Privacy Policy

AHSA Student Browser Monitoring Extensions · Effective April 20, 2026

1. Overview

This privacy policy applies to the AHSA Student Browser Monitor and AHSA Staff Monitor Dashboard Chrome extensions, operated by American High School Academy ("AHSA," "we," "us"). These extensions are deployed exclusively on school-managed devices within the AHSA Google Workspace domain.

2. Data Collected by the Student Extension

The Student Browser Monitor extension collects the following data from school-managed Chromebooks:

• Browsing activity: URLs visited, page titles, and timestamps
• Tab information: Active tab changes, tab count, and navigation events
• Student identity: Google Workspace email address and account identifier (obtained via the signed-in Chrome profile)
• Screenshots: Only when explicitly requested by authorized school staff and only if enabled by IT policy

The Student extension does not collect passwords, form input data, keystrokes, browsing activity on personal devices, or any data outside of the school-managed Chrome browser session.

3. Data Collected by the Staff Extension

The Staff Monitor Dashboard extension collects only the staff member's Google Workspace email address for authentication. It does not collect browsing activity, page content, or any student data directly — it retrieves student monitoring data from the school's server via authenticated API calls.

4. How Data Is Used

All collected data is used exclusively for:

• Enforcing the school's Acceptable Use Policy for internet access
• Blocking access to restricted websites during school hours
• Enabling teachers and administrators to monitor classroom internet activity
• Generating reports on student browsing patterns for educational oversight
• Responding to safety concerns as required by school policy

5. Data Storage and Security

• All data is transmitted over encrypted HTTPS connections to AHSA's monitoring server.
• Authentication uses Google OAuth tokens — no passwords are stored by the extensions.
• Browsing telemetry is stored in a secured database accessible only to authorized school administrators, principals, and teachers.
• Teachers can only view data for students in their assigned classes.
• Data is retained in accordance with AHSA's data retention policy.

6. Data Sharing

We do not sell, trade, or transfer student browsing data to any third parties. Data is accessible only to authorized AHSA staff (teachers, principals, and IT administrators) through the secured monitoring dashboard. Data may be disclosed if required by law or to protect student safety.

7. Chrome Extension Permissions

The extensions request only permissions required for school monitoring and safety workflows on managed devices:

• activeTab: Used after explicit staff interaction to evaluate policy status on the currently active tab.
• declarativeNetRequest: Used to apply school-managed allow/block rules for acceptable-use and safety enforcement.
• tabs: Used to read tab metadata (such as URL, title, and state) needed for classroom oversight and policy enforcement.

8. COPPA and FERPA-Aligned Practices

AHSA operates these extensions in support of Children's Online Privacy Protection Act (COPPA) obligations and FERPA-aligned handling of student records. Browsing activity data is treated as an education record, access is limited to authorized school personnel with a legitimate educational interest, and parent or guardian inquiries are handled through school processes and applicable law.

9. User Control

The Student Browser Monitor is managed by the school's IT department and is force-installed on school-managed Chromebooks via Google Workspace enterprise policy. Students cannot disable or uninstall the extension on managed devices. Monitoring is active only on school-managed devices — personal devices are not affected. The Staff extension can be removed by staff members if set to "allow install" policy.

10. Data Stored Locally

The extensions store the following data locally on the device using Chrome's storage API:

• Extension configuration (API endpoint, tenant identifier)
• Cached blocking policy rules (for offline enforcement)
• Temporary telemetry queue (events pending upload)

No personally identifiable student data is persisted locally beyond the current browsing session.

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted at this URL with an updated effective date. Continued use of the managed extensions after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this privacy policy or the data practices of these extensions, please contact:

American High School Academy
Email: it@ahsa.edu