Privacy and security on the computer

This page is about Notosaurus on a computer. For the Android app and its service, see the app’s privacy policy.

On a computer, Notosaurus has no account and no server of its own: it runs on your computer. A lesson often shows a child’s handwriting, sometimes their name: here is where it goes.

What leaves your computer

• The photos and the instructions go to the AI service chosen in the settings, to make and correct the cards. The text of a digital PDF goes with its page. With them go the child’s class and your instructions for them, never their first name.

• The backs of the cards go to Microsoft’s text-to-speech service, to make the audio, when a voice is chosen.

• The description of a picture goes to the service that draws it, for “Language: vocabulary in pictures”.

• The words of a picture search (a few English words: “dog”, “Storming of the Bastille painting”) go to Wikimedia Commons and Openverse, to find free pictures; never the photos.

The pages themselves load nothing from elsewhere: their scripts and fonts come with Notosaurus (no Google Fonts, no CDN).

Nothing else: no statistics, no tracking. With a model at home (see AI services), the photos don’t leave the house either.

Free tiers

Free tiers usually let the AI service use what you send to improve its models. For children’s notebooks, prefer a paid key. Before taking the photo, you can also cover a name written on the page.

Where the data is

Everything is kept as plain files, in Notosaurus’s data folder: the lessons (photos, cards, audio), the instructions and the settings.

• In the add-on, it is in the add-on’s folder, under user_files/data. Tools → Notosaurus → Server status… shows where. It is kept when the add-on is updated, and removed with it.
• Standalone, it is the data/ folder (or NOTOSAURUS_DATA).

The API keys are stored in that folder, in settings.json, readable only by your user account. They are never sent back to a phone or a browser: the settings only show their last four characters.

To back up Notosaurus, copy the data folder. The cards themselves are in Anki, backed up by Anki and, with an account, by AnkiWeb.

Who can use Notosaurus

• Only paired devices. Over the Wi-Fi, only the computer itself and the devices that scanned the QR code (Settings → Phones) can use Notosaurus: others can’t spend your AI credits or delete lessons. Disconnect every phone unpairs them all, for instance after a phone was lost or lent.
• Settings only on the computer. In the add-on, the settings open only on the computer itself: children can’t change the AI service or see the keys from a phone. Standalone, they are protected by a password.
• A lesson belongs to a profile. A lesson can only be changed from the Anki profile it was made in; another child gets their own copy (⧉ Copy for…).

The Wi-Fi

Notosaurus talks to the phones in plain HTTP, on your local network. Pairing keeps out the curious and other websites, but not someone spying on the Wi-Fi traffic: keep your Wi-Fi protected (WPA2 or WPA3).

Notosaurus is made for home: the phones use it on the same Wi-Fi as the computer. Never expose Notosaurus (or AnkiConnect) to the Internet.