Where Novus Learn draws the line between your device and a server

Every second app now says it is private, local-first, or accountless. The claim is nearly free to make and almost impossible for a visitor to check, which is why the interesting question is never whether a product says it. The interesting question is where the exceptions are — because there are always exceptions, and a product that will not name them has usually not thought about them.

Novus Learn is accountless. There is no login, no profile, no sync you did not ask for, and that is a locked architectural decision rather than a phase. Saved projects, attempt answers, and study progress all live in your own browser. But there is one deliberate exception, and it is the most interesting thing about how the assessment layer is built: the 376 scored aptitude suites and the 9 Reasoning Challenge forms keep their answer keys on the server, while the 200 puzzles ship their answers straight to the page. Same app, opposite rules, on purpose. This is the reasoning.

Start with what the exception is an exception to. There is no identity layer in the app — not a disabled one, not a planned one, none. Public topic routes resolve directly, preferences and saved topics and reading history stay on the device, and any sharing that exists works through capability links rather than an account you sign into.

A generated project is a versioned snapshot in an IndexedDB database that is opened lazily and upgraded additively, so an upgrade never drops what was already there. One current revision is kept per source, unchanged content skips the write entirely, and deletion is available per project or for everything at once. Saved and recent items are deliberately thin: public source identity, display copy, revision identity, a path, and a local timestamp. No article body, no profile, no log of what you did in the app.

Study progress follows the same pattern — one compact record per project holding card schedules, best quiz score, and where you were in a guided lesson. The spaced-repetition scheduler that reads it is a pure function with the current time passed in explicitly rather than read from the environment, which is a small thing that makes it testable and a larger thing that means no review, no answer, and no scene change results in a server write.

Files you upload are parsed in the browser and never reach a server, which is why upload-derived projects are not shareable or exportable: publishing content derived from a private file is a decision that has to be an explicit action, not a side effect of the pipeline. Even the optional database behind the public library is genuinely optional — when its configuration is absent, the client library is never imported and anonymous local use performs zero reads and zero writes. It holds a publication registry and a share-revocation registry, not snapshots and not per-user rows.

The scored, timed suites work differently, and it comes down to what a number is being asked to mean. When a surface reports a percentage after a timed sitting, that number is presented as a result about a person. If the person can read the key before answering, the number means nothing — not because they cheated, but because the measurement was never taken. Protecting the score is not about distrust; it is about the score being worth having at all.

So the keys for the aptitude suites and the Reasoning Challenge forms live in dedicated modules marked server-only, which keeps them out of the client bundle entirely. What the browser receives when a session starts is a public question: an id, a type, the prompt text, and the choices. The schema that defines that shape says in as many words that it never includes correct keys, which is the sort of comment that should be checkable rather than reassuring — and it is, because the keys are in files the bundler will refuse to include.

Starting a session also issues a signed token carrying the attempt id, the start time, and a server-side deadline. It is stateless and verified with a constant-time signature comparison, so it works across server instances without a session table, and a token that has been edited fails rather than degrading into something ambiguous. Submitting an attempt verifies that token, checks the attempt id matches it, compares the deadline against the server clock rather than yours, rate-limits, marks the answers, and returns the result with cache headers that forbid storing it. The supported question types run from single choice and multiple choice through numeric answers with a tolerance, ordering, short text, and situational judgment, which is why a key is richer than a letter in a column.

What comes back with the mark is the part that actually helps: an explanation for every item, retained locally so a reload or an export still has it. The score is the excuse; the review is the product.

Applying that machinery everywhere would have been the easy consistency, and it was rejected. The 200 puzzles across 8 categories, the 2,200 cognitive practice questions across 22 banks, and the Reasoning Challenge practice lab all keep their correct answers and explanations in public content modules, rendered in the browser.

Four reasons, and they hang together. A puzzle never produces a score of record — there is no percentile, no ability estimate, nothing anyone would carry elsewhere; the most one of these surfaces may report is how many you solved in this sitting. They are untimed and unproctored by design, so there is no session to protect and no deadline to enforce, which means the ownership machinery would have nothing to own. The explanation is the product and it appears the moment you check, so a learner who reads the answer early has skipped the exercise rather than defeated a control. And server scoring would cost real capability: no offline use in an installable app, a network round trip standing between you and the teaching text, and a route handler for content that is otherwise static and crawlable.

That decision is only safe because of the boundaries drawn around it, and those are enforced by review rather than by hope. Nothing in the puzzle content directory may be imported by the assessment engine, by any keys module, or by any assessment route. No puzzle may ever be reused as an unseen scored item, and the ids are namespaced so that a collision with a suite or bank id is impossible rather than unlikely. And no puzzle surface may present its result as an ability estimate, a percentile, an IQ figure, or a band that reads like one — raw counts for the current sitting, and nothing more.

The condition that would flip the decision is written down too, which is the part that makes it a real rule instead of a preference. A timed puzzle competition, a leaderboard, a shareable score — anything a third party might read as a credential — would have to move to the scored engine with its keys split out, and would have to be a new content set rather than a re-skin of these files. Once answers have shipped to browsers, they are shipped.

The exception has a price and it should be visible before you rely on it. The scored suites need a working connection at two moments: when the session starts and when you submit. Everything untimed carries on without one. If you lose connection mid-attempt the attempt is marked as offline rather than thrown away, and your answers stay where they already were — in your browser.

The service worker is drawn along the same line, and it is stricter than most. It deliberately never handles or stores API requests, local project or share URLs, device-local library and history pages, matcher sessions and results, aptitude practice and results, or Reasoning Challenge practice and results. It also rejects responses marked private or no-store, responses that set cookies, authenticated requests, and download attachments. A visited public document can be read offline; a result page is not sitting in cache storage waiting for whoever uses the machine next.

That is the trade in one sentence. Less offline reach across the assessment surfaces, in exchange for a boundary that holds when someone else picks up your laptop. We would rather explain that trade than quietly cache a results page because it made an offline demo look better.

The architectural care would be wasted if the wording around a result overreached, so the wording is centralised in the same way the keys are. The cognitive practice bands run from "keep practising" to "strong on this exercise", and the text for each one lives in a single module so that the quiz result, the progress view, and an export cannot drift into three different descriptions of the same performance. Each label is explicitly about that exercise on that day, not about the person taking it — an educational label, not a clinical, diagnostic, percentile, or professionally recognised measurement.

The Novus Reasoning Challenge is named the way it is for the same reason. It is 9 public forms and 12 practice modules, it is an educational and entertainment instrument, and it is not an IQ test: a real one needs standardisation, norming against a representative population, controlled administration, and someone qualified to interpret the output. A browser can supply none of those. How the items are built and what a result does and does not mean are published on the site rather than buried, because the alternative is borrowing authority the instrument has not earned.

The line running through all of this is the same one running through the answer keys. Do not let a number carry more weight than the thing that produced it, whether the risk comes from a leaked key or from a confident adjective.

Attempts are records in an IndexedDB store: the attempt id, its session token, which suite and mode it was, the public stems returned at start so a reload can restore the paper, your answers, which items you marked for review, the score summary once one exists, and the returned review text. They are listed newest first, and any one of them can be deleted on its own.

Because there is no account, there is no account deletion flow — which cuts both ways and is worth saying honestly. Clearing your data is immediate and needs nobody's permission, and it is also entirely on you: there is no server-side copy to recover if you clear your browser storage, and no way for us to restore an attempt you deleted, because we never had it. Portability is the same story. Study material and results can be exported locally; there is no cloud copy to sync between two machines, so moving between devices means moving the export.

Novus Learn is live and still in progress, and the gaps in this area are specific enough to name. Spaced repetition does now reach across projects: a My Learning view reads every saved project's schedules, counts how many cards are due, and lists the nearest handful with their due dates. What does not exist is anything that tells you. There are no reminders and no notifications of any kind — push was deliberately left out of the installable app rather than half-built, because it needs a consent experience, key management, and deletion controls to be done honestly. The practical consequence is that the review schedule only works for someone who already opens the app. Nothing brings you back to it.

The second gap is structural. Each project is exactly one source, so there is no way to compose a subject from five of them — the app teaches sources, not subjects, and closing that needs a multi-source project model rather than a new screen. Both of these are known, written down, and not solved. Naming them here costs a little and costs far less than a visitor discovering them after deciding to trust the tool.

Everything described here is free and needs no account: the 376 aptitude suites across 35 constructs, the cognitive banks, the puzzles, the Reasoning Challenge, and the 565 occupation profiles with a matcher that runs on your device. Start at the assessments hub if you want the scored side, or the puzzles if you want the side that explains itself immediately, and the documentation on this hub if you want the full inventory before you commit any attention to it.