Student privacy
You can't see students' data. Not "may not", but cannot.
Most systems solve this with permissions: the teacher may not look. tilsam solves it in the architecture: the teacher's account simply has no path to student data. The link between your class list and a family's child is stored in tables your account cannot read, and the child's identity isn't even in a table you can access.
That also means nothing can leak through a bug in the interface, a forgotten setting or a stolen teacher account. The boundary is tested automatically with every change to the system.
You see: your class list (your own labels), a status per spot (Waiting, Linked or Unlinked) and your term plan.
You never see: which child was linked, the student's plan, study sessions, check-ins, wellbeing or anything else from the family's app.
The family is in control: they approve the link when they accept, and can revoke it at any time, and you then just see "Unlinked".
The outcome belongs to the family: what they do with your suggestions is never reported back to you.