Binding on every file here and on anything published from it. The student in this programme is a minor. These rules are not editorial preference.
Her grades and hours are published. Her identity is not. The practical effect is that her record never surfaces in a search for her name, which is the part that follows her into adulthood.
This is thin cover, and it is meant to be. The repository author is named, and anyone who knows him can work out who the student is. The rule is not anonymity against someone who already knows her; it is that nothing here is indexed against her name.
A public document that says a named-or-guessable ten-year-old is at a specific place at a specific time is a safety problem, however ordinary the activity.
| Never publish | Publish instead |
|---|---|
| Named organisations, troop or unit numbers | the category: “scouting”, “a sports club” |
| Days and times of any activity | hours per week |
| Towns, bases, facilities, tutoring centres | nothing, or the country at most |
| Anything that fixes her to a place and a time | a weekly total |
“Scouting, one meeting per week, 1.5–2 hrs” makes exactly the same argument as naming the troop and the night, and tells a stranger nothing useful.
No publisher’s content is reproduced here: no word lists, quiz items, answer keys, grading tables or lesson text. Naming a curriculum you use is factual and fine. Reproducing it is not. The two are easy to confuse under deadline — when in doubt, describe the structure and omit the content.
Anything interactive — the coverage benchmark, any calculator — collects nothing and sends nothing. No analytics, no form posts, no third-party scripts, no storage. A family checking whether they do enough hours should not have to trust anyone with the answer.
If that ever changes, it needs a written data policy first, and it must not be bundled quietly into a release.
The repository’s leak scan covers (1) and (3) mechanically. (2) and (4) need a human.