Privacy Policy for Rubric Generator

1. Who we are and what this policy covers

Rubric Generator is a browser extension for Google Chrome, published by an independent developer. This policy explains what the extension does with your data, what our website at essaygrader.page does, and what rights you have. It applies to the extension itself and to the pages of essaygrader.page that belong to it (the Rubric Generator page, the welcome page, the uninstall page and this policy).

The short version: the extension works inside your browser; only the rubric drafting described in section 2b sends what you give it to our server.

2. What data the extension handles

Apart from the rubric drafting in section 2b, the extension does not send personal data to us or to anyone else, and we do not sell it. The data described below is handled only on your device.

• Your rubrics. Every rubric you generate or start blank, with your edits, is saved with the browser's built-in chrome.storage.local API under My rubrics (up to 100). They stay in your browser profile until you delete them or remove the extension.
• The form. What you type in the form (the assignment, the notes and the chosen options) is saved the same way, so it is still there when you reopen the tab.
• Install ID and the daily limit. A random install ID (section 2b) and the last known number of rubrics left today are saved in chrome.storage.local.
• No page content. The extension does not read the websites you visit. It has no access to your tabs or browsing history; it only works on its own page, which opens when you click its icon.
• No accounts. The extension has no sign-up, no login and no user profiles.
• No tracking inside the extension. The extension contains no analytics, no advertising code and no remote code.

Chrome Web Store disclosure. Our Chrome Web Store listing declares Website content, because the assignment details you type are sent to our server to draft the rubric.

2b. What goes to our server

Drafting a rubric runs on our own server at rubric.essaygrader.page, because it needs an AI model. This is what happens when you use it:

• What is sent. Only what the draft needs: the assignment or topic you type, the grade band, the rubric type, the number of criteria and levels, and your notes if you add them. Nothing is sent until you press Generate rubric. Your saved rubrics and your edits are never sent. Separately, the extension asks our server for an install ID on first use and for the daily limit when you open it (at most once an hour); these requests carry the install ID and the extension version, and no text.
• Who processes it. Our server passes it to OpenRouter (openrouter.ai), a service that runs it on a language model made by OpenAI, returns the answer to you and then discards the request. We send every request with OpenRouter's zero-data-retention setting: OpenRouter does not store prompts or answers, and it passes them only to model hosts that do not keep them after processing (for OpenAI models this is currently Microsoft Azure). Neither uses the data to train models. The only exception is content flagged by automated child-safety screening, which may be kept for review and reporting as the law requires.
• What we keep. We do not store what you send or the rubrics you get. We keep only: a random install ID that our server gives the extension on first use (it is not linked to your name, email or Google account); daily counters of how many times each install ID drafted a rubric, to apply the daily limit of 3 rubrics (kept for 8 days); and a one-way hash of your IP address with a key that changes every day, to stop abuse (kept for 2 days). Technical server logs (time, address of the request without its content, status) are deleted after 7 days.
• Deleting it. Removing the extension deletes the install ID from your browser. To delete the counters linked to it on our server, write to [email protected] with the install ID shown under About on the extension's page.

The legal basis for this processing is that you asked the extension to draft a rubric (performance of a service you requested), and our legitimate interest in preventing abuse of the daily limit.

3. Cookies and analytics on our website

The Rubric Generator page, the welcome page and this policy on essaygrader.page use Google Analytics 4 to count visits. This happens only on the website, not inside the extension. The uninstall page has no analytics. The welcome page also reports whether the extension's icon is pinned to your toolbar. We never send Google Analytics your rubrics or anything you type. Advertising features are off for everyone.

If you are in the European Economic Area, the United Kingdom or Switzerland, analytics cookies are off. Google works out your country from your IP address. In those places Google Analytics sets no cookies and stores no identifier on your device. The Google script still loads and can send Google a basic signal without a cookie: the page you opened, the time, your browser and device type, and your approximate location.

Everywhere else, analytics cookies are on by default. Google Analytics sets cookies named _ga and _ga_*, which can last up to two years, and processes the same technical data.

Your browser connects to Google to load the script, so Google sees your IP address. Google says Google Analytics 4 uses it to estimate location and does not store it. Statistics are kept for 14 months (see section 8).

Your choice. This website does not ask for consent, so visitors from the European Economic Area, the United Kingdom and Switzerland stay without analytics cookies.

You can also block cookies in your browser settings, use a content-blocking extension or install Google's opt-out add-on (tools.google.com/dlpage/gaoptout). The website keeps working without them. Google's own privacy policy describes how Google processes this data.

Server logs. Like any web server, ours keeps a technical log of requests to these pages: IP address, the address requested, the time, the browser type and, if your browser reports it, the page you came from. The site is served through Cloudflare, which also sees this traffic and protects the site from abuse. We use the log to keep the site running and safe, and it is deleted automatically after a short time. The extension sends nothing to this log; only opening one of these pages does.

4. How we use data

The only data we receive is the counters described in section 2b, the aggregated website statistics and server logs described above and, if you choose to send them, your answer on the uninstall page and any email you write to us. We use the counters to apply the daily limit, the statistics to see how many people reach the welcome page, the logs to keep the site and the server running and safe, and your answers and emails to reply to you and to improve the extension. We do not build individual profiles and we do not combine this data with any other source.

When you remove the extension, Chrome opens a short page on our website that asks why. Answering is optional. Only if you press Send, the reason you picked and the text you typed (up to 500 characters) go to our server, which passes them to us as a message in Telegram with the name of the extension and does not store them. To stop spam, the server counts answers per day by a one-way hash of your IP address with a key that changes every day; the hash is kept for 2 days and is never part of the message. The uninstall page has no analytics and sets no cookies. Please do not put personal details in your answer.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. Who we share data with

We do not sell or rent data, and we share it only with the services named here. They process data for us: Google Analytics, as a service provider for the website statistics in section 3; Telegram, which delivers answers from the uninstall page to us (it receives the extension name, the reason and the text you send, but not your IP address or any install ID); Cloudflare, which delivers the website; and our hosting and email providers, which store the server logs and the emails you send us. Please do not put personal details in your answer on the uninstall page. For rubric drafting in section 2b, OpenRouter (openrouter.ai) and the model host it uses (currently Microsoft Azure) process the data you send as our service providers and do not keep it; see section 2b.

6. Your rights, including under the GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access, correct or delete personal data about you, to restrict or object to its processing, and to lodge a complaint with your local data protection authority. The extension keeps your rubrics and settings only on your device, so you can delete them yourself at any time (see section 8). For the counters on our server, see section 2b. For website analytics, you can opt out as described in section 3. For anything else, write to [email protected] and we will answer within 30 days.

This website does not ask for consent, so it sets no analytics cookies in those places. The legal basis for the basic signal without cookies, for website analytics elsewhere and for server logs is our legitimate interest in understanding how the website is used and keeping it safe. The legal basis for emails and uninstall page answers you send us, and for counting those answers by the IP hash, is our legitimate interest in replying to you, improving the extension and preventing spam. The legal basis for storing your rubrics and settings is that you asked the extension to keep them.

7. Children

The extension and the website are made for teachers and are not intended for children under 13 (or under the age set by your country's law). We do not ask for names, ages or accounts and do not knowingly collect personal information from children. Please describe the assignment, not the students: leave student names and student work out of the form. The only thing our server keeps about an installation is a random install ID and a daily counter (section 2b).

8. Data retention and deletion

Your rubrics, the form and the install ID live in your browser only. Delete a rubric with the × next to it under My rubrics; removing the extension from Chrome deletes everything it stored. Counters on our server are deleted after 8 days and IP hashes after 2 days (section 2b). Website analytics data is kept by Google Analytics for the retention period set in our account (14 months) and then deleted automatically. Server logs are deleted automatically after a short time. We keep emails only as long as we need them to reply or to improve the extension, and you can ask us to delete them. Answers from the uninstall page stay in our private Telegram chat until we delete them; our server keeps only the daily counts and the IP hash described in section 4, for 2 days.

9. Changes to this policy

If we change this policy, we will update the text on this page and the date at the top. Please check this page from time to time if you want to stay informed.

10. Contact

Questions about this policy or about your data: [email protected].