Privacy Policy

The short version

The product monitors; it does not block sites, take control of a device, or look at content.

What is collected and when

A teacher may open a lobby so students can join. While a student is waiting there, the extension sends joined-state heartbeats and an initial privacy-safe extension/device inventory; it does not report the active tab, Chrome focus, idle/lock state, or browser-page actions. Start device check starts browser monitoring and the device check before the assessment begins. Begin assessment is locked until every student reports fresh, working monitoring. Pencils Ready monitors; it does not lock a device down, and it does not require a school-managed device. End closes the server session, and connected extensions stop when they receive that ended state. An offline extension cannot receive End until it reconnects, so the teacher and IT must keep an offline device closed until receipt is confirmed. The page-focus sensor inside the browser page attaches nothing until the extension receives the armed state, and detaches when the session ends, is disarmed, or monitoring is paused. While the device check or the assessment is running, Pencils Ready collects:

• The hostname of the active tab: for example, deltamath.com or en.wikipedia.org. A port is included only when it is non-default. A tab shown beside the test page in Chrome's split view is reported the same way as the active tab.
• The page path, the page path only while that tab is off the teacher's allow list: for example /browse/library. A hostname alone cannot tell a student sitting on the assessment apart from one who has wandered to another part of the same site, which is the difference a teacher needs to see. While the tab is on the allow list, no path is derived, sent, or stored. Query strings and fragments are refused in every case, as are page titles and page content.
• Whether the test page is in front: whether Chrome is the front window, including when all Chrome windows lose focus (Cmd-Tab to another app, another browser, another Chrome profile); whether the test page itself has the keyboard focus inside Chrome (the address bar, a Google Lens overlay, a dialog, another extension, or an assistant such as Siri can take it without Chrome leaving the front); and whether a Chrome side panel or split view is open beside the test page. The reason is recorded with the event as one of three words: window, page, or side panel. Never what was typed, said, shown, or answered.
• Idle and lock state: no keyboard or mouse activity for 60 seconds while the page was in front, and whether the screen is locked. Idle only changes the visible status; it does not create an event by itself.
• A heartbeat: a timestamp approximately every 15 seconds so the dashboard can show a device as offline after 45 seconds.
• Device and sensor health: extension version and installation type, whether policy permits disabling it, the page-sensor self-check, counts of displays, Chrome windows, tabs, split views, and audible background tabs, and, once the device check starts, how many other Chrome windows are not on an allowed page (a count, never which site) and how much narrower the page is than its Chrome window (a number of pixels, so a side panel or split view can be seen), Incognito-extension and local-file access settings, and the sensor-check time. The Incognito setting reports only whether the extension can run there; it does not prove whether school policy disabled Incognito. Window and tab titles are never collected.
• Copy, cut, paste, and drag/drop action metadata on browser pages: the action type, time, and the emitting frame's hostname when Chrome provides it, otherwise the containing tab's hostname, including copies started by a button on the page. These are instantaneous review signals, so the navigation grace period does not apply. Pencils Ready does not read or store clipboard contents, dropped content, keystrokes, selected text, form values, or the original source of pasted material. To prevent flooding without hiding later activity, it itemizes the newest 250 actions awaiting review, retains reviewed records, and shows older or delayed actions to both student and teacher as a counted summary that may combine those action types.
• At join time, before the device check starts: name and email from Google sign-in, the initial extension/device inventory described above, and joined-state connection heartbeats so the teacher can see who has entered and remains connected to the lobby.
• Whether the student's status page was closed, reloaded, or navigated away: a timestamp the join page sends as it unloads, shown to the teacher only as an advisory “confirming” hint during a live session, cleared by the next extension heartbeat, and never stored as an event or included in reports.
• After the session ends, an optional survey: a student may answer two multiple-choice questions and add an optional comment. The answers are shown to the teacher with the student's name and are deleted with the session.
• A random browser-profile identifier: the join page creates an opaque UUID and stores it in that site's local browser storage. It recognizes the browser profile connected to the student's single session record, supports reconnects, and prevents simultaneous replacement. A stale connection may be replaced from another profile or device after five minutes. It is not a hardware serial number and remains until the student clears the site's stored data.

What is never collected

Metadata-only page-action detection is limited to web pages where the Pencils Ready extension is allowed to run during the device check or a live assessment. It cannot identify where pasted material originally came from, inspect the system clipboard, read dropped content or keystrokes, or observe page actions inside other applications. It cannot hear or read what a student says or types to Siri or any other assistant, what a side panel shows, or what other applications display; it only sees that the test page is not in front, and which kind of Chrome surface took its place. Outside armed/live monitoring, it records no browser-activity or page-action signals; the lobby fields are described above.

What the extension stores on your own device

Chrome Web Store policy requires disclosing locally held data even when it is never transmitted. While you are joined to a session, the Pencils Ready extension keeps the following in Chrome's extension storage on your own device:

• an opaque session credential and its proof key, which authorize this device to report to your teacher's session, never your Google password;
• the session id, name, status, and start time, your participant id, the web app origin, your teacher's allow list and grace-period setting, and the time you joined, so the extension survives Chrome restarting mid-assessment;
• the current reported state, its focus reason (window, page, or side panel) when the test page is not in front, the hostname of the tab being reported (the active tab, or a split-view tab beside it) and, only while that tab is off the allow list, its page path;
• for each Chrome window, the narrowest the page has been since the device check started (a number of pixels), so a side panel opened later can be told apart from one that was already there;
• short lists of teacher-command identifiers already handled or awaiting acknowledgement, and a flag that the session is ending, so a command is never applied twice or lost across a restart;
• a clock-offset correction, so events are timed against the server rather than a wrong device clock;
• the reason monitoring is paused, when it is; and
• a bounded queue of at most 250 pending action records (type, time, and hostname only) held when the network drops so nothing is lost or duplicated on reconnect.

None of it includes page, clipboard, or dropped content, selected text, keystrokes, or form values. All of it is cleared when the teacher ends the session, or when the server ends this device's connection, for example after a monitoring pause, or when the same student joins from another device, after which the extension keeps only a short note of why monitoring stopped. You cannot clear it yourself while the session is live; this is deliberate, so an active monitoring connection cannot be quietly dropped or replaced. The extension makes no network requests at all once it holds no session credential.

Where data goes and who sees it

Reports travel over HTTPS to the Pencils Ready web application, hosted by Vercel, and are stored in a Supabase Postgres database in the United States (us-east-1). Google provides sign-in identity.

Pencils Ready uses a student's Google name and email only to identify the student in the session. It does not request access to Google Drive, Classroom, Gmail, or other Google data.

Like any website, our servers see the IP address each request comes from. Pencils Ready uses it only in a keyed-hash form to limit abusive connection attempts; it is not stored with student records, though it may appear in our hosting providers' operational logs.

Server authorization and database Row Level Security limit teachers to their own sessions. Students can see their own event log on the join page, the same events their teacher sees. The extension holds an opaque, proof-bound credential only for the connected session, never a database key. Personal data is not sold, used for advertising, or shared for unrelated purposes.

Chrome Web Store Limited Use commitment

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Pencils Ready uses data only to provide and protect its disclosed, session-only assessment-monitoring purpose. It does not sell data, use it for advertising or credit decisions, or allow unrelated human access. Pencils Ready staff open student records only to answer a school's support request, investigate a security issue, or comply with the law.

Retention, access, correction, and deletion

Session data becomes eligible for deletion 90 days after a session ends. An automated purge runs weekly, so eligible records are normally removed within the following seven days. Participant records, events, and commands are deleted with the session. A session left open without any participant heartbeat for 12 hours is automatically ended so it enters the same retention schedule. Separately, no session stays live longer than 4 hours after the device check starts: if the teacher has not pressed End by then, it is ended automatically, so a forgotten session can never keep recording into the next class.

The Google sign-in identity record (name, email, and profile picture URL) is retained separately from session data and is deleted on request.

A school, parent, or eligible student may request access, correction, or deletion through the school or by contacting Pencils Ready below. A school's legal retention obligation may require a different response.

Students under 13

Pencils Ready is used under a school's direction, never through an individual account a student opens themselves. Where a school uses it with students under 13, the school consents on behalf of parents for the school-authorized educational purpose, as the FTC's COPPA guidance permits. Student information is used only to run this service for that school, never for advertising, profiling, resale, or training models, and a parent may review or request deletion of their student's records through the school.

Lines Pencils Ready will never cross

Pencils Ready will not add webcam or microphone capture, keystroke logging, clipboard- or dropped-content capture, full-URL or page-content logging, all-day monitoring outside sessions, or automated cheating verdicts. A human teacher decides every disposition.