Privacy · DoDefend

What DoDefend is

DoDefend is used by an instructor to assess practical work. Students capture evidence of their work on their phone, answer a few questions about it, and the instructor validates the result. This page explains what happens to that work and to the information around it. It is written for students first and for instructors second.

What DoDefend holds

For each student invited to an assessment, DoDefend holds:

The email address the instructor invited you with, and your name if the instructor entered one.
The evidence you save at each checkpoint: photos, short videos, and audio recordings, with the note you typed or recorded beside them.
Text transcripts of your recordings, of the sound of your videos, and of your voice notes. They are made by an AI transcription service and are labelled as AI-transcribed wherever they appear.
Your answers to the defense questions, typed or recorded, with transcripts of the recorded ones. A question you skip is recorded as skipped.
The AI's advisory draft, the instructor's judgment of each rubric criterion, and the validated record.

For an instructor, DoDefend holds the email address you sign in with, your name if you gave one, the course export you import and what is extracted from it, and the title and extracted text of each PDF, DOCX, text, or Markdown course material you upload. The uploaded material text is stored so you can reuse it in assessment proposals and later regenerations; the uploaded document file itself is not kept after its text is read. DoDefend keeps no passwords: instructors sign in with a link sent to their email, and students use the private link in their invitation.

To limit abuse, requests under a student link are counted per link and per network address for a short window. The counters are kept under one-way digests made with a secret key that the database does not hold, so the link, the address, and the student are not stored or logged by that mechanism, and a copy of the database cannot be worked back to them. Expired counters are cleared as later requests are counted.

Course-material upload attempts are also counted per instructor account for a one-hour window, so one account cannot start an unsafe number of document readers. That counter uses the same one-way, secret-keyed protection: it does not store the instructor's account id, and it expires after the window.

Educational records, and what they are used for

Everything a student captures, writes, or says in DoDefend is part of that student's educational record for the course. DoDefend uses it for one purpose: to run the assessment it was captured for. That means generating the defense questions from your own evidence, drafting an advisory evaluation for your instructor, showing your work to your instructor for validation, and writing the record.

Student data is not used to train or improve AI models, ours or anyone else's. It is not sold, not shared with advertisers, and not used for any purpose unrelated to this assessment.

For institutions in the United States: student evidence is treated as education record data under FERPA. DoDefend uses it only for the assessment, collects only what the assessment needs, and shows it in the product only under the student's own link and to the instructor who owns the assessment. Outside the product, it is held and handled by the services listed under "Where your work is kept" and "AI and transcription providers" below, each for the job described there. Those two sections list every service DoDefend keeps your work with or sends it to.

Who can see your work

Anyone with your private link. The link is meant for you alone, but it is the only key: nothing under it asks for an account, a password, or a code, so a person you forward it to, or who finds it, can open your assessment and see your work, and can add to it while the assessment is open and your work is not yet validated, exactly as you can. Keep it to yourself; "Your private link" below says how it is protected and how your instructor can replace it.
The instructor who owns the assessment. They sign in with their own email address and see everything you save: your media, notes, transcripts, answers, the AI's draft, and your record. No other instructor can see it, even one using DoDefend.
Nobody by any other route. There are no public share links, records are not searchable, and the pages under your link are marked so search engines do not index them. The services that hold or handle parts of your work for DoDefend, and what each receives, are listed in the next two sections.

Your record names the instructor who validated it and when. It is the assessment's output: once written, it is never edited.

Where your work is kept

DoDefend runs on infrastructure it rents. Three providers hold or carry your work on DoDefend's behalf, each on DoDefend's instructions and for no purpose of its own:

The hosting provider runs DoDefend's servers: the web application you and your instructor use, and the background worker that processes your media, makes the transcripts, and calls the AI. Everything described on this page passes through those servers. Today that is Railway.
The database provider holds DoDefend's database: your email address and name, your notes, the transcripts, your answers, the AI's draft, your record, and the one-way hash of your link. It also holds the instructor's uploaded course-material titles and extracted text. Today that is Railway.
The storage provider holds the private bucket with your photos, videos, and recordings, the originals and the processed copies, and the instructor's course export. Today that is Amazon Web Services.

AI and transcription providers

Beyond the infrastructure above, DoDefend sends parts of your work to three services, each for one job, through their programming interfaces:

Anthropic (the Claude API) receives the assessment's design and, for each student, the photos (with their metadata removed), still frames taken from the videos, the transcripts, the typed notes, and the defense answers. It is used to generate your defense questions and to draft the advisory evaluation. It also receives the text DoDefend extracts from the instructor's course export (the title and text of each page, file, and link in it, not the export file itself), to find the learning objectives. DoDefend does not attach your name or email address to any of this: they are not among the fields it sends. When the instructor selects an imported or uploaded course material, Anthropic receives that material's title and extracted text to generate the initial assessment proposal and any later regenerated proposal. The original uploaded document file is not sent. Selected material goes as it is, so anything that identifies a person in its title or text reaches Anthropic with it. But what you capture, write, or say goes as it is, so anything that identifies you in a note, a recording, an answer, or a photo (your name written or spoken, your face, a label on your work) reaches Anthropic with it. DoDefend reaches Anthropic directly. It can be set to reach it through a gateway instead, a service that forwards the requests and receives the same as Anthropic, but not without naming the gateway here; none is named, and none is used.
OpenAI (the Whisper API) receives the audio of your recordings, the sound of your videos, your voice notes, and your spoken answers, and returns the text. It receives the audio as a file and nothing else about you; for a video, that is the sound track alone, not the picture.
Resend delivers the emails DoDefend sends (your invitation, the notice that your questions are ready, the notice that your record is ready, and the instructor's sign-in link) and receives each one whole: the address it goes to; the name it is shown as from (your instructor's on your emails, DoDefend's own on a sign-in link) and the address it is sent from, which is DoDefend's sending address; the address replies go to, which is DoDefend's reply address, named under "Contact"; its subject line; and its body. For a student, that is your email address; your name, if the instructor entered one; the instructor's name, or their email address if they have not given one; the assessment title and the course title; in the invitation, the due date and the opening lines of the scenario; in the notice that your questions are ready, how many questions there are and about how long they take; and your private link. For an instructor, it is your email address and your sign-in link. No evidence, transcript, answer, draft, or record is ever emailed. Nothing else about you goes with the request: the two notices also carry a code that lets Resend tell a retried notice from a new one, so that a notice sent again within a day is not delivered to you twice; Resend keeps the code for a day, and a retry after that can reach you twice. The code is a one-way digest that names nothing.

The AI never assigns a grade. Its draft is advice, shown to the instructor with the evidence it cites; the instructor decides every criterion, and nothing is pre-selected for them.

Your private link

The link in your invitation is your only key to your assessment. Anyone who has it can open your assessment and see your work, whether the assessment is open or closed and whether your work is validated or not, and can add to it while the assessment is open and your work is not yet validated: once your instructor closes the assessment or validates your work, the link still shows what you saved, and nothing more can be added under it. Do not forward it or post it. The link is a long random key; the database keeps a one-way hash of it, not the link itself. The server can rebuild your link only with a secret key it holds, which it does to send you the later emails.

Your instructor can revoke your link or send you a new one. The old link stops working at once. Pages under your link send no referrer to any page you go to from them, so the link does not leak to other sites.

Media, metadata, and storage

Location and camera metadata is removed from every photo and video before it is shown to your instructor or sent to the AI.
Your media is kept in a private storage bucket that is not publicly readable. When a page needs to show or upload a file, your browser gets a signed link that stops working after 10 minutes for viewing and 15 minutes for uploading.
Every upload is checked: its declared type and size before it starts, and its actual content afterwards. Files that are not the photo, video, or audio they claim to be are rejected, and executable files are rejected outright.
Connections to DoDefend are encrypted in transit (HTTPS).

Retention and deletion

Today, DoDefend keeps what you capture for as long as the course and the assessment exist. Nothing is deleted on a schedule, and the original files of your media are kept beside the processed versions. Automatic removal of original media after validation is planned but not in place; until it is, originals are kept.

An instructor can delete a course or an assessment from its page. Deleting removes it from the database with every student under it: their evidence, notes, defense answers, drafts, results, and links, which stop working at once. The removal of the files from storage is queued in the same step and follows shortly after; it runs once more 75 minutes later, so a capture that an upload link still valid at the deletion finished in between is removed too. Before anything is removed, every validated record is written to private storage as it was validated and checked there, under a separate archive path that the file removal never touches; a validated result is kept even after its course is gone. There is no delete button for one student's evidence on its own. Requests to remove other data go through the contact below.

Contact

Students: your instructor is the first contact for anything about your work, your record, or your link. They are named in every email DoDefend sent you. A reply to one of those emails reaches DoDefend, not your instructor.

Instructors, and anyone with a question this page does not answer or a request to remove data: reply to any email DoDefend sent you. Every email DoDefend sends names the address replies go to, whoever it is shown as from. DoDefend does not send from a no-reply address, and never directs replies to one. The mailbox replies go to is read by the team that runs DoDefend.