Legal
For your network administrator
What Spontar needs on your network, what it does not, and what to change if you would rather run the kit on your own Wi-Fi.
In one line
The kit brings its own Wi-Fi router, and a lesson runs on that network without touching yours. The teacher's iPad needs ordinary outbound HTTPS before and after a lesson — to open it and to upload its record — and nothing during it.
The kit's network
The kit contains a small travel router (GL.iNet Beryl AX) with no uplink: no cable into your
network and no internet. It broadcasts a WPA2 network named spontar- followed by
six characters, on 2.4 GHz and 5 GHz, with client isolation off. The teacher joins it on the
iPad with one tap. Each Cue has been given the kit's network name and password when it was
added to the institution, joins by itself when switched on, and finds whichever iPad is
running the lesson on that network.
| Lesson | TCP 4400 — the iPad listens, the Cues connect |
| Device updates | TCP 4401 — served by the iPad on the kit network |
| Discovery | mDNS / DNS-SD, service _spontar._tcp (multicast, UDP 5353) |
| Client isolation | Off |
| Internet | Not used while a scene runs |
What the iPad needs from the internet
| When | To sign in and open a lesson (the scenes are fetched then), and afterwards to upload the lesson record |
| Outbound | 443/TCP to Google Cloud (Firestore, Cloud Functions, Firebase Auth), on your normal Wi-Fi or mobile data |
| Inbound | None |
| Fixed IP / VPN | Not required |
| Region | europe-west3 (Frankfurt) |
If you would rather use your own Wi-Fi
It works if the network the iPad and the Cues share allows TCP 4400 and 4401 between devices, allows mDNS multicast on UDP 5353, has client isolation off, offers 2.4 GHz (the Cues have no 5 GHz radio) and uses WPA2-Personal — a Cue cannot join an enterprise (802.1X) network. Managed and guest networks usually have client isolation on, which is why the kit carries its own router.
On the Cues
| What a Cue holds | Its own device key, the kit's network name and password, and a software version — no names, no roster, no results, no account |
| What a Cue sends | A hello, a signature and Next presses — never names or content |
| Camera | None |
| Microphone | The hardware has one; Spontar's firmware never uses it |
| Location | None |
| Internet | Never — a Cue only talks to the iPad on the local network |
Accounts and identity
No SSO integration is required, and none is currently offered. Students have no accounts of any kind: they hold Cues — devices registered to the institution that authenticate with device keys, not with credentials. No student email address exists in the system, so there is nothing to sync with your directory and no account-recovery channel to secure.
Staff accounts use email and password. If you need SAML or OIDC, tell us — it is not built, and knowing somebody needs it is how it gets built.
Data
Firestore in europe-west3. Session records are visible to the teaching teacher
only and are deleted after twelve months by default. Aggregate usage figures contain no
student and are kept indefinitely. Sub-processors are listed and dated
here.
Bandwidth
Negligible. A session moves a few kilobytes per beat. The heaviest thing the product does is fetch the scenes when a lesson is opened, which is text and typically under a megabyte for a term's material, and the current device software when there is a new version.
Questions
Write to hello@spontar.com. If you need this in a particular format for a procurement process, say which one and we will fill it in rather than sending you a brochure.