ChalklineAI & privacy
AI is a tool the teacher holds, not a feature that holds the teacher.
A whiteboard sits in front of children. That sets the bar: nothing is collected, nothing is sent without a deliberate choice, and nothing destructive happens without a click from you.
Offline by default
On a fresh install there is no AI traffic at all. The Rules mode understands English commands like “plot y = x²” using a local parser, with no internet and no model.
Online, only if you choose it
The online assistant understands free-form requests. It needs your own OpenRouter key or a server your school runs. Through OpenRouter you pick the model from many providers and can restrict routing to providers that do not store prompts.
What leaves the computer, and when
| Mode | Sent | To |
|---|---|---|
| Rules (default) | Nothing | — |
| Online, when you ask something | Your request, the last few chat messages, and a description of the board (object kinds, formulas, text on the board) | The endpoint you configured: OpenRouter or your school server |
| Anything else | Nothing. No analytics, no crash reports, no update pings. | — |
Safeguards
Guardrails that are in the code, not just the policy
- The API key never reaches the page. It is encrypted with the operating-system keychain and only the main process can read it.
- Destructive actions need your confirmation — clearing a page, deleting objects or pages, opening or overwriting boards.
- Bounded output. At most 40 actions run per reply, and unknown actions are rejected outright.
- No open HTTP bridge. The page can only send a validated list of chat messages to a fixed destination.
- Changing the AI endpoint requires a native confirmation dialog.
- A school proxy is included: per-teacher tokens, rate limits, a model allow-list and quotas, so teachers never hold provider keys and the school can audit use.
- Strict Content-Security-Policy, a sandboxed renderer, and navigation and permission lockdown.
- Board files are sanitised on load, and all text reaching the DOM is escaped.
Children
Pupils do not have accounts
Chalkline has no pupil logins and no student data model. The practical advice, repeated in the guide: do not write pupils’ names or photos on boards you send to an online AI, and use the offline Rules mode when you do.
Because we hold no data, the school remains the controller of whatever its teachers put on a board. A data-protection checklist for school deployments is available on request.
AI can be wrong. Solutions, integrals, sections and assistant replies should be checked before they are presented as correct. The terms say so, and the interface keeps the working visible so there is something to check.
Try it with the network cable out.
That is the test we design for: everything except the optional AI assistant works with no connection at all.