Privacy policy

NESA Marking Report — Chrome extension. Last updated 15 September 2026.

This policy describes what the NESA Marking Report extension collects, what it does not collect, and where information goes. It is written to satisfy the Chrome Web Store user data policy and to be readable by the teachers who use the tool.

Who this is for

The extension is limited to staff of the NSW Department of Education. Access is granted by Google sign-in with an @education.nsw.gov.au account and by an allowlist held on the server. Students cannot use it.

What stays on your computer

Student responses stay in your browser during normal marking. Extraction, marking, code execution and report rendering all happen locally, on the page you already have open and are already authorised to view.

The extension does not send student names, NESA student numbers, student answers, drawings, code submissions, spreadsheets or page content anywhere — with one exception, described under Problem reports below, which only ever happens when you actively choose it. Apart from your email address at sign-in, nothing is collected unless you report a problem.

PDF downloads

Choosing Create PDF generates a PDF on your device and saves it to Chrome's download location without a print dialog. The filename uses the student's name and NESA number when the number is present in the displayed student heading, with spaces replaced by hyphens, for example Alex-Taylor-Smith-(12345678).pdf. Unsafe filename characters are sanitized, and NESA-marking-report.pdf is used when no usable name is available. This filename is visible in Chrome's download list and on your device. The file may contain the student's name and number, responses, drawings, code, spreadsheets and official marking guidance. PDF generation uses bundled code and fonts; the report is not uploaded to a conversion service.

Choosing Print in a marking report suggests the same filename for Chrome's Save as PDF. The student heading is used temporarily as the sanitized print title; the generic report title is restored after printing or cancellation. A selected printer may also display that print-job title.

The downloads permission is used only for the PDF you requested and its completion status. Downloaded files remain on disk until you delete them. Removing the extension does not delete those files.

What is collected

Nothing is collected while you mark. The only information collected in normal use is your email address, once, when you sign in — and that is used solely to confirm you are approved staff. There is no usage tracking, no analytics and no profiling.

In normal use

Data	Why	Kept
Your email address	To confirm you are approved Department of Education staff	For the sign-in session only. Server logs record a one-way hash, not your address.

That is the complete list. No page content, no student data, no marking data and no record of what you marked or when is collected.

Only if you choose to report a problem

Nothing below is collected unless you actively submit a problem report. If you never report a problem, none of it is ever sent.

Data	Why
Your description of the problem	To understand what went wrong
Extension version, browser and operating system	To reproduce the problem
Your email address, if you are signed in	So you can be contacted about your report. Reports sent without signing in carry no address.
A random installation identifier	Only on reports sent without signing in, to prevent abuse. It is a random value and is not linked to you.
De-identified exam data — only if you separately opt in	To diagnose a marking or extraction fault. Off by default, every time.
Diagnostic URLs and recent report-page errors — only if you separately opt in	URLs, error messages, stack traces, script locations and logged object details help reproduce failures. Identifying and credential values are redacted; ordinary URL query parameters are retained.

Held in your browser, never collected

The report you are marking, the marks you enter, student responses and recent report-page diagnostics stay on your computer unless you explicitly attach their redacted form to a problem report. Your sign-in token is held in browser session storage and sent to the broker to authenticate requests. It is never included in problem-report content or diagnostic logs. Removing the extension deletes its local data.

Problem reports

If you report a problem, a report is created in a private repository so it can be diagnosed.

By default a report contains only your description of the problem and the technical details in the table above. No page data is included.
You may separately choose, for that one report, to attach de-identified exam data. This is never the default and is never remembered between reports.
Opted-in attachments retain answer text, code and recorded output, drawings, fetched spreadsheet or other linked responses, marking results, diagnostic URLs and detailed errors. Names, NESA numbers and credentials are removed, not the response content needed to diagnose the fault.
If you do choose it, the student's name, NESA student number and session details are removed, and the raw page content is replaced, before anything is sent. You are shown exactly what will be sent and must review it first.
If the removal step cannot be verified, the report is refused rather than sent.
The preview includes the redacted description and attachment, and submission uses that exact snapshot. Editing the description requires another preview. Large issue attachments are compressed losslessly rather than cut off; attachments exceeding the size limit are refused.

De-identified data is not the same as anonymous data. A student could still, in principle, be recognised from a distinctive answer. Reports are therefore kept in a private repository with restricted access, and are deleted when the problem is resolved.

What is never sent

Session credentials from the NESA site
Student names or NESA student numbers
Raw page content
Anything at all, by default, from the page you are marking

Marking data

Answer keys and marking guidelines are provided by the server when you are signed in. They are held in memory while you mark. Raw deterministic answer-key files are not exported. Official guidelines and answer diagrams are included in a local PDF when you explicitly choose Create PDF.

Third parties

Google — used to sign you in. Google receives only a standard sign-in request; it is not told anything about the exam or the student.
GitHub — hosts the private repository where problem reports are filed.

Information is not sold, rented, or used for advertising, and is not used for any purpose other than operating this tool.

Your choices

You can use the tool without ever sending page data. This is the default.
You can sign out at any time, which clears your session.
Removing the extension deletes everything it stored in your browser.
To have a problem report deleted, contact the maintainer below.

Not affiliated with NESA

This is an independent tool built by teachers at Tempe High School. It is not produced, endorsed or supported by the NSW Education Standards Authority.

Contact

Contact the maintainer at Tempe High School, or raise an issue in the project repository.