ScriptSense
Privacy Policy
How ScriptSense collects, uses, protects, and retains information about faculty, staff, and students.
Overview
ScriptSense is a web application that digitises handwritten student work. Teachers photograph or scan student assignments, upload them to ScriptSense, and the system uses optical character recognition (OCR) and artificial intelligence to produce a digital transcription for review, correction, and archiving as a Google Doc.
This policy explains what information ScriptSense collects in the course of providing that service, how it is used and protected, who it may be shared with, and how long it is kept. It applies to the ScriptSense application operated for Hawaii Preparatory Academy (HPA) at scriptsense.akakala.com.
ScriptSense is operated by the developer on behalf of HPA. For data governance purposes, HPA is the data controller — it determines the purposes for which student and faculty data is processed. ScriptSense acts as a data processor, handling data only as directed by HPA and as described in this policy.
Who This Covers
This policy applies to:
- Faculty and staff who hold a ScriptSense account and use the application to upload, review, and approve student transcriptions.
- Students whose handwritten work is submitted for processing through ScriptSense. Students do not log in to ScriptSense directly — their data is handled exclusively by their teachers and by the automated processing pipeline.
- Administrators who manage accounts, rosters, and institutional settings within ScriptSense.
This policy does not cover data held by HPA in other systems (including Blackbaud, Google Workspace, or any other school platform) or data processed by teachers in Google Drive after a ScriptSense Doc has been created. Teachers' use of Google Drive is governed by Google's own terms and HPA's Google Workspace agreement.
Information We Collect
Faculty & Staff Accounts
When an administrator creates a faculty account in ScriptSense, the following information is stored:
- Name and email address
- Password — stored as a bcrypt hash; the original password is never retained
- Role (faculty or admin) and institution association
- Spell and grammar correction preferences
- Google OAuth refresh token — stored encrypted, only if the faculty member chooses to connect Google Drive
- Two-factor authentication secret — stored encrypted, only if the faculty member enables 2FA
- Last login date and IP address (the server's view of the requesting IP, used for security logging)
Student Information
Student records are created either through synchronisation with the school's Blackbaud SIS or manually by an administrator. Each student record contains:
- Name — stored encrypted at rest
- Email address (optional) — stored encrypted at rest; used only to share an approved Google Doc with the student
- Student reference number (optional) — the school's own student number, stored encrypted at rest
- Blackbaud record identifier (only for records created by SIS synchronisation) — stored encrypted at rest, alongside a one-way keyed token used to match the record on subsequent syncs without holding the identifier in a readable form
- Class enrolments
ScriptSense does not collect date of birth, grades, financial information, behavioural records, or any information about a student beyond what is listed above.
Submitted Work
When a teacher uploads a student's handwritten work, ScriptSense stores and processes:
- The original uploaded images or PDF pages — stored encrypted at rest on the server. EXIF and GPS metadata are stripped from images immediately on receipt before any processing occurs.
- Processed (preprocessed) images — contrast-adjusted copies used to improve OCR accuracy, stored encrypted at rest.
- OCR text — the raw text output from the OCR engine, stored encrypted.
- Claude transcription — the AI-polished transcription, stored encrypted.
- Teacher-approved final text — the text the teacher approves (with or without edits), stored encrypted.
- Correction diffs — records of differences between Claude's output and the teacher's final text, used to improve future transcriptions for the same student's handwriting.
- Processing metadata — submission timestamps, processing status, spell and grammar correction counts, and AI API token usage counts (used for cost tracking).
Usage & Technical Data
ScriptSense logs the following for security, reliability, and cost-tracking purposes:
- Audit log entries — records of significant actions (login, logout, user creation, role changes, data erasure) including the acting user, timestamp, and relevant identifiers. The audit log is append-only and not deletable through the application.
- Server-side session records — a hashed session token, the associated user ID, and the session creation and expiry timestamps. No sensitive data is stored in the session itself.
- Error and processing logs — written to a server log file outside the web root; not associated with identifiable individuals beyond what the PHP error context includes.
ScriptSense does not use third-party analytics services, advertising networks, tracking pixels, or fingerprinting techniques. No data is sold or used for advertising.
What We Don't Collect
ScriptSense is a narrowly scoped transcription tool. To be explicit about what falls outside that scope:
- No behavioural or browsing data. ScriptSense does not track which pages you visit, how long you spend on them, or use any analytics platform. There are no tracking pixels, heat maps, or session recordings.
- No device data. ScriptSense does not read device identifiers, install lists, contacts, calendars, or any other data from the devices used to access it beyond the IP address visible in a standard server request.
- No location data. ScriptSense does not request or store the geographic location of any user or device. EXIF/GPS coordinates embedded in uploaded images are actively stripped on receipt.
- No biometric data. ScriptSense does not collect fingerprints, face scans, voiceprints, or any other biometric identifiers.
- No health or demographic data. ScriptSense does not collect information about a student's health, disability status, ethnicity, household, or family beyond what appears incidentally in handwritten schoolwork submitted for transcription.
- No advertising profiles. ScriptSense does not build profiles of users or students for advertising or any commercial purpose. Student data is never used to target advertising, sold to data brokers, or shared with marketing firms.
- No third-party analytics. No Google Analytics, Meta Pixel, or equivalent service runs on ScriptSense pages.
How We Use Information
ScriptSense uses the information it collects solely to provide the transcription service to HPA. Specifically:
| Purpose | Information used |
|---|---|
| Authenticating faculty accounts | Email, password hash, session token, TOTP secret |
| Processing submitted work | Uploaded images, OCR text (sent to OCR engine), transcription text (sent to Claude) |
| Identifying the student in a mobile capture | Page header image sent to Claude Vision; name matched against the class roster |
| Creating approved Google Docs | Approved transcription text, student name and email (if available), teacher's Google OAuth token |
| Improving transcription accuracy | Correction diffs stored per student; used as context in Claude prompts for future submissions from the same student |
| Syncing class rosters from Blackbaud | Blackbaud API credentials; class and student data read from the SIS on faculty login |
| Cost and usage reporting | API token counts and submission counts, aggregated by month |
| Security and audit | Login IP, audit log entries, session records |
No information collected by ScriptSense is used for any purpose beyond operating this service for HPA. No data is shared with advertisers, data brokers, or any party not listed in the Third-Party Services section below.
Data Ownership
All student and faculty data processed through ScriptSense is and remains the property of Hawaii Preparatory Academy. ScriptSense acts as a data processor under HPA's direction. This means:
- ScriptSense acquires no ownership interest in student data through the provision of its services.
- ScriptSense may not use student data for any purpose beyond operating the transcription service for HPA.
- Student data is never sold, rented, traded, licensed, or commercially distributed to any third party.
- Student data is never used to train general-purpose machine learning models. When OCR text is sent to the Anthropic Claude API, it is submitted under Anthropic's API terms, which govern how Anthropic handles submitted data for model training purposes — see Anthropic's privacy policy for details.
- Administrators can erase student submission content and anonymise student records at any time from within the application.
Google Docs created by ScriptSense and saved to a teacher's Google Drive are the teacher's own documents, governed by HPA's Google Workspace agreement and Google's terms of service. They are not under ScriptSense's control after creation.
Third-Party Services
ScriptSense relies on the following external services to deliver its functionality. Each receives only the minimum data necessary for its specific role.
How We Protect Data
ScriptSense applies multiple layers of technical protection to the data it handles:
| Measure | What it protects |
|---|---|
| AES-256-GCM encryption at rest | Uploaded images and PDF pages; OCR text; Claude transcriptions; teacher-approved final text; student names; student email addresses; Google OAuth tokens; TOTP secrets; Blackbaud API credentials. All encrypted with authenticated encryption — tampering is detected, not just confidentiality. |
| Password hashing (bcrypt) | Faculty passwords. Original passwords are never stored. |
| Session token hashing | Server-side session tokens are stored as hashes, so a database leak does not expose usable session credentials. |
| HTTPS / HSTS | All traffic between browsers and the ScriptSense server is encrypted in transit. HTTP is redirected to HTTPS; HSTS prevents downgrade attacks. |
| EXIF / GPS stripping | Device metadata (including location data embedded by smartphones) is removed from uploaded images immediately on receipt, before any other processing or storage. |
| Login rate limiting | Repeated failed login attempts are temporarily blocked to prevent brute-force attacks. |
| Server-side sessions only | No sensitive data is stored in browser cookies or local storage. The browser holds only a session identifier (an HTTP-only cookie); all user data lives on the server. |
| Application files above web root | PHP source code, configuration, encryption keys, and uploaded files are stored in directories not directly accessible via the web server. |
| Temporary plaintext handling | When encrypted images must be decrypted for OCR processing, they are written to a temporary file in a scratch directory outside the web root, then deleted immediately after use. They are never written to a publicly accessible path. |
No security measure eliminates all risk. If a security incident occurs that may affect HPA's data, ScriptSense will notify HPA promptly to enable HPA to fulfill any obligations it has to notify affected individuals under applicable law. The process for this is detailed in the ScriptSense Incident Response Plan maintained separately.
Retention & Erasure
ScriptSense retains student submission content only as long as needed for educational purposes, and erases it automatically according to HPA's configured retention policy.
Automatic retention schedule
Each institution configures an annual school-year-end date (by default 1 July) and a number of completed school years to retain after that date (by default zero — meaning content older than the most recent 1 July is eligible for purge). Each day, the ScriptSense cron job identifies any submission content that has passed this threshold and erases it automatically.
What is erased: the original uploaded images, processed images, OCR text, Claude transcription, teacher-approved text, and correction diffs for the affected submissions. What is retained: the submission record itself (student name placeholder, assignment, timestamps, correction counts, Google Doc reference) so that usage reporting and audit history are not broken.
Manual erasure
Administrators can erase data on demand at any time, independently of the retention schedule:
- Student erasure: anonymises the student record (replacing name, email, and student reference number with a non-identifying placeholder) and immediately purges all submission content for that student across every assignment. The erasure is permanent: the record is tombstoned so that subsequent Blackbaud synchronisations will not repopulate it, even if the student remains on the school's roster.
- Assignment erasure: purges submission content for every student in a specific assignment.
Faculty account data
Faculty account records are retained while the account is active and for a reasonable period after deactivation, to preserve the audit log. Administrators can deactivate accounts at any time, which prevents login without deleting the record.
Google Docs
Google Docs created by ScriptSense are saved to the teacher's own Google Drive and are not under ScriptSense's control. Automatic and manual erasure within ScriptSense does not delete the associated Google Doc. Teachers and administrators must remove Docs from Google Drive separately if required.
Student Privacy & FERPA
The Family Educational Rights and Privacy Act (FERPA) governs the privacy of student educational records at institutions that receive federal funding. HPA is subject to FERPA, and student data processed through ScriptSense forms part of HPA's educational records.
ScriptSense operates as a school official under FERPA — a service provider with a legitimate educational interest in accessing student education records solely for the purpose of providing the transcription service contracted by HPA. ScriptSense does not use student data for any purpose other than providing that service, does not disclose student data to third parties beyond those listed in this policy, and does not retain data beyond the institution's configured retention period.
Student consent: Individual student consent is not required for HPA to use ScriptSense to process student work, provided HPA has determined (as the data controller) that doing so serves a legitimate educational purpose under its FERPA obligations. Teachers are responsible for ensuring that use of ScriptSense is consistent with HPA's FERPA compliance framework.
FERPA rights: Students (or their parents if the student is under 18) retain the FERPA rights to inspect and request corrections to their educational records. These rights are fulfilled through HPA's standard FERPA processes, not through ScriptSense directly. Administrators can extract or erase ScriptSense data in support of a FERPA records request.
Your Rights
The following rights apply to data held about you in ScriptSense. Contact your ScriptSense administrator to exercise any of them.
| Right | How it is fulfilled |
|---|---|
| Access | Faculty members can view their own account information within the application. Student data can be provided to the student or their parent on request via an administrator. |
| Correction | Faculty account details can be updated by an administrator. Student names and email addresses can be updated in the Students admin panel. |
| Erasure | Administrators can erase a student's submission content and anonymise their record on demand. Faculty accounts can be deactivated at any time. |
| Google Drive disconnection | Faculty members can disconnect their Google account at any time from within the application. This revokes ScriptSense's access to their Drive and clears the stored refresh token. |
| 2FA removal | Faculty members can disable two-factor authentication from their account settings. An administrator can reset 2FA on their behalf if the device is lost. |
Contact & Changes
Questions about this policy, requests relating to your data, or concerns about how ScriptSense handles information should be directed to:
ScriptSense Administrator — Hawaii Preparatory Academy
Contact via your institution's usual channels or through the HPA IT department.
For concerns that cannot be resolved through HPA, you may contact the ScriptSense developer directly via the address on file with HPA.
Changes to this policy
If this policy is updated in any material way, HPA administrators will be notified before the change takes effect. The effective date at the top of this page will be updated. The previous version of this policy can be provided on request.
This policy was last updated in August 2026 for the ScriptSense pilot at HPA. It will be reviewed before any extension of the pilot or production deployment.