Student privacy
You can't see students' data. Not "may not", but cannot.
Most systems solve this with permissions: the teacher may not look. tilsam solves it in the architecture: the teacher's account simply has no path to student data. The link between your class and a family's child is stored in tables your account cannot read, and the child's identity isn't even in a table you can access.
That also means nothing can leak through a bug in the interface, a forgotten setting or a stolen teacher account. The boundary is tested automatically with every change to the system.
You see: your term plan, how many families have joined and, if you use the class list, your own labels with a status per spot.
You never see: which child was linked, the student's plan, study sessions, check-ins, wellbeing or anything else from the family's app.
The family is in control: they see who you are before saying yes, they approve the link and can revoke it at any time, without you learning more than that a family has left.
The outcome belongs to the family: what they do with your suggestions is never reported back to you.