Privacy Policy

The school or district is the data controller: it holds the education records and decides how Umbrelly is used. Umbrelly is the service provider (processor), acting on the school's instructions under its agreement with the school. Where Umbrelly collects information about children under 13, it does so on the school's behalf under the school-consent model that COPPA permits for educational use.

Accounts and roster information, for every user:

• Name, email address, role (teacher, student, school admin, IT admin, parent or guardian), school and organizational unit.
• For students who require parental consent: a guardian email address and whether consent has been recorded.
• Sign-in metadata, including the time of the last sign-in.
• A profile photo, if the person chooses to add one. This is optional, never required, and there is a Remove button beside it. Nobody is given a photo by the school and none is imported from a student information system. The only way one exists is that the account holder uploaded it. It is stored in Umbrelly's own database, not on a third-party image host, and it is visible to the same people who can already see that person's name on a class or school roster.

Umbrelly does not store a student's date of birth. Where a school's student information system supplies one, it is used once to work out whether that student needs parental consent, and then discarded; only the yes/no answer is kept.

Where a school connects a student information system (Google Classroom, Clever, ClassLink, OneRoster or PowerSchool), roster data arrives from that system and is kept in step with it.

During an active class monitoring session only, Umbrelly records:

• Screen images of the student's visible browser tab, with the time of capture. This is a picture of the web page on screen, not the whole desktop, not other applications, and never the camera, the microphone or what the student types.
• Browser tab activity: the page address, page title, site, and when the tab was opened and closed. This covers every tab open in the school browser during the session, not only tabs the class is using. Reports label each site with its category, taken from the same public category lists filtering uses; this is a label on the address already recorded, not anything new collected.
• Search terms, where a page address is a web search: the words searched for. They are part of the page address already recorded above; they are named separately because reports can list them on their own.

Screen images are the most sensitive thing Umbrelly holds. Whatever is on the page is in the picture, including anything the student has typed into it. Pages the student opens outside the school browser (and files on their own device) are not captured: the software only works on ordinary web pages.

Capture is bound to the session. When the session is not active, the software does not capture screens or tabs. Students can see for themselves whether monitoring is on: that indicator is a permanent part of the student view, and there is no hidden monitoring mode.

Independently of monitoring sessions, Umbrelly records:

• Blocked web requests: the address and site a student was prevented from reaching, the category and reason, and the time.
• Focused-browsing sessions, where a teacher restricts a class to a set of sites: which sites were allowed or blocked, and when.
• Administrative audit records of significant actions taken in the software, including every change to a student's consent, and every time monitoring was refused because consent was missing.
• Device online/offline status: whether a school-managed device is powered on with the Umbrelly extension loaded and running, refreshed every few minutes. This is a presence signal only (on or off), with no page, site or search information attached to it, and it is tracked separately from screen and tab capture, which remain bound to an active session as described above.
• Extension version: the build version of the Umbrelly extension on a student's device, and the time it was last reported, kept on the student's account. Only Umbrelly staff use it, for operational support, and they see it as a count per version. It is not shown for individual students in school dashboards, but it is included when a student's data is exported on request. It is removed when the account is deleted.

Reports and dashboards. From the tab activity above, Umbrelly reports which sites, videos, documents, web apps and search terms students used (by page title and address) to teachers for their own classes, and to school and district administrators for their schools. These are counts and lists of what was visited, not judgments about it.

Class messages, in two directions: a teacher or admin may message a class, a group, or one student at any time, and a student may reply, but only from inside an active, consented monitoring session, and only to the teachers on that class. A student cannot start a conversation on their own. A teacher's own per-class toggle turns off both their own sending and their own receiving of new messages for that class; it does not remove a class's message history from the class-wide oversight view described below, which any teacher or admin who oversees the class keeps regardless of their own toggle. Every message is written to the administrative audit record above.

Hall passes. A student can ask to leave the room from the Umbrelly extension, and only while a teacher is running a live monitoring session: their own class's session, or failing that, their homeroom teacher's. Outside a live session a request goes nowhere, and there is no email or notification about it. For each pass Umbrelly records the student, where they said they were going, the optional note they typed (up to 80 characters), the class session it went to, when it was requested, when it started and ended, the time allowed, which teacher approved, denied or ended it, and why it ended (the student came back, the teacher ended it, it was denied or cancelled, nobody answered within 5 minutes, the class session ended, or the front office signed the student out or closed the pass). For a pass to the office, Umbrelly also records when the front office checked the student in and when it sent them back to class, and which staff member did each. A note a teacher adds when saying no is shown to the student and is not stored. Every change to a pass is written to the administrative audit record above. A pass does not pause or change monitoring or filtering: they keep running while the student is out of the room.

Calls to the office. The front office can ask a student's teacher to send the student to the office, only while the student's own class is in a live monitoring session. For each call Umbrelly records the student, the class session, whether it is an early dismissal or anything else, an optional note from the office to the teacher (up to 80 characters), who asked and when, and how it ended: the teacher sent the student, the office checked the student in, the teacher replied that it isn't a good moment with a short reason the office sees (not possible for an early dismissal), nobody answered within 5 minutes, the class ended, or the office cancelled it. The student is told nothing until the student is sent; their pass then says the office asked for them. The office's note and the teacher's reason are staff-to-staff and are never shown to the student or included in the student's data download; everything else about the call is. Every change to a call is written to the administrative audit record above.

Expected early pickups. When a parent or guardian tells the school they are coming, the front office can log it: the student, the day and time, who is picking the student up (up to 80 characters), and an optional office note (up to 120 characters). Nothing is sent to anyone when a pickup is logged. When the adult arrives, the office calls the student through the teacher (see "Calls to the office"); that call tells the teacher only the pickup time. Who is picking the student up and the office note are seen by front office staff only: never by teachers or students, and they are left out of the student's data download (the pickup's time and outcome are included). Umbrelly records whether the pickup happened, was cancelled, or lapsed at the end of the day, and every change is written to the administrative audit record above.

Until September 2026 this policy said Umbrelly performed no analysis of a student's activity. That is changing. The two capabilities below are approved. Each is off until a school or district turns it on, each says here whether it is available yet, and this section is updated in the same release that changes either one.

• Off-Task, for teachers during a class. Not yet available. While a monitoring session is running, Umbrelly compares the site a student is on with the categories of sites expected for the class's subject, which the teacher sets, and once the student has been on an unrelated site for longer than a threshold the teacher chooses (30 seconds by default) shows that teacher the student's name, the time elapsed and the site. It works from the site's category, never from the page's text or the screen image; it is offered only for subjects whose site categories are reliable; it is shown only to the teachers running that session; and it keeps no record beyond the tab activity above.
• Safety alerts, for staff a district names. Built, and off for every district. A district can turn it on only after it has signed a data processing agreement that covers Anthropic, the AI provider (see "Where the data lives"), as a subprocessor and has completed a notice to families. If a district turns it on, Umbrelly sends two kinds of text to Anthropic: the words of a web search a student makes during a monitoring session, and the text of a class message a student sends to staff. Only that text is sent. No school document, no page a student reads and no screen image is sent. Anthropic returns a signal (self-harm, cyberbullying, violence, depression, anxiety, substance abuse, eating disorder, or none) and a confidence. Nothing below the district's confidence threshold becomes an alert. An alert goes to the staff the district has named for it, never to the student, to a teacher who is not named, or to a guardian. A named person decides what happens next, and nothing acts on a student automatically. A staff member who opens the screen image attached to an alert sees a warning first, and that view is recorded. Alerts are kept for the periods under "How long it is kept".

What does not change: neither capability scores or ranks students for any other purpose, neither feeds advertising, and screen images are never sent to an AI service.

Built, and off for every district. A district can turn on AI help for its web filter. When it is on, Umbrelly uses a third-party AI service provider to classify publicly available web content that Umbrelly's own servers fetch from the public web: a site's public description, and the public titles of videos and posts. The provider is also sent the bare website names (the domain only, such as example.com, never a full page address) of commonly visited sites that students reach. A site counts as commonly visited only if it is widely used across the web or several different students have reached it. The provider returns a category for a site, whether a site or title fits a class subject such as "Math", or whether a video looks suitable for school.

The provider is never sent student records, account identifiers, page contents, or anything students type, such as searches, messages or the reason given in an access request. It is not told which school or district a request comes from. Before anything is sent, it is checked against the school's roster and held back if it matches a student's or staff member's name. Public content can still occasionally mention a person, for example in the title of a popular video, so that check lowers the chance but cannot rule it out.

To get that public content, Umbrelly's servers fetch it themselves from the websites, from YouTube and from Reddit. Those requests carry no student names, accounts or cookies.

To decide what to classify, Umbrelly briefly holds which site, video or post a student reached. That record is encrypted and becomes unreadable after at most about an hour, including in backups. To count how many different students reached a site, Umbrelly keeps coded counts that do not contain a student's name or account, for at most 60 days. Both stay inside Umbrelly and are never sent to the provider.

The results describe content, not students, and a popular site is classified once for all of Umbrelly. AI help can add a block or tell a teacher a site looks unrelated to the class. It never removes a block, and it never approves or denies an access request. It is off by default: a district administrator turns it on, only for schools whose agreement with Umbrelly covers it, and can turn it off at any time. A district can ask for the provider's name under its agreement with Umbrelly.

These are statements about the current software, not promises about intent. The section above lists the two approved capabilities and whether each is available.

• No advertising, and no sale of personal information. Student data is never sold, rented, or used to target advertising.
• No third-party analytics or tracking. The application loads no analytics, advertising or session-replay services.
• No AI processing of student data except the safety-alert check. Apart from that check, described above and only where a district has turned it on, no student data is sent to any AI service, and nothing in the software scores or profiles a student. AI help with filtering, also described above, sends public web content and the names of commonly visited sites, never student records or anything a student types.
• No content capture outside an active session. Screen and tab capture happen only while a session the student can see is running. Whether a device is on and the extension is loaded (a presence signal with no page or site content attached) is visible at any time; see "What Umbrelly collects" above.
• No reading of what students write or read, except for safety alerts. Off-Task works from a site's category, not its content. Only the safety-alert check reads text, only the search words and class messages named above, only for the risk signals named above, and only where a district has turned it on. It never reads school documents or the pages a student reads.
• No access to files on the student's own device. The extension does not run on local files, and local file paths are never sent to Umbrelly.

Umbrelly can be told that a particular student needs a parent's consent before being monitored. When a student is marked that way and no consent has been recorded, the software refuses to monitor them. That check is not a setting in a menu that someone can forget to switch on: it runs again on every single capture, and if it cannot confirm consent (including if it cannot identify the student at all), it refuses. Every refusal is written to the audit record, so a school can show that it worked.

Consent can be withdrawn at any time by a school administrator, and monitoring of that student stops within seconds.

One limitation parents should know about. Umbrelly does not work out by itself which students are under 13. A student is only marked as needing consent when the school marks them, either by syncing a student roster that includes ages, or by setting it by hand. Until a school does that, Umbrelly treats a student as not needing parental consent and will monitor them. So the protection above is real and strictly enforced, but it only covers the students a school has actually marked. If you want to know whether your child has been marked, ask your school. They can see it and change it, and Umbrelly cannot answer for them.

Screen images are stored inline in Umbrelly's own database rather than on a third-party image host or object store. Practically, that means student imagery does not travel to an outside storage provider. The database and application are hosted on Umbrelly's infrastructure providers, who process data on Umbrelly's instructions and have no independent right to use it.

One exception, tied to the safety-alert check above. When a district turns it on, the text being checked (search words and class messages a student sends to staff) is sent to Anthropic, the AI provider, under a data processing agreement that restricts the text to returning the classification and forbids any other use, including training. Screen images are never sent. Until a district turns the check on, no student text is sent to any AI service. AI help with filtering, described above, is separate: it sends only the public web content and website names described there.

All traffic between the browser, the extension and Umbrelly is encrypted in transit.

Access follows the school's own structure, and the software enforces it server-side rather than merely hiding things in the interface:

• Teachers see students in their own classes, and screen captures only for a session they are running. Device online/offline status for their own students is visible at any time, not only during a session. For messages, a teacher sees every message on a class they teach, in either direction, not only messages addressed to them personally.
• School administrators see their own school. District administrators see the schools in their district. Both get the same class-wide view of messages as a teacher, for any class they oversee, and the same always-visible device online/offline status for students in their school or district.
• Hall passes: requests and passes out of the room appear to the teachers of the class session the request went to, while that session is live, and afterwards in that session's details. Administrators who oversee the school see the school's pass log and each session's passes. They can read passes but cannot approve them as administrators. A student sees only their own pass, in the extension.
• Front office staff see hall passes whose destination is the office, for students in their own school, across every class, and closed ones for the rest of the day. They can record that a student arrived at the office, sign a student out (which ends the pass), or send them back to class; each of these is recorded with who did it and when. They can also find a student in their school by name, see which class is live for that student right now, and start a pass for a student who comes to the desk without one (sending them to class, or checking them in at the office); that is recorded with who did it and when. They can call a student to the office through the teacher of the student's live class (see "Calls to the office"); that teacher sees the call and the office's note. They can log expected early pickups, including who is coming (see "Expected early pickups"); only front office staff see that. They can also see which classes in their school are in session right now, the roster of each of those classes with whether each student is online, and whether a student is out of the room: the destination is shown only for office passes, and any other pass shows only as "Out of room" with how long. They can open a student card (homeroom, the current and next class, today's office passes, and open calls and pickups); each card opened is recorded with who opened it and when. Office staff do not see screens, tabs, browsing, messages, reports, or where a student went on any other hall pass. Administrators who cover the front desk see the same view.
• Guardians see their own linked child's blocked-site history, and nothing about any other student. The parent portal does not display messages or hall passes; they are included in the data download for a linked child.
• Safety-alert staff named by the district see the alerts routed to them, and only those. Alerts are not shown to teachers who are not named, to students, or in the parent portal.
• Students see their own monitoring status and what is collected about them, and only the messages they personally sent or received, never a class's full message history.

Screen captures are delivered only to staff views for the running session; they are never broadcast to student views.

Umbrelly deletes student monitoring data automatically, on a schedule, rather than keeping it until somebody remembers to remove it. Each kind of record has its own window, because a screen image and an audit record are not equally sensitive and should not live equally long:

Those are the defaults. A school can set its own windows in its agreement with Umbrelly, and a district that needs data held for a shorter or longer period can have that instead. The deletion runs on its own several times a day and is permanent: deleted records are not moved to an archive that somebody could read later.

One exception, and it is deliberate. If a school places a record on legal hold (because of a safeguarding investigation, a records request, or a legal matter), that student's data stops being deleted for as long as the hold lasts, and the account cannot be erased either. A hold has an end date, so it lapses on its own rather than quietly preserving data forever, and who placed it and why is recorded.

When a school confirms an account deletion, the account and its records are erased immediately. There is no waiting period and the deletion cannot be undone. Before confirming, an authorized administrator sees which records will be removed and must type the account's email address. Records under an active legal hold cannot be deleted.

A school can also deactivate an account instead of deleting it. That switches off access and destroys nothing, which is usually the right answer when a student transfers or a staff member is on leave, and it can be reversed at any time.

Separately, a school district can place a records hold on an account, usually because of a legal matter or an open records request. While a hold is in place the records cannot be deleted, by anyone, including by a scheduled deletion that has already been ordered. A hold does not change who can see the records or what is collected; it only prevents their destruction.

Under FERPA, guardians (and eligible students) may review the education records a school holds, and ask for corrections. Depending on where a family lives, other rights may apply, including access, correction, deletion and a copy of the data in a portable format.

Requests go to the school first. Because the school is the controller, guardians should contact their school or district; the school can act directly in Umbrelly, and Umbrelly assists the school on request. Umbrelly does not release student records directly to a requester without the school's instruction, because it cannot verify a family relationship that only the school can confirm.

Monitoring and filtering rely on a Chrome extension that a school deploys to managed devices. The extension observes navigation in order to apply the school's filtering policy and, during an active session, to send screen and tab information. It is installed and removed by the school through device management, not by the student.

The extension runs only on ordinary web pages. It does not run on local files or on the browser's own internal pages, and it does not read network requests. Chrome requires broad site access for the screen-capture feature specifically; that access is limited in practice by the consent check above and by the fact that capture only happens during a session the student can see.

Material changes will be communicated to the schools that use Umbrelly. The date at the top of this page always reflects the current version.

Guardians and students: contact your school or district administrator, who can act on your request directly.

Schools, districts and privacy officers: contact Umbrelly through the address on your agreement, or through your Umbrelly representative.

A dedicated privacy contact address will be published here once support routing is in place.