Help & setup

The app owner should sign in with the same GenMB email used to own this app. Ownership is checked on the server; it cannot be selected during registration.

Use Administration → Users & roles to create Teacher, Student or Administrator accounts. Staff accounts need a paid GenMB plan. Give temporary passwords directly to account holders; they choose a new password on first sign-in.

Public registration creates student accounts only. Every teacher and student must sign in once before they appear in classroom enrolment lists.

This app uses the enabled built-in key-value store, not a relational database. A managed relational database is a Pro feature. You can upgrade to Pro, or connect your own Supabase project for free from the Database panel.

The backend now uses GenMB’s supported server key-value and Secrets APIs. No custom storage binding is needed. School records use one persistent encrypted key per record, with permissions checked on the server. The encryption key is required because the shared key-value store is publicly readable; removing encryption would expose student information.

1. If any school records were saved previously, restore their original ACADEMY_DATA_KEY. Do not replace it or delete existing records.
2. For a new academy with no saved records, generate a new cryptographically random value privately. On a computer with OpenSSL, run openssl rand -hex 32 in a terminal. Alternatively use a password manager to generate a random password of 64 characters. Do not share the output in chat.
3. The platform app owner opens this app in the GenMB editor, opens the backend Secrets panel, adds the exact name ACADEMY_DATA_KEY, pastes the generated value without extra spaces or quotes, and saves it. Do not put it in frontend files or academy Settings.
4. Keep a secure password-manager backup. Refresh the app, sign in as Owner and run the storage test below. Then save a subject and classroom, refresh, sign out and sign back in to verify they remain available.

Existing encrypted records are preserved. A wrong key or damaged record produces an error rather than showing a misleading empty academy. Private profile notes still use account-scoped KV. Shared KV does not guarantee protection against deletion or replay of encrypted values; keep backups and use an access-controlled relational store before relying on it for production-sensitive school records.

Meetings use browser WebRTC peer connections with GenMB realtime signalling. No LiveKit or Jitsi is used. They are designed for small tutoring groups; each device connects directly to every other participant.

Use the published HTTPS app and allow camera/microphone access. Embedded previews may need the host to allow camera and microphone in its iframe.

STUN is included. For reliable calls across restrictive networks, configure your TURN relay and add backend Secrets TURN_URL, TURN_USERNAME and TURN_PASSWORD. Use short-lived credentials for production; this version uses the configured account credentials.

Chat and whiteboard updates are shared in realtime, with session history copied from connected participants for late joiners. They are not retained after every participant leaves. GenMB channels are app-scoped, not documented as classroom-authorised; confidential meetings require server-controlled channel access before production use.

The built-in uploader supports photos, PDF, Word, spreadsheet, presentation and text documents. Files are public by URL and can be listed by visitors. Upload only non-confidential learning materials.

For private student photos, marked work or confidential documents, connect access-controlled storage before using uploads with real student information. A signed URL from the current storage service does not make a file private.

Announcements, assignments, submissions, feedback and behaviour updates generate saved in-app notifications. Deadline reminders are generated on a student’s visit within 24 hours of the due date, not by a background email service.