Where does your data go?

This page is for teachers who want to know what Corico does with data before using it, and for the people who advise them (data protection officer, school management, digital lead).

The principle: Corico has no database, no accounts and no file storage. Everything that has to last is in your own Nextcloud space on the ENT. The Corico server only relays the exchanges between your browser and this Nextcloud, and keeps nothing of them.

Know this first: a QR code is enough to listen

The memo links are sensitive and are protected neither by a sign-in nor by a personal code. Anyone who scans the QR code gets the audio.

This choice is deliberate: the student listens without an account or an app. It has a direct consequence: the QR code does not check who is listening. The link is impossible to guess, but it only has to be obtained once:

• a classmate who scans another student's paper, or a photo of that paper, can listen to the memo;
• a photo shared in a class chat gives access to the whole group, until the link expires;
• access leaves no trace visible to the teacher in the tool.

What to take from this:

• In the memo: talk about the work, without any student's name and without anything you would not say if a classmate were listening. No grade, no personal, health or family situation.
• When handing back: hand the papers back in person and tell the students that a photo of the QR code gives access to the memo.
• Sheet of labels: until the QR codes have been stuck, it links each student's name to their link. Keep it with you, then destroy it. The same goes for the PDF.
• In case of a leak: delete the sharing link in Nextcloud. Access is cut immediately, and the printed QR code no longer works.

The app shows this warning everywhere a QR code appears, and on the page that generates the PDF, before the download.

Where things go

The word "server" or "relay" means nothing to you? Everything is explained in How it works and in the glossary.

Who sees what

Data	Your device	Page site (French hosting)	Relay (OVH VPS)	ENT's Nextcloud
App password	Stored	Never	Passes through, never kept	Checks it
Encryption key	Stored	Never	Never	Never
Sound of the memos	Until sent, as a draft	Never	Passes through, never kept	Stored, not encrypted
Student names, class lists	In clear	Never	Pass through encrypted	Stored encrypted
Names of classes and assignments	In clear	Never	Passes through, never kept	Folder names, in clear
Link between student and memo	In clear	Never	Passes through encrypted	Stored encrypted
Your Nextcloud login	Stored	Never	Passes through, never kept	Already knows it
IP address	—	Host's logs	Seen during the connection; a hash kept 15 minutes at most	The relay's, or the listening student's

"Passes through" means the data goes through working memory for the time of the request, then disappears. The relay writes nothing to disk. The sound is converted to MP3 on your device, before it is sent.

What stays on your device

The camera, only if you scan Nextcloud's QR code on a phone, and only during that scan: the image is read on the phone, then forgotten. Nothing of it is sent or kept.

On your device: it depends on what you said it is (a personal or a shared device). On a personal device, the Nextcloud access, the lists, the links between students and memos, the memos not yet sent and the encryption key are kept in the browser, like files on your disk, and the app password is there in clear, unless you chose a local password: it then seals all of it, and is kept nowhere. On a shared device, they stay in the page's memory and nothing of them is written on the device: closing the page, or 30 minutes without activity, forgets them. Corico asks the browser not to offer to keep the app password, without being able to forbid it in every browser. The language and the theme you chose are kept too, and on the documentation site the language you read it in. There is no account of ours. A button erases all of this if you wish, and revoking the app password cuts the access of every device.

While the tool is open and in view, it fetches the encrypted backup once a minute, to tell you what your other devices did: each time the same request, through the relay, which keeps nothing of it.

So that the tool opens without a network, the browser also keeps a copy of its files, never of your data. This copy updates by itself.

The key exists only on your devices. To add one, the tool creates a link that contains the Nextcloud access and the key, encrypted by an 8-character code to be passed on separately; this link is never sent to a server and leaves the address bar immediately. With its code, it opens everything, and your devices share the same app password: revoking one cuts all the devices. After a device is lost, the key can be changed. If the key is erased everywhere, the backup can no longer be read and you have to start from scratch. The memos stay in Nextcloud and the printed QR codes keep working.

What the relay does, and nothing else

The relay exists for a single technical reason: the ENT's Nextcloud does not allow a web page from another site to talk to it directly (CORS).

• It stores nothing on disk. No database, no file, no cache. The service runs with no folder to write to, and the system prevents it.
• It does not log requests. It writes only one line at startup. No login, no file name, no IP address in its logs.
• It holds, 10 minutes at most, half of a pairing link's secret. When you pair a device, the relay draws a random number, keeps it in memory, gives it once to the device that opens the link, then forgets it: after that, or after 10 minutes, the link and its code open nothing. This number contains nothing of you, no account and no data; the address that asked for it is only kept as a hash, to limit abuse, and goes with it.
• It slows abuse down, with one exception to know about. To limit requests and refused passwords, it keeps in memory, for 15 minutes at most, a hash of your IP address: a value that cannot be reversed, computed with a secret drawn at each start. It is never written to disk or tied to a name.
• It has no accounts. Your login and password go along with each request and are never kept between two requests.
• It talks to a single server only. The destination is fixed in its configuration, the system blocks any other address, and only the useful operations go through: uploading and reading files of the Corico folder alone, creating a read-only link to one of them, checking the account. It can also delete a memo when you ask for it, and nothing but a memo: only files with the names the tool gives its sounds, never your backup. It can see nothing else in your Nextcloud, and delete nothing else there. Everything else is refused.
• It does not follow redirects, so that your password never goes to another server.
• It adds no statistics, no trackers, no advertising. Neither does the page: it loads nothing from a third-party site.

What you have to take on trust

Saying "nothing is stored" does not mean "no risk". Here are the limits, plainly.

• The relay sees your app password and the sound of the memos go by. It does not keep them, but whoever administers the server could change the code to do so. You therefore have to trust its administrator: today, Romain Casati.
• The page's host serves the code that runs in your browser. Modified code could read the encryption key. The page's security policy limits its connections to the relay, but this policy is served by the same host: it does not protect against it.
• The sounds are not encrypted on Nextcloud, because students must be able to listen to them. The files have a random name, but a voice can say a first name: do not say the student's name in the memo.
• The names of your classes and assignments are in clear on Nextcloud, as the names of the folders the memos are tidied in, Corico/2nde 3/DS 1/. No student's name is there. A student who opens their link sees the file alone, never its folder.
• A QR code can exist before its memo. If you print before marking, a file and its public link are created in your folder for each student, with nothing but two tones in it. Its name is random, and nothing there tells who it is for: the link between them stays in your encrypted backup. The memo then replaces this file at the same address.
• One QR code for the year, if you choose it. The link then belongs to the student, not to a memo: whoever has it hears all you publish for them, until you make a new one, which cuts the old one at once. Memos not published are private files, with no link.
• A redone memo keeps its link. The new sound replaces the old one at the same address, and the printed QR code keeps working. Nextcloud normally keeps the old sound in the file's "Versions" tab, visible to you alone: delete it there if it really has to disappear.
• The QR code's link is public. Anyone who obtains the QR code or the link can listen to the memo, without an account, until it expires. The link is impossible to guess, but a photo of the paper is enough to pass it on.
• The hosts' logs exist. The page's hosting and the ENT keep their own logs (IP addresses, pages requested, times). The secret part of the pairing link is not in them, because it is never sent to the server.
• A paired device gives access to everything. It keeps the app password and the key. Protect it, and revoke the password in Nextcloud if it is lost.

How long data stays

Data	Duration
A memo's sharing link	Expires on June 30 of the school year
Sound file on Nextcloud	Until you delete it: expiry does not erase it
Encrypted lists	Until you delete them
On the relay	For the time of the request; 15 minutes at most for the hash of the IP address
On your device	Until you erase it, with the button provided

Expiry cuts the students' access, but does not delete the file. The end-of-year clean-up is done from the tool: deleting an assignment deletes its memos and their links. Nextcloud then keeps them in its trash for a while, visible to you alone.

What the student shares by listening

The student scans the QR code and lands directly on the ENT's Nextcloud. They go through neither the relay nor the Corico site, and need neither an account nor an app. Only the ENT sees this connection.

How to check for yourself

1. Look at the traffic. Open the browser's developer tools, Network tab, and use the tool: the only connections should go to the page's site and api.corico.infobrisson.fr.
2. Look at your Nextcloud. Everything the tool creates is in the Corico folder. You can read it, delete it and revoke the links from the usual interface.
3. Cut access at any time. Deleting the app password in Nextcloud immediately removes all the tool's access to your space.
4. Read the relay's code: server/app.ts and server/main.ts, a few dozen lines, are written to be read.

Regulatory framework

This page describes the technical operation and is not legal advice. A memo about the work of a student, often a minor, is personal data. Before using it in class, talk to the data protection officer of your school or your school district (académie), and to your management. This page can be passed on to them as it is.