Connected Classroom · Governance
Data and Governance
What the tools collect, where requests travel, and what a school's IT review needs in order to check the claims rather than take them on faith.
Last updated 30 July 2026
Scope
This page covers the Intelligence Suite: UDL Architect, Wonder Web, CrossLink, and REAL Connections. It also covers connectedclassroom.org itself.
Connected Classroom is the practice of one person, Timothy Cook, a practicing international classroom teacher. There is no company, no staff, and no investors. Where this page says "I," that is literal.
The AI Ethics Disclosure covers how the tools are built and where teacher judgment stays. This page covers data and security. The two are written to agree; if you find a place where they do not, that is a mistake and I want to hear about it.
What Is Collected
The principle is data minimization: if a tool does not need it to work, it is not collected.
| Category | Collected |
|---|---|
| Account information | None. There are no accounts, logins, or passwords. |
| Your name, email, school | None, unless you choose to write to me by email. |
| What you type into a tool | Processed in real time to produce the output, then gone. Not written to any storage I control. |
| What a tool generates | Not stored. It exists in your browser until you leave or clear it. |
| Anonymous usage counts | Which tool ran, the grade band, and the subject. Nothing that identifies you and nothing you typed. |
| Student data | None. The tools ask for your objective or standard, never for a child's name, work, or record. |
| Cookies and trackers | No advertising or behavioral tracking. No ads anywhere on this site. |
Session state, meaning the inputs a tool remembers if you come back within a day, is saved in your own browser and clears itself after 24 hours. It never reaches a server.
Where a Request Travels
Three parties touch a request, and no more.
- GitHub Pages serves the interface as a static page. It sees that you loaded the page. It never sees what you type into it.
- A Google Apps Script backend I control receives your input, holds the API credentials and the instructions so neither is ever exposed in your browser, and calls the model.
- Google's Gemini API generates the output and returns it. The tools run on gemini-flash-latest.
There is no other service in that path: no analytics layer, no advertising layer, no third-party processor. Requests are shaped by system-level instructions I write and maintain. No model is trained or fine-tuned on anything you submit, and your inputs are never used to improve any model.
Your work is yours. I do not sell, rent, trade, or license anything you type or anything a tool generates for you. Everything you make with these tools is yours to use freely in your teaching, under CC BY-NC-ND 4.0.
Students and Student Records
These tools are built for educators, not students. They are designed for instructional planning, and nothing in them is intended to be used by a child unsupervised.
Because no student information is requested, transmitted, or stored, there are no education records here for a school to manage, and no personal information collected from children. Your district remains the sole custodian of its student records; nothing in these tools changes that or takes any part of it on.
This is a description of how the tools work, not a legal certification. Whether a given tool fits your obligations under FERPA, COPPA, GDPR, or your local regulations is a determination your district has to make. Confirm your specific obligations with your district, and use this page as the factual basis for that review.
The practical rule I teach and follow: never enter a student's name or identifying details into any general AI tool, including these. Use an alias or a numbered key and keep the lookup table locally.
Security
Connected Classroom is a signatory to the CISA Secure by Design Pledge. What that looks like in practice, stated as plainly as I can:
- No accounts, so no credentials to steal. Removing logins and passwords from the core tools eliminates the class of attacks that multi-factor authentication exists to mitigate, along with default and reused password risk.
- No database, and no servers of my own. The backend runs on Google Apps Script and the interface on GitHub Pages. There is no user database to breach, and platform security patching is handled by those providers rather than depending on my availability.
- Limited attack surface by construction. Model output is escaped before it is displayed, and the absence of direct database access substantially reduces exposure to common web vulnerabilities when the platform is used as intended.
- Disclosure is invited. The reporting channel below is a real one, and it covers security issues, not just pedagogical ones.
- Monitoring is de-identified. The same anonymous counts described above are what I use to notice misuse or abuse patterns. There is nothing user-identifying to monitor.
I am one person, not a security team. If a critical vulnerability is found in these tools, I will say so publicly and fix or withdraw the tool rather than leave it running quietly.
Reporting a Problem
Security vulnerabilities, biased or inaccurate output, and anything that looks like it contradicts this page: write to ethics@connectedclassroom.org.
I read every report myself. I teach full time, so I will not promise a response window I cannot keep, but reports change the instructions behind the tools, and they have. You can also ask for a human review of any AI-generated suggestion you believe is biased or wrong, which is me, reading it.
Changes
This page is dated at the top and updated when the architecture or the practice changes, not on a schedule. If a tool changes what it collects, this page changes first.