Security & Data Overview

1. What is ClassWatcher?

ClassWatcher is a Chrome browser extension used by teachers to track missing assignment submissions in D2L Brightspace. It helps teachers quickly identify which students have not submitted work, and optionally send SMS or email reminders, to the right audience for their school level:

• Elementary: teachers text or email parents directly
• High school: teachers can reach students, parents, or both
• College / university: teachers message students only, no parent contact

ClassWatcher is a productivity tool for teachers. It does not modify Brightspace, does not interact with grades, and does not have access to assignment content or course materials.

2. What Data Does ClassWatcher Access?

ClassWatcher accesses only what is visible to the teacher on screen:

• Student names: read from submission summary pages in Brightspace to identify who is present or absent from a submission list
• Assignment or quiz page URLs: used to track which pages the teacher is monitoring
• Teacher-entered contact data: parent phone numbers and email addresses that the teacher manually enters into the app; this data is never collected from Brightspace automatically

ClassWatcher does NOT access or transmit:

• Student grades or marks
• Assignment content, rubrics, or feedback
• Course materials, files, or resources
• Student account credentials or personal records
• Any data from pages the teacher has not explicitly opened and watched
• Any data from other tabs or websites

3. Google Sheets Integration

ClassWatcher offers an optional Google Sheets export feature. When a teacher uses this feature, ClassWatcher requests permission to create a spreadsheet in the teacher's own Google Drive.

OAuth Scope	What It Allows	What ClassWatcher Uses It For
https://www.googleapis.com/auth/spreadsheets	Create and edit Google Sheets in the user's Drive	Creates one spreadsheet called "ClassWatcher.com" with the teacher's class list, missing items grid, and contact history

ClassWatcher does not read, access, or transmit any other files in the teacher's Google Drive. The authorization token is stored locally in the teacher's browser and is never sent to ClassWatcher servers. Teachers can revoke this access at any time via their Google Account permissions page.

ClassWatcher's use of Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. Where Is Data Stored?

• Browser local storage: class lists, student names, and watch list settings are stored in the teacher's Chrome browser profile using the Chrome Storage API
• ClassWatcher servers: account credentials (hashed passwords), messaging logs (SMS/email delivery records, retained 365 days), and scan summaries for account-level features. Hosted on DreamHost (United States).
• Teacher's own Google Drive: if the Google Sheets export is used; ClassWatcher has no access to this data after export
• Third-party delivery providers: when a teacher sends an SMS or email reminder, the recipient's phone number or email address and the student's name are passed to our delivery providers (Twilio for SMS, AgentMail for email) for the sole purpose of delivering that message. Class-list scanning happens in the browser; only sending a message involves an external provider.

ClassWatcher does not use third-party analytics, advertising networks, or data brokers. Student data is never sold, shared, or used for any purpose other than delivering the features the teacher explicitly uses.

5. Security Measures

• All data in transit is encrypted via HTTPS/TLS
• Passwords are hashed using bcrypt. Plaintext passwords are never stored
• Session tokens are cryptographically random (256-bit) and expire after 30 days
• The Chrome extension requests only the minimum permissions required: access to Brightspace pages on the teacher's school domain, and storage for local data
• The extension does not run on pages outside of D2L Brightspace domains (except classwatcher.com for account management)
• Parent contact information entered by teachers is accessible only to that teacher's account

6. Privacy Compliance

ClassWatcher is operated by David W Cooper and is designed with the following privacy frameworks in mind. Teachers and administrators are responsible for ensuring use of ClassWatcher aligns with their institution's acceptable use policies.

PIPEDA (Canada): Canada's federal private-sector privacy law. ClassWatcher limits data collection to what is necessary for the features the teacher explicitly uses and does not share data with third parties. As a data-minimization measure, message logs are retained for 365 days and then deleted. ClassWatcher maintains a public Privacy Policy and IT overview. See our PIPEDA compliance guide for full details.

FERPA (United States): The Family Educational Rights and Privacy Act applies to US schools receiving federal funding. Key points for evaluating ClassWatcher under FERPA:

• Submission status is scanned locally in the teacher's browser, not transmitted to ClassWatcher servers during a scan
• ClassWatcher does not access grades, gradebooks, transcripts, or SIS data
• Parent contact information is entered by the teacher, not pulled from student records
• Teacher use of ClassWatcher falls under the school official / legitimate educational interest exception
• Data Processing Agreements are available for US districts on request

See our FERPA compliance guide for a full analysis. For DPA requests or security questionnaires, contact [email protected].

Provincial laws (Canada): Ontario (MFIPPA), Alberta (FOIPPA), and BC (PIPA) govern school boards rather than tool vendors. ClassWatcher's data minimization design is intended to support compliance. Note: ClassWatcher's servers are hosted in the United States (DreamHost). Boards with data residency requirements should consult their privacy officer before adopting any US-hosted tool.

Full details are in our Privacy Policy and Terms of Service.

7. Contact for IT Inquiries