For districts and IT

A data tool with no data to vet.

This page is for technology directors, privacy officers and administrators asked to approve SLP Data for staff use. Short version: the site receives no student information, so there is no data-sharing agreement to sign.

Architecture

• Static app. The app at app.slpdata.org is HTML, CSS and JavaScript files, served as they are by Cloudflare. Nothing behind it runs code, keeps a database or accepts data.
• Its own origin. The app is served from a separate address from the informational site and its contact form, so the browser keeps the app's storage out of reach of every other page.
• Client-side storage. Student records are held in the browser's IndexedDB on the staff member's device, under the same protections as any other site data on that device.
• No third parties. No analytics, advertising, fonts or scripts from other domains. Everything is served from this site.
• Browser-enforced. A Content Security Policy with connect-src 'self' makes the browser block any outbound connection to another host.

Regulatory position

Because no personally identifiable information is transmitted to or stored by the operator, the operator does not act as a school official, service provider or data processor under FERPA, COPPA or state student-privacy laws. The staff member's device and your district's device policies govern the data, exactly as they do for a spreadsheet saved on that device.

Recommended minimal data

The app asks for a first name and last initial, grade and IEP goal text. It does not ask for birthdates, student ID numbers, addresses or photographs. Districts may instruct staff to use initials only.

Managed Chromebooks

Some device policies clear browser data at sign-out. If yours does, staff should either keep the site's storage exempt (allow-list https://app.slpdata.org for persistent site data) or back up with the one-click .xlsx export at the end of each day. The app reminds them.

Verification

The verification page lists checks your IT staff can run in a few minutes, including the Network tab test and the security header check.

Questions: the contact form