Necessary service storage
Sign-in cookies maintain and refresh your authentication session. On 25 October 2026, hosted Auth showed a one-hour access-token expiry and refresh reuse detection, with no configured timebox or inactivity timeout; refreshing can extend access beyond an individual token. Session suitability and the new application MFA enforcement still need acceptance before school adoption. Browser storage also holds teaching drafts, pending saves, tool preferences and recovery pointers so the features you request can work. These are functional service uses, not advertising identifiers. Blocking all browser storage can prevent sign-in, saving or recovery.
Local teaching history expires after 30 days on read/write. Other drafts remain until removed, sign-out or clear-device. Gap Analysis is retired. Startup removes its designated local and session records and database without clearing current Workshop drafts. If an old tab blocks deletion, close that tab and use Retry cleanup. Previously downloaded reports and device backups are outside browser cleanup; keep them under your school's control and never feed individual marks into Tumble's server or AI.
Optional measurement
Vercel Web Analytics and Speed Insights are off by default. Privacy choices lets you opt in or turn them off at any time; the same control is in Account. The choice is stored on this browser until changed or browser storage is cleared. Do Not Track and Global Privacy Control override an opt-in. We do not assert the statistical-purposes exception as the basis for these requests.
When enabled, measurement is limited to a small allowlist of public pages. The app removes query strings, fragments and unknown fields and sends no account, lesson or share-token identifiers. Private teaching/account/adoption routes are excluded, as are custom events. Already loaded measurement code checks your current choice before sending. The provider still receives connection metadata when a request reaches it; this is not a claim that every network request is anonymous. Vercel's contractual coverage is an outstanding supplier gate.
Other connections
Canvas fonts and icons are served by Tumble. Commons image search and bitmap requests pass through Tumble's bounded server relay, preserving licence credits without forwarding browser cookies, IP address, user agent or referrer upstream. Do not type personal information into searches. Opening an external credit or supplier link takes you to that provider. Google receives a sign-in request when you choose Google sign-in. The browser's destination policy blocks other background destinations; tldraw licensing arrangements still require resolution before school adoption.
Shared devices and clearing
Sign out after teaching. This fences further local classroom writes and clears Workshop/Gap Analysis stores, drafts, pending saves and AI state. Close other Tumble tabs and retry if clearing reports a blocked database. Saved cloud work is not deleted by local clearing; use Account for cloud export, history clearing or erasure. Other tabs must reload before starting fresh work.
Your downloads, printouts, browser/device backups and copies held by recipients are outside these controls. Optional measurement preferences and harmless UI settings are separate from classroom-data clearing. To remove all site storage, use your browser's site-data controls. The school adoption form keeps entries only in the open page; it sends nothing automatically, and its clear action removes the form values.