PRIVACY NOTICE · DRAFT FOR OWNER REVIEW

How your portal data is handled

Last updated: 26 October 2026

Before inviting students: the service operator must add their name and working privacy contact below, confirm the school/provider permits this use, and review this notice for the places where the service is offered.

Plain-language summary
When you sync through the Orion or Chrome extension, this service stores a copy of your Bromcom session cookie in encrypted form so it can refresh portal data while the browser is closed. A session cookie works like a temporary sign-in credential. The server can decrypt it to request data from Bromcom. Encryption protects the database copy, but it cannot stop an authorised or compromised server function from using that session.

What happens during a sync

1 · Paired browserAfter you sign in to Bromcom and pair your extension, it reads Bromcom-domain cookies and the supported records visible to its parser: homework and descriptions, timetable, attendance, achievement and behaviour records, report titles and links, student and school display names, and homework attachment names/resource IDs/task links.

2 · Supabase receives itThe extension sends the cookies and parsed records/links over HTTPS to this dashboard's Supabase project. File contents are fetched only when you choose to open an attachment or report. Your Bromcom password is not collected by this dashboard.

3 · Cookie encrypted before storageThe server generates a new random 256-bit data key for each sync and encrypts the cookie with AES-256-GCM. It encrypts that data key with a separate master key held in Supabase Edge Function secrets. The database stores ciphertext, the wrapped data key, and the IVs needed for authenticated decryption.

4 · Background refreshSupabase Cron calls the refresh function every five minutes. The function decrypts the cookie in memory, requests Bromcom, and currently refreshes supported homework fields. Timetable, attendance, behaviour, and report parsing runs in the extension when you sync. The plaintext cookie is not written to the database or returned to the PWA and is held briefly in server memory for the request.

5 · Your dashboardThe PWA reads your saved homework records from your account. It does not receive the Bromcom cookie. When you open a file, Supabase streams it to the browser for viewing; file bytes are not written to Supabase Storage or the database.

Information processed

Dashboard account username, display name, password verifier managed by Supabase Auth, recovery-code verifier, display preferences, and up to five personal text notes of at most 1,000 characters each. Notes do not accept files or images.
If you accept the usage-log notice, your entered display name and the date/time each signed-in dashboard page is opened are recorded for pilot usage reporting. These events are stored with an internal account ID so deleting your dashboard account also deletes its usage events. Bromcom records and cookies are not included in this usage log.
Cookies returned for the Bromcom domain and its subdomains, encrypted at rest, so the server can request portal data. These may grant access to the student portal until they expire or are revoked.
Parsed school records: homework IDs, titles, subjects, classes, teachers, due dates/status, descriptions, submission types, attachment names/resource IDs/task links; timetable lessons; attendance marks; achievement/behaviour totals and event details; report titles and Bromcom report links; and the displayed student and school names. The parser may not recognise every layout or field. Attachment and report file contents remain on Bromcom until requested; on request they are temporarily processed in the Edge Function and streamed to your browser without being saved to Supabase Storage or the database. The browser receives the file to display it and may handle it according to its own cache/download settings. Links can contain temporary access tokens and must be treated as private.
Extension pairing token hash, sync timestamps, and refresh outcome/error messages.
Basic request and security metadata may be processed by Supabase and Cloudflare to operate, protect, and troubleshoot the service.

The extension requests cookies for the Bromcom domain, including its subdomains, so it can preserve the portal session across Bromcom areas. It does not request cookies for unrelated websites or collect general browsing history or the student's portal password. The extension adapter attempts these Bromcom categories on the homepage and Homework page, plus on manual sync. Unsupported or unverified pages are not used to clear existing dashboard records. Attachments and reports are fetched from Bromcom only after you choose to open one from the dashboard; the service streams them to your browser without saving the bytes to Supabase Storage or the database. This uses Supabase Edge Function and network-transfer quotas, but not Supabase file-storage space.

Encryption and who can access the cookie

The extension requests all cookies matching the Bromcom domain, including its subdomains, and sends them in the cookie header. A fresh random data key is generated for each sync. AES-256-GCM encrypts the cookie header and authenticates it against the account and purpose. The data key is separately encrypted with a project master key stored as a Supabase Edge Function secret, outside the database and extension package. The data key therefore changes with each sync; the master key does not rotate every five minutes. Changing the master key requires rewrapping saved data keys or retaining the previous key until records have been migrated.

Database client roles cannot read the cookie table. The server function and anyone who gains control of its runtime and master-key secret can decrypt saved cookies. HTTPS and encryption at rest reduce exposure, but do not make server-side session storage risk-free. Supabase and Cloudflare provide hosting infrastructure and may process service metadata under their own terms.

Automatic refresh and limitations

A successful extension sync saves a portal session. After that, the server attempts to refresh homework every five minutes, even when the paired browser is closed. While Bromcom is open in Orion or Chrome, the extension also syncs its parsed school-record categories on the homepage and every five minutes. Each scheduled run processes up to 50 accounts; a larger queue may take multiple runs to cycle through. The refresh depends on Bromcom accepting the saved session and allowing requests from the server. Bromcom may expire or revoke sessions, require additional checks, change its page format, or block server-originated requests. When refresh fails, the dashboard keeps the last successful homework data and the service records an error status; sign in again in the paired browser and sync to replace the session.

Server-side unattended refresh currently supports Bromcom homework only. Other categories are parsed by the extension while the portal is open. Other school portals need their own adapters and must not be assumed to work.

Purpose, sharing, and retention

Data is used to show and refresh a student's own dashboard and, if they accept the usage-log notice, to count signed-in dashboard visits. It is not sold or used for advertising. Supabase provides authentication, the database, Edge Functions, and scheduled jobs. Cloudflare Pages delivers the separate setup guide and dashboard websites. Both websites use the same Supabase project for accounts and private student records.

Encrypted session data, synced school records, and detected attachment/report links are retained until the student disconnects the portal or the account is deleted. Usage events are retained until the associated dashboard account is deleted. The operator may export the usage events into a separate Excel workbook; exported copies are outside automatic account deletion and need their own deletion/retention process. Disconnecting removes the database session, homework records, attachment URLs, and extension pairing; it does not necessarily revoke a copy of the session already issued by Bromcom. If a cookie or attachment link may have been exposed, sign out of Bromcom or ask the school/provider to revoke portal sessions. Provider backups and operational logs may retain limited records according to their retention settings.

Your choices

Do not pair a browser extension if you do not want the service to store a portal session.
Use “Clear synced data and disconnect browser” to delete the stored session and synced portal data, while keeping your dashboard account.
Use “Delete dashboard account” in Settings or More to delete the Supabase login and its profile, preferences, synced data, recovery verifier, extension pairing, encrypted portal session, and queued recovery requests. Provider backups or operational logs may retain limited records under their retention settings.
Declining the usage-log notice means you cannot use the signed-in dashboard in this pilot. Ask the operator to delete an exported workbook row if you later request account deletion.
Never share your pairing code or dashboard password. Use only your own portal account and a device you trust.

Students should follow their school's and family's guidance before connecting school records to a third-party dashboard. The service operator must decide and document the lawful basis, retention period, age/guardian arrangements, and any school approval required for their deployment.

Service operator and contact

Controller/operator: [Add the responsible person or organisation]

Privacy contact: [Add a monitored contact address or URL before student use]

This notice describes the current pilot implementation. Changes to portal providers, data fields, hosting, or retention should be reflected here before those changes are used.

Return to setup Open dashboard