fetches that article. When you look up a word, it fetches the entry. Those requests go to the sources themselves and are visible in your network tab; we are not hiding a sync channel behind them.

The distinction we hold to is direction. Novus Learn pulls public source material in; it does not push your material out. Nothing you create, upload, record or answer is transmitted as a side effect of using the tool.

This is the kind of claim that deserves to be checked rather than believed, and it is checkable. Open your browser's network panel, upload a document, and watch what happens: extraction runs with no request carrying its contents. That is a better guarantee than a promise in a policy, because you can repeat it whenever you want and it does not depend on us continuing to mean it.

The costs of doing it this way

Local-first has real downsides and it would be dishonest to skip them. Your library does not follow you between devices or browsers. A cleared cache takes your progress with it. Private-browsing windows start empty every time. There is no “restore my account” path, because there is no account.

Sharing works around this rather than through it: a shared link carries the artifact in the link itself instead of pointing at a record on a server. That is why share links are long, and why the recipient sees exactly what you saw without either of you having signed in to anything. It also means a shared link cannot be revoked or edited after the fact — once it exists, it is a copy in someone else's hands.

Backing up is manual, and worth doing deliberately rather than hoping. Downloading a deck as CSV, exporting a study set, or printing a lesson to PDF are all ways of getting something out of the browser and somewhere durable. If a piece of work matters, get it out; the browser is where the tool runs, not where an archive belongs.