Entry point

Learner data enters via three paths: (1) the educator surface (tutor or school admin manually creates a learner or imports a roster CSV), (2) the parent surface (parent adds child during onboarding), (3) class-code self-enrollment (learner enrolls themselves via a code). All three trigger COPPA consent capture if the learner is under 13.

Storage region

Primary database: Supabase Postgres in AWS us-east-1. EU customer data is mirrored to Supabase eu-west-1 with primary serving from the closest region. Object storage (recordings, uploads): Cloudflare R2 with regional replicas.

Lesson runtime

When a lesson starts: LiveKit cluster in the geographically nearest region brokers the WebRTC streams. Streams are NOT recorded by default; when recording is enabled (with parent consent), encrypted output uploads to R2 and the manifest URL is stored in koydo_lingua_lesson_recording.

Engine + AI assist

When a tutor invokes engine drafting (homework comment, parent digest, announcement translation), the request goes through the Koydo ai-gateway Edge Function. Apple Foundation Models attempt the request on-device first; cloud LLM (OpenAI or Vertex) only invoked on AFM miss or low-confidence.

PII boundaries

Cloud LLM prompts strip identifying tokens (learner name → 'student', tutor name → 'tutor', cohort name → 'cohort') before transmission. The original tokens are re-injected on response. The cloud provider never sees the actual learner identity.

Egress

Outbound paths: Stripe (payment + payout data only), LiveKit (real-time stream brokering), Sentry (error reports with PII scrubbed), Google Workspace (transactional email). Each documented in the sub-processor registry.

Retention boundary

PII is auto-purged 30 days after contract termination. Aggregate de-identified metrics retained 7 years for accreditation reporting. Recording auto-purge 90 days unless pinned.