Student Data Privacy

Attendance Tracker is used by teachers, professors, and trainers to record who attended a Google Meet class. That means it handles information about students — so schools and IT reviewers deserve a plain-English page about exactly what we do with it. This page supplements our full Privacy Policy; if anything here seems to conflict with it, the Privacy Policy governs.

Our pledge

• We never sell student data, and we never share it with third parties for advertising or marketing.
• We show no ads — not to teachers, and never to students.
• We do not build profiles of students, and we do not use student data to train AI or machine-learning models.
• We collect the minimum needed to produce an attendance record: names, email addresses, and join/leave times for meetings an organizer chooses to track.
• Teachers and schools can delete their data at any time, self-serve, from the add-on's Settings.

What student data the App touches

• Attendance records: participant names, email addresses, and join/leave times for meetings the organizer tracks, obtained from the Google Meet REST API. This is the core product data.
• Class rosters: if a teacher imports a roster from Google Classroom, the student names and emails are stored only in the teacher's browser — never on our servers.
• No student accounts: students never sign in to Attendance Tracker and no account is created for them. All data about students enters the system through their teacher's or organizer's account.

FERPA

For U.S. schools, attendance records derived from class meetings may be education records under FERPA. Attendance Tracker is designed to operate as a service provider under the school's direction — the "school official" model: the school (through its teachers) controls what is collected, the data is used only to provide the attendance features the teacher requested, we do not redisclose it, and the school can direct deletion at any time. We never use education records for any purpose other than providing the service.

COPPA

Attendance Tracker does not offer accounts to children and does not collect information directly from students of any age — students never interact with the App. Information about students (name, email, join/leave times) is collected from Google's APIs solely at the direction of the educator or organization running the meeting, consistent with the school-consent model the FTC recognizes for educational tools.

GDPR

For schools and organizations in the EU/UK, Attendance Tracker acts as a processor of student personal data on behalf of the organizer or institution (the controller). We process attendance data only to provide the features the organizer uses, support deletion and export requests, and store data with the safeguards described below. Data subject requests can be fulfilled by the organizer directly (self-serve deletion) or by contacting us.

Where data lives & how it's protected

• All primary data is stored in Google Cloud Firestore in the US (us-central1), isolated per organization domain.
• All traffic is encrypted in transit (HTTPS); OAuth tokens are encrypted at rest with AES-256-GCM.
• Card and payment details never touch our servers (handled entirely by Stripe — and billing only ever involves the teacher or school, never a student).
• The full list of sub-processors is published in our Privacy Policy.

Retention & deletion

• Attendance data is retained while the organizer's account is active, so historical reports keep working.
• Organizers can delete their account and all associated data self-serve from Settings ("Delete account & data"), or by emailing us.
• When an account is deleted, the personal data that identifies its participants is removed as described in the Privacy Policy.

Data Processing Agreement (DPA)

Schools and districts that require a signed Data Processing Agreement as part of their vendor review can request one at derek@attendancetracker.dev. We're happy to work through your district's standard privacy agreement or your state's student data privacy consortium terms.

Google API data & Limited Use

All Google user data (Meet participant information, Calendar events, Classroom rosters, Drive files the App creates) is used strictly in line with the Google API Services User Data Policy, including its Limited Use requirements — no advertising use, no sale, no AI training, and no human access except with consent, for security, or as required by law. The full commitments are in our Privacy Policy.

Questions

If your school's privacy or IT review needs anything else — security questionnaires, architecture details, or a call — contact derek@attendancetracker.dev.