The short version
Computer Hall Pass is used to keep school and family Chromebooks on task. Because it is used by children, we designed it to collect as little as we possibly can while still doing the job.
example.com.1. Who we are
Computer Hall Pass ("we," "us") provides web-filtering software licensed to schools, and to families who choose our Family plan. Whoever deploys our software — the school or district, or the parent who holds the family account — is the party that decides what is filtered and who may see the records. In data protection terms, that school or that parent is the controller of the information, and we act as a service provider on their behalf and under their instructions.
Almost everything in this policy is the same either way, because the software is the same either way. Where a family account differs, section 10 says how.
2. What the extension collects
When a Chromebook is enrolled — by a school, or by a parent on a family account — the extension records only the following:
| What | Why we need it |
|---|---|
| Site name of a blocked attempt e.g. example.com |
So the school can see what is being attempted and adjust their approved list. Also supports the monitoring records schools need for CIPA and E-Rate. |
| Time of the attempt | To make the records meaningful and to allow automatic deletion after the retention period. |
| A random device identifier e.g. a3f9c2e1… |
So a school can tell one Chromebook from another. It is generated at random and is not linked to any person. |
| An optional device label e.g. "Desk 4" or "Cart 3 / Unit 12" |
Typed by a teacher or administrator, or by the parent on a family account, so they can find the right Chromebook. It is whatever that adult chooses to type — we recommend a desk or asset number rather than a child's name, and the school decides whether first names are acceptable. Parents are steered to a place or a nickname (“Kitchen laptop”). |
| A safety category, when one is matched e.g. self_harm, explicit, violence |
So a school can respond to a student who may need help. The matching happens entirely on the Chromebook, and only the one-word category is sent — never the words the student typed, which are never transmitted and never stored. See the note below. |
| A site a device asked to have unblocked plus the reason chosen from a fixed list |
So a teacher can approve or deny the request. Recorded only when someone actively uses the "request this site" button. |
| The time the device last contacted us | So staff can see whether a Chromebook is still online and receiving its settings. We store only the most recent time, not a history of connections. |
What never leaves the device. The extension must read the address of a page in order to decide whether to allow it — that check happens locally, on the Chromebook. Only the site name of a blocked attempt is transmitted. Pages that are allowed are not reported at all, and the path and query string are stripped before anything is sent, then stripped a second time on our server as a safeguard. The same is true of typed text: the extension compares what is typed against a safety word list on the device, and if there is a match it sends the name of the category and nothing else. The words themselves are never sent to us, never stored by us, and never shown to school staff.
Permissions the extension requests, and why
webNavigationandtabs— to see the address a tab is about to open, so it can be blocked before it loads.host permissions— the filter must be able to act on any address, because any address might be one that needs blocking.storage— to keep the approved-site list on the device so filtering keeps working without a network connection.idle— to lock the screen after a period of inactivity, if the school turns that on.alarms— to check periodically for updated settings from the school.scripting— to show the full-screen “Eyes up front” attention screen over open tabs when a teacher asks for the class's attention. It draws on top of the page and leaves the student's work untouched underneath; it does not read or record the page.
3. What we collect from the adults who run an account
Staff who administer the service have accounts. For them we store a name, a sign-in username or work email address, their role, and the grade levels they manage. Account passwords are stored only in scrambled (hashed) form. When an administrator creates a staff account with an email address, the sign-in details are emailed to that person once, and the password is erased from our copy of the email after it is sent. We also keep an audit record of administrative actions, such as changing a filter, so schools can see who changed what.
Staff may also choose to add a phone number and a profile photo in their account settings. Both are optional and can be removed at any time. Photos are shrunk to a small square on the staff member's own device before upload, which also removes hidden photo details such as the location the picture was taken. They are stored with our hosting provider at an unguessable web address, so anyone given that exact address could view the photo.
On a family account the equivalent adult is the parent: we store their login email address and the family name they chose. The same audit record applies. See section 10.
4. What we never collect
- Student names, emails, usernames, or student ID numbers
- Search queries, or any other text a student types. Typed text is checked against a safety word list on the Chromebook itself. If it matches, we receive the name of the category and nothing more — the words never leave the device. See section 2.
- Full URLs, page content, screenshots, keystrokes, webcam, microphone, or location
- Browsing history of sites that were allowed
- Anything at all from a Chromebook that has not been enrolled by a school or a family account
5. How we use it
Only to provide the service to the account that licensed it — the school, or the family: enforcing that account's chosen settings, showing that account its own records, and keeping the service working and secure. We do not use it for anything else.
Specifically, and permanently: we do not sell or rent it, do not use it for advertising or to build advertising profiles, do not use it to train machine learning or AI models, and do not combine one account's data with another's to produce analytics or research.
6. Who we share it with
We do not sell or trade information. It is shared only with:
- The account it belongs to. Each school sees only its own data, and teachers see only the grade levels they are assigned. On a family account, only the parent who holds the account can see it.
- Our hosting provider, which stores the database on our behalf under contract and may not use it for its own purposes.
- Legal authorities, if we are legally compelled. Where we are permitted to do so, we will notify the school first.
If our business is ever sold or transferred, the data remains subject to this policy, and schools and families will be notified with an opportunity to have their data deleted instead.
7. How long we keep it
Blocked-attempt records, safety-category records, and decided site requests are all deleted automatically after the retention period the school selects, which is 30 days by default and can be set as low as one day. Deletion runs on a daily automated job — it is not a manual promise.
Two deliberate exceptions. A site request that is still waiting for a teacher's decision is kept until it is decided, because it is an open task rather than a record. And the "last contacted us" time is a single value that is overwritten each time a device checks in, so there is no history of it to delete.
Family accounts do not choose a retention period: it is fixed by the plan — 7 days on Family, 30 days on Family Plus — and is not adjustable, by the parent or by us.
Staff and parent account records are kept while the licence is active. When a licence ends, we delete the account's data within 30 days unless the account holder asks us to do it sooner.
8. Rights, access, and deletion
Because the school controls this information, requests from parents and students about a school account should go to the school first — they can see, download, or delete the records directly, and can also instruct us to do it. On a family account the parent already holds all of those controls themselves.
Schools can, at any time:
- See every record we hold for them, in the console, and download the activity and flagged-search records as a CSV file from those views
- Purge all their records immediately, with one action — that action deletes the activity log, the flagged-search records and the site requests together, not a subset of them
- Change how long records are kept (school accounts; on a family account the period is fixed by the plan)
- Ask us to delete everything, permanently, including backups
To make a request, contact privacy@computerhallpass.com. We respond within 30 days, and usually much sooner.
9. Children's privacy
This service is used by children, including children under 13. Our approach is to avoid collecting children's personal information in the first place rather than to collect it and promise to be careful. Children have no accounts, and we never receive anything they type.
We do not receive children's names from a school. On a family account, the labels are chosen by the parent and typed into their own console — so a parent could type a child's real name into a group or device label. We ask them not to, and steer the wording to nicknames (“Big kid”, “Kitchen laptop”), but we cannot promise a label never contains a name, and we do not claim otherwise.
We provide this service to schools for educational purposes under the school's direction, and to parents for their own children under their own direction. We do not treat a school's agreement as a substitute for our own obligations, and we do not use any information obtained through a school or a family for commercial purposes of our own.
10. Family accounts
We offer the same service directly to parents, as our Family and Family Plus plans. The filtering and the logging behave identically to a school account — domain names only, no full addresses, no search terms, one-word safety categories only — because it is the same extension and the same server. What differs is who holds the account and what is stored alongside it.
What a family account stores
- The parent's login email address. This is the only real personal identifier in a family account, and it belongs to the adult, not the child.
- A family name, chosen by the parent, used as the account label.
- Labels for the kid groups, chosen by the parent — one on Family, up to ten on Family Plus. We recommend nicknames (“Big kid”, “Little one”) and the console asks for one. These labels are shown only to the parent.
- Device labels, also chosen by the parent — a place or a nickname, such as “Kitchen laptop”.
- The same records as any account: the site name of a blocked attempt, its time, the random device identifier, and a safety category when one is matched.
Children still have no accounts, no logins, and no identifiers of their own. A Chromebook is connected with a short code that carries no personal information.
How long we keep it
Retention on a family account is fixed by the plan — 7 days on Family, 30 days on Family Plus — and is not adjustable. Deletion runs on the same nightly automated job as every other account.
Deleting a family account
A parent can have the account and every record in it deleted by emailing privacy@computerhallpass.com from the account's login address. We do it and confirm, without asking for a reason.
What does not apply to a family account
The school-official framing in the rest of this policy — FERPA's school official exception, the district agreements in section 13, the idea of a school as the controller acting through us — applies to school accounts only. A family account has no school in it. The parent is the account holder and the controller of their own family's information.
For COPPA, the parent who opens a family account is giving parental consent for their own child, as the child's parent. There is no school standing in for them, and we do not treat the parent's agreement as a substitute for our own obligations — the data minimisation described in this policy is the same on a family account as on a school one.
11. Security
Data is encrypted in transit. Each school's records are isolated from every other school's at the database level, so the separation does not depend on our application code being bug-free. Access to production data is limited to staff who need it. Device identifiers are random values rather than anything derived from a person.
If a breach affecting a school's data occurs, we will notify that school without undue delay and cooperate with any notifications they are required to make.
12. Where data is stored
Data is stored on servers in the region selected for the account's deployment. Schools with specific data residency requirements should raise them before purchase so we can confirm we can meet them.
13. Agreements with schools
We are glad to sign a district's data privacy agreement, including the standard National Data Privacy Agreement (NDPA). Where such an agreement conflicts with this policy, that agreement governs for that school. Contact privacy@computerhallpass.com.
14. Changes to this policy
If we make a material change — particularly any change that would expand what we collect — we will notify licensed schools and family account holders by email before it takes effect. We will not begin collecting a new category of information about children without telling them first.
15. Contact
Privacy questions and data requests: privacy@computerhallpass.com
General enquiries: hello@computerhallpass.com