Privacy Policy

Service and contact

This policy covers the Math Whiteboard extension and board.tabsmytracker.com. The service is operated by the Math Whiteboard developer. For privacy, support, access recovery or deletion requests contact emtrack2026@outlook.com.

Data and purposes

We process a teacher’s name, email address and password hash to provide an account. Passwords are hashed using salted scrypt; the service does not store the original password. Sessions and invitation secrets are random; the database stores their hashes. Browser storage holds session credentials and language preferences. We also store the last interface language reported by a signed-in teacher and the time it was reported, to understand the use of localized interfaces and provide an internal account report. A student’s language does not change this account value. This record is deleted with the account.

We store boards, PDFs, images, drawings, text, notebooks and editing history for shared lessons and restoration after reconnecting. A teacher may enter student names, contacts, grades, subjects, notes, lesson schedules, homework and payment records in the tutor cabinet. Payment records are bookkeeping entries: we do not collect bank card details or process card payments.

Students enter a display name and join by invitation. Participants see names, presence, cursors and the contents of that board. The tutor cabinet is restricted to the owning teacher. The extension reads clipboard content only when you explicitly paste it into the board. It does not read browsing history or unrelated website content, or use advertising or third-party analytics trackers.

For service administration and capacity planning, we keep account creation dates when known, recent teacher activity, shared-board activity, pseudonymous student visit counts and storage quota refusal counts. Updated clients can confirm that a quota notice was visibly displayed; this is not proof that a person read it. Administrative reports include account names, email addresses and these usage totals, but not passwords, session tokens, lesson content or student contact details. Aggregate account records remain until account deletion. Detailed quota events and pseudonymous visitor records are retained for up to 30 days. Historical events from before measurement began may be unknown.

Sharing and infrastructure

Board data is sent over HTTPS/WSS to our hosted server. The hosting provider handles server storage and network operations. Private backup copies are stored in Backblaze B2. The developer can access service data when necessary for operations, troubleshooting, security or a verified support request. Email support is processed by the email provider. We do not sell personal data or share it for advertising. Data is used only to deliver, maintain and protect the described features, or when required by law. Our use of extension user data follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

This service uses transport encryption and access controls; shared boards are not end-to-end encrypted. Anyone with an active invitation link can join the specified board. Share links privately and revoke them when no longer needed. A participant can retain downloaded files or screenshots; revocation does not erase those copies.

Retention and deletion

Account and lesson data remain until deleted by the teacher or through a verified deletion request. Editing history may retain previous contents until the containing board or account is deleted. Archiving a student is not deletion. Sessions expire after seven days. Unused invitations expire after 24 hours; used invitations continue to work until revoked or their board is deleted. A recovery link expires after 15 minutes and can be used once. Expired session and recovery records are cleaned on restart; unused invitations are cleaned periodically. Revoked invitation metadata can remain until board/account deletion.

A weekly backup is retained until replaced by the next verified successful backup. Update snapshots can remain longer until retired by the operator. Deleting active data does not automatically erase existing backups. Support must retire copies containing deleted account data and confirm completion; no fixed automatic backup-erasure deadline is currently guaranteed. If a backup is restored, completed account deletions must be reapplied before reopening the service. Technical server logs may include connection metadata, IP addresses, error and request times. The application does not deliberately log passwords, session tokens, invitations, or lesson content. Log files are rotated by size rather than a promised number of days.

See account deletion and recovery. Uninstalling the extension does not delete server data. Browser credentials can be removed with browser/extension storage controls. Contact support to request access, correction or deletion of personal data; identity verification is required before account-level changes.

Using the service responsibly

Teachers decide which student information is necessary and must have authority to share it, including any required permission from a parent or guardian. Use a display name rather than unnecessary personal details. Do not upload health records, payment card numbers, identity documents or other sensitive information unrelated to lessons. This policy describes service behavior and does not replace a teacher’s obligations to students. Policy changes will be published on this page.