Privacy Policy

What is collected, and only while a session is running

A session runs from the moment a teacher opens the lobby until the teacher presses End. During that window, Pencils Ready collects:

• The hostname of the active tab—for example, deltamath.com or en.wikipedia.org. It never collects the full URL, query strings, page titles, or page content. A port is included only when it is non-default.
• Whether Chrome is in front—a boolean derived from window focus, including when all Chrome windows lose focus.
• Idle and lock state—no keyboard or mouse activity for 60 seconds, and whether the screen is locked. Idle only colors the teacher's tile amber; it does not create an event.
• A heartbeat—a timestamp approximately every 15 seconds so the dashboard can show a device as offline after 45 seconds.
• At join time only—name and email from Google sign-in, extension version, and the number of connected displays.

What is never collected

• Full URLs, query strings, page titles, or page content
• Screenshots, camera, microphone, or audio of any kind
• Keystrokes, clipboard contents, or form input
• Anything outside a session
• Browsing history; only the active tab's hostname is observed in the moment

Where data goes and who sees it

Reports travel over HTTPS to the Pencils Ready web application, hosted by Vercel, and are stored in a Supabase Postgres database in the United States (us-east-1). Google provides sign-in identity. Pencils Ready uses a student's Google name and email only to identify the student in the session; it does not request access to Google Drive, Classroom, Gmail, or other Google data.

Row Level Security limits teachers to their own sessions. Students can see their own event log on the join page—the same events their teacher sees. The extension holds an opaque session token, never a database key. Personal data is not sold, used for advertising, or shared for unrelated purposes.

Service providers: Vercel (web hosting), Supabase (authentication and database, hosted on AWS), and Google (sign-in identity).

Retention and deletion

Session data is retained for 90 days after a session ends, then deleted automatically. Participant records, events, and commands are deleted with the session. A session left open without any participant heartbeat for 12 hours is automatically ended so it enters the same 90-day deletion window. Pencils Ready does not retain student data indefinitely.

A school, parent, or eligible student may request access, correction, or deletion through the school or by contacting Pencils Ready below. A school's legal retention obligation may require a different response.

Lines Pencils Ready will never cross

Pencils Ready will not add webcam or microphone capture, keystroke logging, full-URL or page-content logging, all-day monitoring outside sessions, or automated cheating verdicts. A human teacher decides every disposition.