Release Notes — AI Privacy & Compliance (Alpha 0.10.15)

Overview

This release introduces a comprehensive AI privacy and compliance system for Scholar, designed to support users and institutions operating under stricter AI regulations such as the UK AI regulatory framework and the EU AI Act. The new system provides a layered, auditable privacy model that lets individual users, project administrators, and per-prompt requests all participate in deciding whether a user's profile information may be shared with the AI.

What's included

A global "exclude my profile from AI prompts" preference

Every Scholar user now has a personal AI privacy preference that applies globally to every AI feature in the product:

At registration, a new "AI & Privacy Preferences" section lets new users opt out of having their profile information sent to the AI.
In their user profile, users can toggle the preference on or off at any time. Changes take effect immediately across the app — including in any AI configuration screens that are already open elsewhere in the session — without requiring a page refresh.
Default behavior is "profile included." Users opt out; they don't have to opt in.

When a user has this preference enabled, no AI feature in Scholar will receive their profile information. The preference is stored on the user's profile document under a dedicated AI preferences namespace.

Project-level enforcement for administrators

Administrators creating tasks in admin projects now have a new work-settings option, "Exclude all user profile information from

AI prompts (UK/EU compliance)." When enabled on an admin task:

Every member of that project, working on a task derived from that admin task, has the personalization toggle locked on for that work.
The lock is reflected in the user-facing AI configuration screens with an "Enforced by project" badge, so members understand why the option is greyed out.
The setting is enforced server-side on every AI request, independently of any client-side state.

A help icon next to the admin control explains the setting and its compliance purpose.

Bulk-registration honors the same preference

When an administrator bulk-enrolls students into an admin project, the bulk-registration form now includes a project-wide toggle to set the AI privacy preference for the entire batch of new accounts. Each newly created profile is stamped with the chosen value, so a privacy-conscious admin can stand up an entire cohort with profile-exclusion enabled by default.

Per-prompt control inside AI configuration modals

Every AI configuration modal — for CyberHelper, CyberReview, and Human-Review-AI — now includes an "Exclude my profile information from AI prompts" checkbox as its first, most prominent control, accompanied by a help icon explaining what it does. The checkbox shows the truthful, effective state at all times:

If the project enforces exclusion, the box is checked, locked, and labeled "Enforced by project."
If the user has opted out in their own profile, the box is checked, locked, and labeled "Set in your profile."
Otherwise, the box is freely editable for this individual prompt.

Whatever the user chooses for an individual prompt is sent to the server alongside the AI request.

Server-side enforcement chokepoint

A single decision point in the server now governs whether a user's profile may be appended to any AI prompt. The chokepoint applies a strict OR rule across three tiers:

The per-prompt request from the client
The project's policy on the work in question
The user's own profile preference

If any of those three says "exclude," the profile is not sent. Each suppression produces an audit log entry stating exactly which tier triggered it, providing a clear paper trail. The chokepoint fails closed: any error during the lookup also suppresses the profile. The decision is made independently of the client, so even a buggy or tampered-with request cannot bypass an enforced project policy or a user's profile preference.

Coverage across every AI surface

The privacy gate is applied consistently across all 15 AI surfaces in Scholar:

The 10 CyberHelper modules: Ask, Advise, Brainstorm, Check Flow, Expand, Plan, Proofread, Research, Summarize, and Translate
CyberReview, the rubric-driven AI reviewer
Human-Review-AI, the review-of-a-review feature
The SOAR-based cyber-review engine, in all three of its modes (single-criterion, multi-criterion, and follow-up conversation)
AdminChat and the Voice Assistant

For AdminChat and the Voice Assistant — which are not tied to a specific work — the user's profile preference is the governing setting (since there is no per-work toggle and no project policy to apply).

Anti-hallucination directive on every AI prompt

Even when a profile is suppressed, an AI can sometimes "helpfully" invent a name to address the user (we've seen frontier models default to names like "Alex" or "Sarah" when prompted to address someone whose name they don't know). To eliminate this, every AI prompt in Scholar now carries one of two explicit privacy directives:

When personalization is allowed, a positive directive tells the AI to address the user by the name in the supplied profile and use the profile thoughtfully.
When personalization is suppressed, a categorical anti-hallucination directive forbids the AI from addressing the user by any name, from inventing or guessing a name, and from carrying over names from prior chat history. The AI is instructed to use neutral pronouns and to drop personalized framing entirely.

The negative directive appears verbatim in every gated prompt, both as a runtime guardrail for the model and as an audit trail for compliance review.

How the layers fit together

Tier	Who sets it	Where they set it	Scope
1. Per-prompt	The user, on the fly	AI configuration modal in the editor	A single AI request
2. Project policy	Project administrator	Admin task work settings	All works in the project derived from that task
3. User preference	The user	Registration form, user profile, or bulk-register form	All AI features in Scholar, for that user

If any tier is set to "exclude," the profile is suppressed. The user-facing UI shows the most-restrictive active source so the user always knows why a control is locked.

What you'll see as a user

A new "AI & Privacy Preferences" section on the registration form, in your profile, and inside every AI configuration modal.
A help icon next to each control with plain-language explanations.
Source-specific badges ("Enforced by project" or "Set in your profile") that explain why a control is locked when it is.
AI responses that no longer address you by an invented name when you've chosen to keep your profile private.
Immediate, in-session reflection of any preference change you make in your profile.

What you'll see as a project administrator

A new "Exclude all user profile information from AI prompts (UK/EU compliance)" toggle when configuring an admin task.
A new batch-default toggle on the bulk-registration form so an entire cohort can be created with profile-exclusion enabled.
Console audit lines on the server describing every personalization suppression and its cause.

Compatibility

Existing user records, project settings, and accounts continue to work without modification.
Any user who has not expressed a preference defaults to "profile included," matching prior product behavior.
No data migration is required.

New Release Alpha 0.10.15