Security

Keep thieves out of this classroom

A classroom account is a public handle, not a bank. Secure it by checking the address, signing out when you leave, and never giving anyone a password, seed, or lock code.

How to secure account access

1
Check this address before you sign in
…
A fake page copies the login box. The address cannot. We never email a “verify your classroom” link.
2
Prefer Google or X. Do not reuse a bank password
Sign-in only proves who you are on the floor. It is not a brokerage. If you use email, twelve characters, mixed case, a number, and not a word everyone guesses.
3
Sign out of this browser when you leave
You are not signed in here. That is the safest default on a machine you do not own.
Open sign-in
4
Set a lock code if other people sit here
It stays on this device. We never see it. Idle lock hides the desk. On a shared computer, idle lock also signs the account out. After eight wrong guesses the desk is wiped.
5
On a library or family computer, tick shared and wipe when you leave
We will not remember the desk. After 15 minutes idle we wipe it and sign the account out. Leave this tab for 20 seconds and we do the same. Sign out and wipe before you stand up.
6
Hide how much coin you hold if someone can see the screen
Favorites can show last price without size. We never upload how much you hold — only the ticker if you star it while signed in.
7
Never paste a seed, wallet key, bank login, or card number
Not in the Professor. Not on the floor. Not in email. We will never ask. If a page here does, leave.
Phishing lesson · Favorites privacy

Delete my account

Delete my account erases this signed-in desk: floor notes, follows, stars, lessons, class seats, and the sign-in row. A Desk Pass month is canceled. Paper cash on this browser is wiped. House counts stay anonymous tallies. This cannot be undone.

Encrypted transport
On
This page is a secure context. Traffic is not sent as plain text.
Session isolation
On
Cross-site scripted requests are refused so a sibling site cannot ride your session.
Secret harvest block
On
Notes and Professor questions that look like keys, cards, or ID numbers are refused.
Sensors refused
On
Camera, location, and payment stay off. The microphone is allowed only on this classroom, for the speak-to-text button. We do not keep the recording.
Device lock code
Off
Anyone who sits here can read the paper desk. Set a lock code.
Remember this browser
Advice
Lessons and paper fills are written here. Fine on a machine you own.

Lock code for this browser

A code hashed on this device with PBKDF2. It is not sent to us. It hides the desk from whoever sits down next. It is not a bank vault — if they have the code, or eight wrong guesses, the desk is gone.

Auto-lock

Walk away from a shared computer

Signs you out and erases paper trades, lessons, and Professor chats on this browser. Use it on a library or family computer before you leave. Device memory is stamped and can expire — a 30-day age remember is not a date of birth. It is not a vault. Anyone with this browser can still read what it stored.

This is a shared or public computerWe will not remember the desk. After 15 minutes idle, we wipe it for you.Remember the desk on this browserOff = nothing is written after this. Prefer off on a machine you do not own.

Show the welcome chooser on HomeOn = Home asks beginner or tape again. Off = Home is your paper book. How you sit is always in Settings.

This address

…

Phishing sites copy a login box and steal the password you type. Check this line before you sign in. We will never email you a “verify your classroom” link, and we will never ask for a seed phrase.

What we never ask for

No bank login, no brokerage account, no card number, no government ID, no seed phrase, no wallet key. The paper desk is fake cash. If a page here ever asks for those, it is not us — leave.

What a stranger cannot steal from us

Lessons, watchlists, and paper fills live in this browser, not in a vault we keep. Floor notes are public on purpose — do not write anything you would not say in a room. Sign-in uses Google, X, or an email you chose; we do not store a copy of that password in the classroom app code, and session cookies are host-only.

What we do on every request

Cross-site scripted requests are refused so a sibling site cannot ride your session. Writes on the floor require a signed-in user and are paced. Posts and Professor questions are stripped of markup and blocked if they look like keys, cards, or identity numbers. The Professor redacts emails and phone numbers before a model sees them. The browser is told not to send a referrer, not to open camera or geolocation, not to take a payment, and not to sniff file types. The microphone is allowed only on this classroom, for Talk to Professor Moon. We do not keep the recording.

What you still have to do

Use a password you do not reuse. Do not paste recovery phrases into the Professor or the floor. On a shared computer, tick the box above or wipe the desk when you leave. Set a lock code if other people use this machine. We are a classroom, not a bank, and we will not pretend otherwise.

Read the safety path

Privacy Terms About