Effective date: 23 September 2026

This policy describes what the Satit Chula Classroom Tools Chrome extension and the school backend behind it do, what data they handle, and who is responsible for it. It is written to match the software exactly. Every claim below can be checked against the source code at https://github.com/jozilla77/cudclassroom.

Who is who

• Data controller: โรงเรียนสาธิตจุฬาลงกรณ์มหาวิทยาลัย ฝ่ายมัธยม (Chulalongkorn University Demonstration School, Secondary Division). The school decides what student data this service holds and what it is used for. Requests about a student's data go to the school.
• Developer and operator: Loxley Orbit. Loxley Orbit writes the software and runs it for the school. The backend and its database live in a Google Cloud project that Loxley Orbit administers on the school's behalf. Loxley Orbit's administrators can technically reach the data in that project. They use that access only to run, maintain and support the service for the school, and only as the school instructs. Loxley Orbit does not use the data for any purpose of its own.
• Contact for this policy and for data requests:saran.o@satitm.chula.ac.th

Who uses this extension

Everyone in the school community (teachers, staff and students) who uses a @satitm.chula.ac.th Google account. The school's Google Workspace administrator installs it on school Chrome profiles. Anything that involves school data requires signing in with a school account. Nobody outside the school's domain can use those features.

Different people get different features:

These limits are enforced on the school's server, not only by hiding buttons. See Security below.

The student data involved is data the school already holds, in Google Classroom and in its own student records. It is processed here on the school's own authority, as the institution that runs the class. That is the same basis on which the school keeps attendance and coursework records without asking each student to consent to Google Classroom separately.

What the extension does

On classroom.google.com:

1. Re-colours Classroom's interface with the school's branding and shows the school's name in the top bar.
2. Lets a teacher record attendance (Present, Absent, Late, Excused, with an optional note) on the People tab. It also shows a monthly attendance report that can be downloaded as a spreadsheet file.
3. Shows teachers each student's Thai name, room and roll number (เลขที่) on the People tab, and can print a class list.
4. Shows a traffic-light indicator beside an assignment's due-date field. It tells the teacher how many other assignments the class already has due that day.
5. Gives teachers class tools: a random student picker and a group maker, using the course's own class list.
6. Lets a teacher say which school competency each rubric criterion measures, and then collects the course's rubric grades as evidence for the competency report.
7. Adds three items to Classroom's left menu: Announcements, a page inside the extension showing school notices; Teaching Evaluation, which opens the school's own T-Rating website; and, for teachers, Competency Report, which opens the report on the school's backend. The toolbar button also opens the report.

What data is handled, and where it goes

1. Signing in to the extension

When someone clicks Sign in, the extension asks Google for an identity token through chrome.identity. It requests only the openid, email and profile scopes, the same non-sensitive information used to prove who is signing in. This token is:

• kept in the browser's session storage (chrome.storage.session) and cleared when the browser session ends;
• sent only to the school's backend, over HTTPS, as proof of identity on each request;
• verified there with Google, checked for a @satitm.chula.ac.th address, and never saved in the database.

The extension never receives, stores or sends a password.

2. Attendance

When a teacher saves attendance, the extension sends each student's Classroom user ID, the name Classroom shows for them, the mark and any note. These are stored in the school's database (Google Cloud Firestore, Bangkok region), filed by course and date.

When a teacher refreshes a course's competency evidence (section 6 below), the backend also counts each student's Present, Absent, Late and Excused days for the term. The competency report uses that count for its life-skills measure.

3. The student directory

The backend holds a directory of students taken from the school's own student records. For each student it stores the school student number, school email address, Thai name (prefix, first name, last name), room and roll number, and a note of which import the record came from.

When a teacher opens a People tab, the extension reads the school email addresses shown on that page and asks the backend for those students' directory entries. Only staff accounts can make that request. The extension then shows the Thai name, room and roll number next to each student. None of this is stored by the extension.

4. Reading Google Classroom

The backend reads Google Classroom through domain-wide delegation, set up by the school's Google Workspace administrator. It reads as the signed-in person, not through one shared account that can see every class. That means it can only read classes the person can already see in Classroom.

Access is read-only. This software cannot create, change or delete anything in Google Classroom. It uses these scopes:

• classroom.courses.readonly: course details, and whether the signed-in person teaches the course
• classroom.rosters.readonly: the class list
• classroom.coursework.students.readonly: assignments, due dates, rubrics and rubric grades
• classroom.profile.emails: students' school email addresses, used to match a Classroom account to the school directory

For the workload indicator, the backend keeps a short-lived copy (5 minutes) of how many assignments are due on a date, so that it doesn't query Classroom again on every page.

5. Class tools

The random picker and the group maker use the class list from Google Classroom, together with the directory's Thai names and roll numbers. Nothing they produce is stored on the server. So that a page reload doesn't make the picker repeat students, the list of students already picked in the current lesson is kept in that browser tab's own session storage. It is cleared when the tab is closed.

6. Competency evidence

When a teacher tags a rubric criterion with a competency and refreshes the course, the backend stores:

• the tag itself: which competency each criterion measures, who saved it and when;
• evidence: for each student and each rubric criterion in the course, the assignment title, criterion title, points earned and possible, the resulting competency level, whether the work was late, and a link back to the work in Classroom. Only grades a teacher has already returned to the student are read. Draft grades are skipped. Grades on a criterion nobody has tagged are stored but count towards no competency until it is tagged;
• a term summary for each student: their current level in each competency, calculated from that evidence and from the attendance count above;
• a lookup table linking each student's Google Classroom user ID to their school student number and email address. The backend needs it to connect Classroom grades to the school directory.

7. The competency report

The report is a web page on the school's backend, not inside the extension. Opening it requires signing in with the school's Microsoft account (Entra ID). The school's Entra administrators decide who may open it.

After sign-in, the backend sets one cookie, satit_session. It holds the person's email address, name and report role (for example Teacher), is digitally signed so it cannot be altered, and expires after 8 hours. It cannot be read by page scripts. It is used only on the backend's own address. Four short-lived cookies used during the Microsoft sign-in are deleted as soon as sign-in finishes.

At the time of writing, the report displays example figures, and the page says so. As real evidence builds up, it will show real students' competency levels, only to staff with access to their class.

8. School-wide totals

The school's reporting dashboard (Google Looker Studio) receives totals only, such as how many students in a year group reach each level. It never receives names or individual results. Any group with fewer than five students is left out, so that no total can point to an individual child.

9. Access log

Each time someone reads or changes student data, the backend records who did it (school email address and role), what they did (for example attendance.read), which course, how many students were included, and whether they signed in through Google or Microsoft. No marks, names or grades are written to the log. It lets the school answer "who looked at this class's records", which is a normal safeguard for data about children.

Retention

Attendance, the directory, competency evidence, term summaries, the ID lookup table and the access log are kept until the school deletes them. Nothing is deleted automatically yet. The school can have any record deleted at any time by asking at the address above. This is a known limitation, and the school should consider it when deciding how long to keep records. Workload figures and report totals are temporary copies, replaced within minutes.

What is never collected

The extension does not use analytics, advertising or tracking of any kind. It does not read email, files or calendars, and it reads nothing outside classroom.google.com. It communicates only with the school's own backend and with Google's sign-in service. The announcements page loads nothing from the internet. It does not run code fetched from anywhere at runtime: everything it runs is inside the extension package reviewed by the Chrome Web Store.

Opening the Teaching Evaluation link simply opens the school's T-Rating website in a new tab. The extension cannot read that site and sends it nothing. T-Rating is covered by its own terms.

This website

The pages on this site (this policy, the terms of service and the product home page) use Google Analytics to count visits. It records the usual web analytics data: pages viewed, approximate location from the IP address, and browser and device type. It is not connected to the extension or the backend, and it never sees a student, a class, an attendance record or a school account.

The extension does not load Google Analytics and cannot. Chrome's Manifest V3 forbids an extension from running code fetched at runtime, so everything it runs is inside the reviewed package. You don't need to visit this website to use the extension.

Sharing

Data is shared only with:

• Google, which runs Classroom, Firestore, Cloud Run and the sign-in service. This is part of how the tool works, not an additional disclosure.
• Microsoft, which runs the school's Entra ID sign-in for the competency report. Microsoft confirms who is signing in. The report's data is not sent to Microsoft.
• Loxley Orbit, as the school's operator, only as described in Who is who.
• The school itself, which the data belongs to.

Data is never sold. It is never shared with any other third party, and never used for advertising.

Security

All traffic between the extension, the backend and Google's and Microsoft's services is encrypted in transit (HTTPS/TLS). Firestore encrypts stored data by default.

The backend refuses every data request that lacks a valid, verified school sign-in. A school sign-in alone isn't enough, because students have school accounts too. Every request that returns or changes named student data passes a second check:

• attendance, class lists, class tools, the workload indicator and competency evidence are limited to teachers of that course, confirmed with Google Classroom, plus the school's named data administrators;
• the student directory is limited to staff accounts;
• the competency report requires a role that the school has granted in Entra ID, and refuses student accounts even if they were granted one by mistake.

If a check can't be completed (for example, Google can't be reached), the request is refused, never allowed.

Children's privacy

The school is a secondary school, so students who use this extension include minors. Their names, attendance and returned grades are processed as described above.

Everything the backend holds about students, it holds so that their own teachers and the school can teach and report on them. It does not profile students for any other purpose, and does not track or advertise to anyone. The extension is distributed only inside the school's Google Workspace. It is never offered publicly to children, and it works as part of the school's own systems, not as a consumer product.

Data about students is processed by the school, for the school's own education and administration, under the school's own legal basis for keeping such records. That is the same basis it already relies on to run Google Classroom. Families with questions about how the school handles their child's records should contact the school at the address above.

This section describes how the software is designed. It is not a legal determination. Because the data includes minors' data, the school should have this policy reviewed by its own legal or data protection contact before relying on it. Thailand's Personal Data Protection Act (PDPA) applies.

Changes to this policy

If what is collected, or how it is used, changes materially, this document will be updated and the effective date above will change.

Contact

Questions, requests to see or delete data, or concerns about this policy: saran.o@satitm.chula.ac.th