Trust in a tool that carries children's stories has to be structural. Here are the hard questions, answered by architecture rather than by policy.
Both, in the right order. Where a page includes AI-written prose, that AI element does one fixed job, authored and vetted by our team, fed only the observed moments within the current scope. The teacher steers it with dials — length, tone, audience, focus — and by starring the moments that matter most, so the words are anchored in evidence, not in typed instructions. There is no prompt box anywhere in the product. No user-typed text ever reaches an AI instruction. Then the teacher reads and approves every word before it ships. Each school holds its own AI off-switch, generated fills are cached so a page opened by thirty families bills once, and a school that turns generation off keeps the full analytical product.
Mostly nowhere — and that is the design. The intelligence (similar moments, themes, intent routing, the charts) runs in the browser on the school's own devices: TF-IDF plus a self-hosted, quantised embedding model of about eight megabytes, downloaded once and cached (Model2Vec; Tulkens & van Dongen, 2024). It works behind school network filters, costs nothing per use, and observation text never leaves the room to be understood. Cloud AI is optional garnish, spend-bounded. There is no mining, no profiling, no third-party model training.
A room, not a door. The school's credential never travels in a URL. A published link carries a scoped view-code that returns only that page's slice of data — nothing about the wider record travels with it. And a sent link is never silently rewritten: editing the draft afterwards doesn't change what a family already received.
No — and we will decline the principal who asks. Practice lenses speak at team level: an unseen stretch is information about us, never a league table of adults. The same line holds for children: no ranking surfaces exist to switch on.
Only when a human chooses. Gatherr works in fourteen languages — the interface translates itself, a page's language travels with its link, and the intelligence tokenises Chinese, Arabic, Tamil and Thai correctly. But names and a teacher's own observation text are never machine-translated silently. Fidelity to the moment outranks fluency of the page.
Real, and cited. Similar moments run on Okapi BM25 (Robertson & Zaragoza, 2009) fused with dense embeddings by reciprocal rank fusion (Cormack, Clarke & Buettcher, 2009), gated so weak matches are suppressed rather than padded. Themes come from the school's own vocabulary, never a generic taxonomy. The flow read follows Csikszentmihalyi (1990); the coaching copy follows Hattie & Timperley (2007); the thinking tools follow Hyerle (1996). One boundary we state plainly: observation data measures attention as much as ability, so we never claim psychometric validity — our claims are pedagogical, and our own lenses are the first to expose the gaps in a school's noticing.