What a Chrome extension can see on your Brightspace page (and what it sends)

Every so often a colleague forwards a link to a Chrome extension with "this looks amazing, is it allowed?" in the subject line. It's a fair question, and it deserves a better answer than "it has good reviews." An extension that works on your Brightspace pages sits in the same browser window as your class lists, your students' names and, depending on the page, their marks. Before you install anything there, it's worth knowing what it can actually see and where that information goes.

This post is the checklist I'd want a colleague to run through. The first half applies to any extension, from any company. The second half uses ClassWatcher — the tool I built — as a worked example, so you can see what the answers look like when you ask them of a real product.

What an extension can see depends on two things

A Chrome extension's reach is set by two separate pieces: permissions and site access.

Permissions are the browser features it asks to use: storing data, opening and managing tabs, showing a side panel, setting timers, running scripts on pages. On their own, most of these don't touch page content at all.

Site access (developers call it host permissions) is the list of websites the extension can work on. This is the one that matters most for student privacy. When Chrome tells you an extension can "read and change your data" on a site, it means exactly that: on those sites, the extension's code runs inside the page and can see whatever the page shows you. If you can see a class list, a submission table or a grade, an extension with access to that site can see it too.

That last point is the one people miss. An extension doesn't need your Brightspace password or a special connection to your school's systems to read a Brightspace page. It works inside your browser, using the session you're already signed in with. It sees what you see — no more, but also no less.

The scope of site access is the first thing to check

There's a big difference between these three:

• "Read and change all your data on all websites." The extension can run on your bank, your email, your board's HR portal and Brightspace alike. Sometimes this is genuinely needed (an ad blocker, a password manager). For a tool that only claims to help with Brightspace, it's a question worth asking.
• "Read and change your data on a number of websites", or a short named list. The extension is limited to specific addresses. This is what you'd expect from a single-purpose tool.
• Optional access. Some extensions ask for a site only at the moment you need it, and you approve it then. Nothing is granted up front.

How to check an extension yourself in Chrome

You don't need to trust a listing's description. Chrome will tell you what an installed extension is allowed to do:

1. Type chrome://extensions into the address bar and press Enter.
2. Find the extension and click Details.
3. Read the Permissions section. This is Chrome's own plain-language summary, not the developer's.
4. Look at Site access. Depending on the extension, you may be able to narrow it — for example to run only when you click the extension, or only on sites you list. Restricting a tool too far can stop it working, but it's a useful way to see what it actually relies on.

Before installing, the Chrome Web Store listing also has a privacy practices section where the developer declares what kinds of data the extension handles. Read it alongside the developer's own privacy policy and check that the two agree.

How to read a privacy policy for what's sent where

Privacy policies are long, but for a classroom tool you're really looking for answers to four questions. If the policy doesn't answer them, that's an answer in itself.

• What leaves the browser? A good policy separates what the extension processes on your own computer from what it sends to the company's servers. "We collect data to improve our services" tells you nothing.
• Is student information included? Look for student names, ID numbers, grades and parent contact details by name. Vague categories like "user content" can hide a lot.
• How long is it kept? A specific retention period (so many days, then deleted) is a much better sign than "as long as necessary".
• Where is it stored, and who else touches it? Look for the hosting country and a list of the third-party services involved, such as message delivery or payment providers. For Canadian schools in particular, US hosting is something your privacy officer may want to know about.

The legal side is a separate question from the browser mechanics covered here. If you need it, I've written about PIPEDA and teacher tools in Canada and FERPA for US teachers using Brightspace tools.

Questions to ask before installing anything that touches student information

• Does the site access match the job? A Brightspace tool should be asking for Brightspace sites, not every site you visit.
• Can I use it without an account? If the core feature works with nothing to sign up for, there's less to go wrong and less data in someone else's hands.
• What changes when I do sign up? Ask exactly which information starts going to the company's servers, and why.
• Who is behind it? Is there a real contact address and a privacy policy that names a person or company you could write to?
• Does it write anything back? Does it only read pages, or can it change grades, settings or submissions?
• What does my board say? Check your board's approved-software list or extension policy first. If you're not sure, ask before you install, not after.

A worked example: ClassWatcher

Here's what those answers look like for ClassWatcher, which shows you who hasn't submitted an assignment or quiz in Brightspace. I'm including it because it's the tool I know inside out, and because it's easier to judge a checklist when you can see it applied.

What it asks Chrome for

ClassWatcher's permissions are storage (to keep your class list and settings in your browser), tabs (to open assignment and quiz pages when you check a watch list), scripting (to show its box and buttons on Brightspace pages), sidePanel (for the ClassWatcher panel beside Brightspace) and alarms (a timer that cleans up a check that stalls).

Its site access is a fixed list rather than every website: brightspace.com, desire2learn.com and a handful of other addresses Brightspace is hosted on, Google Assignments pages, and classwatcher.com itself. If your school runs Brightspace on its own web address, ClassWatcher asks for that one address only when you enter it in Settings, and Chrome asks you to approve it. It holds no access to any other site.

Without an account

You can install ClassWatcher and use the free on-page list without signing up. Open a Brightspace assignment or quiz page and a box lists who hasn't submitted.

In that mode the on-page list sends nothing to us. Opening a page, checking who hasn't submitted, importing a class and sorting the list make no requests to our servers, and we receive no information about you, your school, your courses or your students.

There are three ordinary website visits, and they're the only exceptions:

• When you first install the extension, it opens our getting-started page in a new tab.
• If you open the ClassWatcher side panel, it loads our web app and asks our server whether you're signed in. That check carries a random installation identifier and nothing else, and with no account we store nothing from it.
• If you remove the extension, Chrome opens a short goodbye page on our site.

Two things are kept on your own computer. If you choose to import a class, the student list Brightspace already holds — names, Brightspace usernames and the internal ID numbers Brightspace uses — is saved in your browser's local extension storage. Nothing is imported until you confirm it, and that list is never sent to us while you have no account. The extension also counts how many distinct assignment or quiz pages you've opened, up to fifty, identified by your school's Brightspace address and Brightspace's own course and assignment numbers, never student names. That count sits in Chrome's synced storage; your class list does not.

With an account

The paid plans add messaging parents, watch lists and exports, and that is the point where some information does go to our servers. It's worth being precise about which:

• Stays in your browser: class lists, watch lists and parent contact details. Our servers never receive a roster, a grade or a piece of student work.
• Stored on our servers: scan history as counts per page, with no student names; and the log of messages and notes you send, which includes the student's name and the text. That log is what lets your contact history follow you to another computer.
• How long: message logs and contact notes are deleted after 365 days.
• Where: our servers are hosted in the United States, by DreamHost. If your board has data-residency rules, check with your privacy officer before you sign up.

The full detail is in our privacy policy, and there's a version written for IT teams on our IT and security overview page. If your IT department wants to review ClassWatcher before you install it, that page is the one to send them.

The short version

Any extension that runs on Brightspace can see what you see there. So check how widely its site access reaches, read what its privacy policy says leaves your computer, prefer tools that work without an account, and follow your board's policy. That holds whether the extension is mine or anyone else's.