PRIVACY POLICY
Student Dashboard Sync
Last updated: 25 October 2026
What the extension accesses
The extension runs only on the supported Bromcom portal host. After a student pairs their extension and explicitly agrees to cookie syncing, it reads Bromcom session cookies and selected portal records, currently homework. It does not collect general browsing history or the student's school password.
How the data is used
The extension sends the pairing token, selected portal records, and session cookies over HTTPS to the Supabase project configured for this dashboard. The Edge Function encrypts session cookies with AES-256-GCM before saving them in the database. The service operator controls the encryption key and can decrypt the session to provide the requested sync service. The dashboard uses the records to display the student's own school data.
Storage and sharing
Account records, dashboard preferences, selected school data, and encrypted session cookies are stored in the configured Supabase project. Data is not sold or used for advertising. Access is restricted to the student's account in the dashboard; service operators with backend access can technically access stored records and decrypt sessions.
Retention and deletion
Data remains until the student disconnects Orion/Chrome from the dashboard or the service operator deletes the account. The dashboard's “Clear synced data and server session” action removes the synced portal records and server-side session. Students should also sign out of the school portal or revoke its sessions if they believe a cookie was exposed.
Choices and consent
Sync is available only after pairing and an affirmative cookie-transfer consent. Students can avoid connecting a portal account. The extension syncs when the supported portal page is open; it does not sync after the browser closes.
Contact
For privacy requests, contact the operator who provided this dashboard. The operator should publish their contact details here before making the service available to students.