Unusually little student data. On purpose.

Students

• No student accounts, rosters, emails or SIS ids.

  Students open a Program with a link, QR code or room code. Joygi never asks who they are.

• Private work stays on the device.

  What a student writes, makes or practices in a Program stays in their browser. It is never sent to Joygi's servers, to educators, to Studio, to Apollo, to analytics or to any AI provider.

• What a student keeps, they control.

  A Carry choice is saved only when the student taps Keep, only in that browser, and can be removed from the device with one tap.

• No tracking.

  Joygi creates no completion records, readiness states, engagement scores, risk flags, emotional-state inference or profiles of any student.

• What a live Room sends.

  A room code and one random token per room and browser tab, so a device counts once. The server holds the room's position and a hash of the token, in memory, for at most three hours. The facilitator sees a count of devices and nothing else.

• The room garden.

  In a group session, a student can scan the code on the shared screen and tap once to plant a seed. That tap is a live Room join and sends exactly what one sends: the room code and one random token. No name, no words. The screen draws one seed per device, never a number, and ranks nothing.

• The four corners.

  While the facilitator holds the four corners open, a phone in the room may tap one of the session's four choices, once. The tap carries the room code, the same random token and a number from one to four. Every corner is a good corner. The screen draws seeds in the corners only once at least five phones have chosen, never a number, never who, and the facilitator sees the same. When the session ends, the code stops working and the room is gone within three hours.

• The room activity.

  Some sessions tend one picture together: a tree, a field or a canopy on the screen. While the facilitator holds it open, a phone may tap one of the session's suggestions, or write its own words and keep them. What the phone sends is the room code, the same random token and one number, once. Words typed on a phone never leave it. The screen adds one leaf, sprout or lifted stone per tap and never shows a number or who tapped.

Educators and organizations

• Beta access is by invitation, work is by account.

  An invitation admits an educator. A Joygi account, with email and password held by the sign-in provider, then holds a workspace and a role. Joygi's own records keep the email only as a keyed hash and a short hint.

• A preview has an end date, and nothing is lost when it ends.

  An invited organization's preview runs for a set number of days from the first time its lead enters. When it ends, the sessions, live Rooms and program links close; the organization's saved configuration, its team page and the conversation with Joygi stay open. Nothing is deleted, nothing is billed, and no group is launched without an agreement.

• Your library belongs to your account.

  Saved Programs and Journeys are kept in your workspace on Joygi's servers, so they follow you to any device. They hold Program definitions and Journey names, and nothing about students.

• A request for access keeps only what you type.

  Your name, work email, organization and the setting you describe are stored so Maria at Joygi can reply. Nothing about students is asked or kept.

Cookies, analytics and AI

• The student surfaces set no cookies.

  Joygi's other surfaces use first-party, HttpOnly cookies only. No third-party cookies are needed.

• No analytics or tracking tools.

  No tag managers, session replay, ad tech, tracking pixels or error-reporting services. Pages cannot contact other sites: the content security policy allows connections to Joygi only.

• No AI provider is called.

  Apollo, Joygi's programming assistant, is deterministic code. It works on your goals and Programs and never reads what students write. Before a model is ever used, the provider and its no-training terms will be named here.

• Fonts are self-hosted.

  No external scripts or content delivery networks load at runtime.

Security

• Transport and headers.

  HTTPS only (HSTS), a nonce content security policy, no framing, no referrer, and a restrictive permissions policy on every page.

• Requests.

  Strict schema validation and same-origin checks on every write. Room and link creation are rate-limited by the proxy-reported address.

• Secrets and tokens.

  Secrets live in the host's environment, never in the code. Tokens and secrets are hashed or signed and compared in constant time.

• Hosting.

  Render, in Virginia, United States. Databases for staff and account surfaces use row-level security and verified TLS.

Deployment

• Nothing to integrate.

  No SIS, LMS, rostering or single sign-on is required. Educators can post a Program link in any LMS, email or class page; if formal completion tracking is needed, the school's LMS remains the system of record.

• Allowlisting.

  Only Joygi's own domain. The browser never contacts another host.

• Browsers and devices.

  Current Chrome, Safari, Edge and Firefox on phones, tablets, Chromebooks and laptops. Layouts are checked from 360 px up.

• Accessibility.

  Working toward WCAG 2.1 AA: keyboard access, visible focus, screen-reader semantics, reduced motion, 44 px targets and checked contrast. A VPAT follows a stable release and an independent audit.

Questions we are asked