Tally
for reviewers, districts, and IT

Data safety & compliance

Everything a Google OAuth reviewer, a district security team, or an IT director needs to evaluate Tally — in one place, matched to the actual code, not aspirational copy.

One AI provider, disclosed

Tally uses a single model provider today — Anthropic's Claude — for both short-answer and essay grading. We are not claiming multi-model support we haven't built. Anthropic's own data-handling commitments for API usage (no training on API inputs/outputs by default, defined retention windows) apply directly to every grading call Tally makes; see Anthropic's privacy policy for their terms. If Tally adds providers later, this page will name them and this claim will be updated first.

Scope-by-scope justification

classroom.courses.readonly
List the teacher's active courses so they can pick which one to grade.
classroom.coursework.students
Read assignment details and post draft grades — Tally never returns a grade to a student; only the teacher does, in Classroom.
classroom.rosters.readonly
Resolve student names locally in the browser so the teacher sees who's who — this data never leaves the client.
classroom.profile.emails
Only used to confirm the signed-in account matches a Classroom teacher role; never sent to the grading server.

Where Google user data goes (and doesn't)

Classroom API calls → made client-side, in the extension, with your own OAuth token. Never touch Tally's server.
Answer text → stripped of name/email/course/submission ID, paired with a random local id, sent to Tally's grading server.
Tally's grading server → holds the Claude API key, reads only the rubric + anonymized text, replies, discards.
Grade + feedback → returned to your browser, rejoined to the real student by the local random id.
Draft grade → posted to Classroom by the extension, using your OAuth token — again, never through Tally's server.

Full technical design: see the grading proxy architecture — the rule enforced in code, not just policy: any request containing a name, email, or Classroom ID is rejected before processing.

Limited Use disclosure

Tally's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • Google user data is used only to provide and improve Tally's own grading features, not for advertising.
  • Google user data is not transferred to any third party except as necessary to grade an answer (anonymized, to our model provider) or to comply with law.
  • No human reads Google user data except for debugging with your explicit consent, security incidents, or legal compliance.

Education law compliance

FERPA
Tally acts as a school official under the district's direct control, per standard FERPA guidance for ed-tech vendors. DPA available on request.
COPPA
No account creation by students; Tally is teacher-facing only, so direct-collection provisions don't attach here. District-level consent agreements are supported. Under 2025 amendments, no implied consent for advertising is claimed or used.
SOPIPA / state laws
No sale of student data, no targeted advertising, no profile building — consistent with California SOPIPA and similar statutes in Illinois, New York, and Texas.
Student Privacy Pledge
Tally intends to sign the Student Privacy Pledge prior to public launch.

Subprocessors

The complete list of third parties involved in delivering Tally. We will publish 30 days' notice before adding any subprocessor that touches grading data.

Anthropic (Claude API)AI grading
Anonymized answer text and the teacher's rubric only. No student name, email, or Classroom identifier is ever transmitted. Not used for model training.
Cloudflare WorkersGrading proxy hosting
Transits the same anonymized payload. Holds the provider API key. No persistent storage of answer text.
Cloudflare KVUsage metering + rubric storage
Monthly submission counts keyed to a random install id, and teacher-authored rubrics. No student data.
Google Classroom APISource of record
Called directly from the teacher's browser with their own OAuth token — Tally's infrastructure is not an intermediary.

Retention schedule

Student answer textNot retained — in memory only
Grades and feedbackNot retained — returned to browser, then discarded
Student names, emails, Classroom IDsNever received by Tally's servers
Grading checkpoints (resume after interruption)Local to the browser; cleared when the run completes
Teacher-created rubricsUntil the teacher deletes them, or 30 days after a deletion request
Usage counters (anonymous install id)40 days, then auto-expired
Server error logsNo answer content logged; operational metadata only

Security controls

Encryption in transit
TLS 1.2+ on every connection between the extension, Tally's proxy, and the model provider.
Encryption at rest
Rubrics and usage counters are stored encrypted at rest by the hosting platform.
Key management
Provider API keys live only as platform secrets, never in extension code or client storage.
Input validation
The grading endpoint rejects any request containing a name, email, or Classroom ID field before processing it.
Least privilege scopes
Only the four Classroom scopes needed to list, read, and post drafts. No Drive, no Gmail, no Sheets.
No remote code execution
Manifest V3 with no eval, no remotely-loaded scripts, and a single allowed host — Tally's own proxy.

AI-specific disclosures

→
Which model grades student work?
Anthropic's Claude, for both short answers and essays. Tally uses a single provider today and will name any additional provider here before adding it.
→
Is student work used to train the model?
No. Anthropic does not train on API inputs or outputs by default, and Tally does not opt into any program that would change that.
→
Can the AI assign a final grade?
No. Every score posts to Classroom as a draft. A teacher reviews and returns it; nothing reaches a student otherwise.
→
How are uncertain answers handled?
Blank, off-topic, borderline, and partially-correct answers are flagged for teacher review rather than being silently scored.
→
What about AI-detection results?
Originality checks are advisory only and surfaced with their reasoning. Tally never auto-penalizes a student based on one.

Incident response & deletion

Breach notification. In the event of a confirmed security incident affecting district data, Tally will notify affected districts without undue delay and no later than 72 hours from confirmation, with the scope, the data categories involved, and remediation steps taken.

Deletion on request. Because no student data is retained after a grading run, there is typically nothing to delete. Teacher-created rubrics and account records are deleted within 30 days of a district or teacher request, or contract termination.

Revoking access. A teacher can revoke Tally's Google access at any time from their own Google Account permissions page. Access stops immediately; no server-side action by Tally is required or possible to prevent it.

Questions districts ask

Do you sign a Data Processing Agreement?
Yes — see our DPA terms. A district DPA is available on request, and Tally will execute district-specific agreements including state-mandated addenda.
Where is data processed?
Grading requests are processed on edge infrastructure in the United States. No student identity is present in those requests.
Can we pilot before signing anything?
Yes. Because Tally uses your existing Google Workspace accounts and stores no student data, a single-teacher pilot requires no procurement action.
What happens if Tally shuts down?
Nothing is stranded. Grades already live in your Classroom gradebook, and there is no student data held by Tally to migrate or delete.
Does Tally see our whole Google Workspace?
No. Only Classroom courses where the signed-in teacher is the teacher of record, and only the assignments they choose to grade.
Who can we contact for a security review?
help@gradewithtally.com — architecture notes, threat model, and subprocessor details are available to district reviewers.

For Google Workspace admins

Deploy Tally to every teacher in your domain without asking any of them to install anything — and pre-approve the OAuth scopes so no teacher ever sees a consent screen.

1
Force-install Tally for the OUs you choose
Add Tally by its Chrome Web Store extension ID and set installation policy to "Force install." Teachers in those OUs get it automatically, already pinned — no action on their part.
Admin console → Devices → Chrome → Apps & extensions → Users & browsers
2
Pre-approve the OAuth scopes
Add Tally's OAuth client ID to your API-controls trusted-app list with its three Classroom scopes. This suppresses the individual consent screen — teachers never have to decide on data access themselves.
Admin console → Security → Access and data control → API controls → Manage third-party app access
3
Scope it to a pilot group first
Apply the policy to a single OU — one department, one building — before a domain-wide rollout. Same policy, narrower target; move it up a level when you're satisfied.
4
Revoke from one place, any time
Removing Tally from the trusted-app list immediately cuts all Classroom access domain-wide, regardless of what any individual teacher previously approved.
Why this is the better path

Chrome removed inline installation in 2018 — no website can install an extension directly, including ours. Individually, a teacher clicks "Add to Chrome" on the Web Store and approves the scopes themselves.

Force-install skips both steps: Tally appears already installed and already authorized, the district controls exactly which OUs get it, and access can be revoked domain-wide from one place. It also means no teacher is individually consenting to data scopes on the district's behalf.

For security reviewers

Because Google-scoped student data never reaches Tally's backend, our infrastructure is not in scope for a Google API Services security assessment (CASA) — that boundary is enforced by code-level validation, not policy alone. Google's own trigger for CASA is whether a server has the capability to access restricted-scope data, not just whether it does; Tally's grading server has no code path that can receive a Google identity at all. Full architecture and threat-model notes are available on request.

Tally is teacher-facing only — students never sign in or interact with Tally directly, which keeps COPPA's direct-collection-from-children provisions out of scope; any parental-consent obligation is handled at the district level, as with other classroom tools.

Security or DPA requests: help@gradewithtally.com