CateLMS Sync — Privacy Policy
1. What the extension does
The CateLMS Sync extension exists to eliminate the manual retyping of student data between CateLMS and a school's Student Information System (SIS) such as Aspire or PowerSchool. When a teacher clicks "Send to SIS" inside CateLMS, the extension:
- Receives a payload of records (attendance marks, grade scores, or assignment metadata) from the CateLMS-hosted page the teacher is signed into
- Locates the SIS browser tab the teacher already has open
- Fills the appropriate fields in the SIS gradebook by reading from and writing to that tab's DOM, the same way a person typing manually would
- Reports the outcome (which records succeeded, which failed) back to CateLMS for the teacher's audit log
2. What data is processed
| Data category | Where it comes from | Where it goes | What we do with it |
|---|---|---|---|
| Student names, student SIS identifiers, attendance marks, grade scores, proficiency bands, late/missing/excused flags | The teacher's authenticated CateLMS session | The teacher's authenticated SIS session, in a separate browser tab | Pass through. Held in extension memory only for the duration of a single sync operation (typically 5–15 seconds). |
| Assignment metadata (titles, point values, due dates, categories) | The teacher's CateLMS session | The teacher's SIS session, when matching or creating an assignment | Pass through. Sent to Anthropic's Claude API only when the teacher explicitly invokes AI-assisted assignment matching, and only the assignment metadata, never student data. |
| Page Pack configuration files (URL patterns, CSS selectors, field mappings for known SIS systems) | Bundled with the extension | Used locally by the extension to identify SIS pages and find the right form fields | No personal data. Public configuration. |
3. What data is NOT collected
- The extension does not maintain its own database. We do not have a server that stores student records.
- The extension does not transmit data to any third party other than (a) the SIS the teacher chose to sync to and (b) the CateLMS instance the teacher is signed into.
- The extension does not include analytics, telemetry, advertising tracking, or fingerprinting libraries.
- The extension does not read browser history, bookmarks, saved passwords, or content from tabs other than the active SIS tab during a sync operation.
- The extension does not capture screen contents, keyboard input outside its own UI, or microphone/camera input.
4. AI-assisted matching (optional, opt-in per use)
When the extension cannot deterministically match a CateLMS assignment to an existing SIS assignment, the teacher may invoke an AI tiebreaker. This sends only the candidate assignment titles, point values, and due dates (the SIS-side metadata that is already visible to the teacher in their SIS) to Anthropic's Claude API for classification. Student names, student identifiers, and student grades are never sent to Anthropic. The AI tiebreaker is invoked at most once per Send-to-SIS operation and only when the deterministic match score falls into an ambiguous range (0.50–0.85 confidence).
5. Permissions explained
The extension requests the minimum permissions needed to do its job. Each permission is justified below.
| Permission | Why it's needed |
|---|---|
host_permissions (required, narrow) | The extension declares required host permissions only for the domains it supports out of the box: catelms.com and hs2c.org (CateLMS-hosted instances) plus *.aspire.org and *.powerschool.com (the registered SIS Page Packs). On these domains the extension's content scripts run automatically. The extension does not run on any other website by default. |
optional_host_permissions: *://*/* | For school districts whose SIS is hosted at non-standard domains, the extension declares an optional broad-host permission that is NOT granted at install time. When you invoke the extension on a domain not covered by the required permissions, your browser shows a native consent dialog asking whether to allow the extension on that specific site. The extension only activates on a new domain after you click Allow. Permissions are per-origin and you can revoke them at any time. |
tabs | Required to discover which browser tab has the SIS gradebook open. The extension queries tab URLs against Page Pack patterns to find the right tab; it does not read tab contents from any other tab. |
storage | Stores the user's CateLMS base URL preference and the cached handshake state. No personal data is stored. |
scripting | Reserved for runtime script injection in case a Page Pack needs to execute a small DOM-manipulation routine on a SIS page. Currently used by the page-pack engine to read and fill SIS form fields. |
activeTab | Lets the extension act on the tab the user explicitly invoked it from (the toolbar popup). |
6. Children's privacy and FERPA
The extension is intended for use by school staff (teachers, counselors, administrators) operating school-issued accounts. It is not directed at children. To the extent that student records flow through the extension during a sync operation, those records are part of the school's official student information record covered by FERPA and the school's existing data agreements with its CateLMS and SIS providers. The extension does not establish any new third-party data relationship — it acts as a pipe between two systems the school has already authorized to hold student records.
7. Data retention
The extension does not retain student data after a sync operation completes. The audit log of sync outcomes (which records succeeded or failed) is stored on the CateLMS instance the teacher is signed into, governed by that instance's data retention policy.
8. Data security
The extension uses the teacher's existing authenticated browser sessions to communicate with both CateLMS and the SIS. No separate credentials are stored or transmitted by the extension. All HTTP traffic between the extension and either system uses the encryption already established by those systems (HTTPS / TLS).
9. Changes to this policy
If we change what data the extension processes or how, we will update this policy and bump the effective date above. Material changes will be announced in the extension's Chrome Web Store listing and in the CateLMS release notes.
10. Contact
Questions about this policy or about how the extension handles data: privacy@hs2c.org.