Privacy Policy for the TeachAIFlow Trace extension

TeachAIFlow Trace is a Chrome and Edge extension that records your conversations with the AI assistants listed in section 13 (and with TeachAIFlow's Flow chat) so you can cite them in your assignments with a sealed reference your teacher can verify, and check your own work before you hand it in.

• Without signing in it records nothing. It only records once you have signed in with your TeachAIFlow account and the “Recording” switch is on.
• What it records stays in your browser, in the extension's local storage. It is not sent to any server and we cannot see it. Captures are deleted automatically after 48 hours.
• From each AI reply it also keeps “private fingerprints”: codes computed with a key that exists only in your browser, with no text, used to check your work. They do not leave the browser either. They last 180 days by default (you can choose 90 or 365) and are not deleted when you sign out; they are deleted with “Delete fingerprints”, “Delete all”, when another account signs in, or when you uninstall.
• The only thing that leaves your browser is what you choose to seal by pressing “Reference”: that snapshot is stored on our server, in the European Union, with your name and email, for 12 months or until you delete it.
• If you certify a document (“Trace Verified”), our server receives the PDF's hash and the figures of the check, never its text or the file name.
• A reference or a certification can be seen by anyone who holds its code and is signed in with a TeachAIFlow account. Only you hand out that code, by pasting it into your assignment or into the PDF.
• The extension uses no artificial intelligence, makes no automated decisions, carries no analytics or third-party cookies, reads no website outside the list in section 13, and we do not sell data.

The data controller is Javier Tur Murcia (Spanish tax ID 43223966C), Carrer des Canari 7, 07141 Sa Cabana, Illes Balears (España), operator of TeachAIFlow (Arts. 4(7) and 13(1)(a) GDPR). Contact for privacy matters and rights requests: teachaiflowapp@gmail.com.

This policy is specific to the extension and applies together with the general Privacy Policy, the Terms of Service and the Legal Notice of TeachAIFlow. Anything not covered here (account, billing, website cookies) is governed by those pages.

If your university or school deploys the extension for its students and decides what the references or certifications are used for, that institution is the controller of that processing and TeachAIFlow acts as its processor under the contract required by Art. 28(3) GDPR. If you install it on your own, we are the controller.

It applies to anyone who installs the extension and creates or uses a TeachAIFlow account from its panel (usually university students) and to anyone who looks up a reference or a certification with its code (usually teachers), who also needs a TeachAIFlow account.

To create an account you must be at least 14 years old (Art. 7 of the Spanish LOPDGDD). When you sign up you declare your date of birth and we check it before the extension is allowed to record. Between 14 and 17 you may use the extension with a free account, under the same rules as on the website: you cannot purchase the PRO plan and you receive no profiling-based advertising.

Under 14: you cannot sign up on your own. Students below that age can only use TeachAIFlow through a school that has contracted the service and governs their accounts, with the school as controller. The extension is not designed for that channel and blocks anyone who declares an age under 14.

When you are signed in and recording is on, an extension script runs only on the websites in section 13 and stores in the extension's local storage (chrome.storage.local):

• The prompts you write to the AI assistant: the text of the input box at the moment you send it.
• The assistant's replies, as they appear on the page or as they arrive over that same website's connection.
• What you copy from a reply, so the citation can show what you used verbatim. It is detected inside the AI page itself; the extension does not read the system clipboard.
• Context data: assistant, conversation identifier from its URL, date and time, and whether a reply was regenerated.
• Private fingerprints of each AI reply (see section 6): 64-bit codes, with no text, together with the assistant, the date, the reply's word count and the position of each fragment. They include neither your prompt nor the conversation's address.
• Your session: a device token (never your password) plus your name and email to show them in the panel.
• An installation identifier: a random number the extension generates the first time it runs, which says nothing about you on its own and is only lost when you uninstall it (see section 5).
• The result of your latest document checks (figures only, never the text; five at most), so you can certify the one you have just checked.

This data does not leave your browser, except for what section 5 lists. TeachAIFlow cannot access it: there is no sync, no backup and no telemetry.

Captures: they are deleted automatically after 48 hours, with a cap of 3,000, and immediately when you sign out, unlink the device from the website, press “Delete all” or uninstall the extension. Signing out also empties that browser's list of references (your sealed references stay in your account, on the website).

Private fingerprints: they have their own period, 180 days from each reply (you can choose 90, 180 or 365 in the panel). Signing out or unlinking the device does NOT delete them: they stay tied to your account, so that the evidence cannot be emptied just before checking an assignment, and they work again if you sign back in with the same account. They are deleted with “Delete fingerprints”, with “Delete all”, when you delete the conversation or turn they come from, when another account signs in on that browser, and when you uninstall the extension.

The only thing the extension checks when you open the panel is the codes of your already sealed references (never the captures or the fingerprints), to remove from the list the ones you deleted from another device or from the website.

Not captured: voice, generated images, the content of files you upload to the assistant, or anything from other tabs or other websites.

Only the following data reaches our server (teachaiflow.com, hosted in the European Union):

• Account: name, email, password (stored only as a hash), date of birth, language, and the date and version of your acceptance of the Terms and the Privacy Policy. If you choose “Continue with Google”, we receive from Google your name, verified email and an account identifier; nothing else.
• Email verification: when you create the account we send a 6-digit code to your address.
• Device token: when you sign in from the panel, the server issues a token for that browser. We store only its SHA-256 hash, a label derived from browser and operating system (“Chrome on Windows”) and the creation, last-use, expiry and revocation dates. We store neither the full User-Agent nor an IP address linked to the token.
• Installation identifier: it travels with every request the extension makes to our server (X-TF-Install header) and is stored with the token. It lets us know that two sessions of the same browser are the same browser, so that checking an assignment does not wrongly warn you about “another device”.
• Date of your fingerprints: the extension reports up to which date that browser keeps fingerprints; only that date, not how many or of what. It does so when fingerprints are created or deleted, and refreshes it every 6 hours while the extension is in use. With it, the checker in another browser of your account knows whether this one holds evidence that the other lacks.
• Uninstall notice: when you uninstall the extension, the browser opens a teachaiflow.com address carrying the installation identifier (not the token). The server revokes that installation's tokens and takes you to the home page.
• Sealed references: when you press “Reference” you choose what to send (a whole conversation or only the turns you tick). The server receives that snapshot (selected prompts, replies and copies, with assistant and dates), computes its SHA-256 hash and the TF-XXXX-XXXX code, records the sealing date and time together with your name and email as they appear in your account at that moment, and stores it all in the ext_references table. The hash covers the content; who sealed it is fixed by the server from your token.
• Document checks and certifications: the codes of the references your document cites and, only if you decide to certify it, the PDF's hash and the figures of the check. Details in section 6.
• Access log: when someone signed in opens a reference or a certification that is not theirs, or checks an assignment against it, we record which account did so, which code it looked up and when.
• Technical security logs: our hosting transiently records the IP address and time of each request to limit abuse (requests per minute) and detect incidents. They are not linked to your profile or used for anything else.

Each reference is an independent snapshot: if you delete the captures or fingerprints in your browser, the sealed reference stays in your account; if you delete the reference, the server removes it and the code stops working. The same applies to certifications.

Per-account quota: up to 200 MB of stored references, 300 new references per month, 200 stored certifications and 50 new ones per month, plus per-minute request limits. Deleting frees stored space; the month's creations are not given back when you delete. Quotas limit how much we keep about you; they do not extend any retention period.

At teachaiflow.com/account/extension/verificar you can check an assignment before handing it in: the page points out passages that match, word for word, AI replies your browser recorded and that are not covered by a reference you cite. This is how it works:

• What a fingerprint is: from each AI reply, the extension takes runs of 5 consecutive words, computes a 64-bit code for each one with a secret key (SipHash) that is generated in your browser and exists only there, and keeps a selection of those codes (winnowing). It does not keep the text and, without the key, the codes are useless. The key is deleted together with the fingerprints.
• The document is read in your browser (PDF, Word or text; if a PDF is scanned, text recognition also runs in your browser). Neither the file nor its text is sent to our server. The comparison is done by the extension against your fingerprints, which never leave it.
• The server is only asked for: the content of the TF references your document cites (the same anyone with the code sees), to check they are still intact and to discount what is already referenced; and which other browsers of your account hold current fingerprints, to warn you that the result would be incomplete.
• Certifying (“Trace Verified”) is optional and only possible with a verified result, a PDF and at least 100 words. If you press “Certify”, the server generates a TV-XXXXX-XXXXX code, the page adds it as a mark on the last page of the PDF, and we store in the ext_verifications table: the code, your name and email, the SHA-256 hash of the marked PDF, the document type, the word count, the number of replies it was compared with, the fingerprint duration you chose, since when that browser has had fingerprints and when it was linked, the TF codes cited, the method's version and parameters, and the dates. We do not store the text, the file name or the fingerprints.
• Anyone who holds the TV code and a TeachAIFlow account sees your name (or, if your account has no name, your masked email), the date, those figures, the codes cited and the hash, and can check that the file they received is the certified one: the hash is computed in their browser and the file is not uploaded.

What it means and what it does not: “Trace Verified” says that the AI use this browser could observe is traced in the document. It does not prove that no AI was used on another device, in another browser or with recording paused, and it does not prove authorship. It is a tool-assisted statement, not a cryptographic proof of the content.

A certification that is started but not completed is discarded after one hour. Completed ones are kept for 12 months or until you delete them at teachaiflow.com/account/extension, section “My certifications”.

• It does not read or run on any website outside the list in section 13. It has no browser permission to do so.
• It uses no artificial intelligence at any point, neither our own nor third-party. TeachAIFlow sends nothing captured, sealed or checked to any AI provider. What you write to the assistant is received by that assistant under its own policy, not ours.
• It carries no analytics, pixels, third-party cookies or advertising. It does not measure how you use it.
• It does not capture your passwords for the assistants, for Google or for any other website. It only reads the content of the conversation.
• It does not upload your documents: the checker reads them in your browser.
• It does not sell personal data, does not share it with third parties for their own purposes, and does not use it for purposes other than those described on this page.
• It records nothing without a signed-in session and, when it records, it shows it: a red dot on the icon and a “Recording” switch in the panel.

Each purpose rests on a basis under Art. 6(1) GDPR (and, where it is consent, on Arts. 4(11) and 7 GDPR and Art. 6 LOPDGDD):

• Creating and maintaining your account, verifying your email, issuing and checking the device token, sealing the reference you send us and resolving the references cited by the document you check: performance of the contract you accept when signing up (Art. 6(1)(b) GDPR). Without this data the service cannot be provided.
• Capturing conversations and computing their private fingerprints in your browser: your consent (Art. 6(1)(a) GDPR), given when you sign in from the panel, where this policy is presented, and maintained while the “Recording” switch is on. Storage on your device is further covered by Art. 22(2) of the Spanish LSSI, as a service you have expressly requested. You may withdraw it at any time: pausing recording stops capture; signing out deletes the captures; “Delete fingerprints” or “Delete all” delete the fingerprints; uninstalling the extension deletes everything.
• Installation identifier, fingerprint date and uninstall notice: performance of the contract (Art. 6(1)(b) GDPR), because without them the checker would raise false “another device” warnings or miss a real one, and legitimate interest (Art. 6(1)(f) GDPR) in not leaving tokens active for browsers where the extension is gone. The identifier is stored on your device under the same Art. 22(2) LSSI: it is strictly necessary for the service you request.
• Publishing the reference to whoever holds the code, with your name and email: your consent (Art. 6(1)(a) GDPR), given by the express act of pressing “Reference” after seeing what you are about to seal. Withdrawing it means deleting the reference (Art. 7(3) GDPR): the code stops working, without affecting the lawfulness of earlier access.
• Certifying a document and showing the certification to whoever holds the TV code: your consent (Art. 6(1)(a) GDPR), given by pressing “Certify”. Withdrawing it means deleting the certification.
• Showing the reference or certification to whoever enters the code and checking the assignment they upload: legitimate interest (Art. 6(1)(f) GDPR) of the teacher in verifying a citation the student handed over, and of the student in having a verifiable citation. It is minimal processing: access requires the code you hand out and an identified account, the uploaded assignment is processed in memory and discarded, and there is no profiling.
• Access log: legitimate interest (Art. 6(1)(f) GDPR) in protecting the student's data against improper access (for example, someone trying codes at random) and in being able to investigate abuse.
• Checking the minimum age and keeping proof of your acceptance: compliance with legal obligations (Art. 6(1)(c) GDPR; Arts. 6 and 7 LOPDGDD).
• Service security (rate limits, technical logs, token revocation): legitimate interest (Art. 6(1)(f) GDPR) in protecting the platform and its users, and the security duty under Art. 32 GDPR.

Where the basis is legitimate interest, you may object by writing to us (Art. 21 GDPR); we will assess each case.

You decide what gets sealed: the whole conversation or only the turns you tick. Before sealing, the panel shows you exactly what will be sent.

You hand out the TF-XXXX-XXXX code yourself, by pasting it into your assignment. It is not published in any listing, the reference page is not indexed by search engines, and the code cannot be guessed: it is derived from the hash of the content.

Opening teachaiflow.com/ref/<code> requires signing in with a TeachAIFlow account (student or teacher). Whoever opens it sees that the reference is authentic, the sealing date and time, the assistant used, your name, your MASKED email (for example a•••••@uib.es: the first letter and the domain) and the content you chose to seal. That is enough for the teacher to confirm the reference belongs to whoever signs the assignment, without your full address being available to anyone holding the code. Only you see your full email, in your panel and with your session open.

The teacher may also upload the assignment (PDF, Word or text) so the server marks which passages are verbatim from the reference. That assignment is processed in memory and not stored: no copy remains at TeachAIFlow. If the PDF is scanned, its text is recognised in the teacher's browser and only the text is sent.

With a TV-XXXXX-XXXXX code they see what section 6 describes: the certification, not your conversation or your document.

Every lookup of someone else's code is logged with the account that made it (section 5). If you believe someone accessed your reference without reason, write to us.

If the teacher belongs to a university or school, that institution handles the result under its own assessment rules. TeachAIFlow plays no part in grading.

We apply the storage-limitation principle (Art. 5(1)(e) GDPR):

• Captures in your browser: 48 hours from capture, or up to 3,000 captures; sooner if you sign out, unlink the device, press “Delete all” or uninstall.
• Private fingerprints in your browser: 180 days from each reply (or 90 or 365, as you choose); sooner if you press “Delete fingerprints” or “Delete all”, delete the conversation or turn, another account signs in on that browser, or you uninstall. Signing out does not delete them.
• Installation identifier: in your browser, until you uninstall the extension; on the server, together with the token it accompanies.
• Sealed references: 12 months from sealing (the academic year in which you submit the assignment, with its defence, reviews and appeals), or until you delete it. After that period an automatic purge removes it from the server.
• Certifications: 12 months from certification, or until you delete it; uncompleted ones, one hour. After that period an automatic purge removes them.
• Device tokens (with the fingerprint date and the installation identifier): 12 months from issue, or until you sign out, revoke it from /account/extension or uninstall the extension. A revoked or expired token stops working immediately and an automatic purge removes it.
• Access log: kept with the usage records of the account that made the lookup, as set out in the general Privacy Policy, and deleted with that account.
• Account data: for as long as the account exists, as set out in the general Privacy Policy. Deleting the account deletes its tokens, references and certifications.
• Technical security logs: a short period, the one the hosting provider needs to operate and troubleshoot incidents.

We do not share your data with third parties for their own purposes. To operate the extension we use only the following processors, under contracts compliant with Art. 28(3) GDPR:

• Vercel: hosting and execution of the teachaiflow.com server. It handles the extension's requests and serves the /ref pages and the checker page.
• Neon: the PostgreSQL database holding your account, the tokens (hash only), the sealed references, the certifications and the access log.
• Resend: delivery of the email containing the verification code when you create the account. It receives your email address and the code.

TeachAIFlow's server (Vercel functions) and database (Neon) run in Frankfurt, Germany (eu-central-1 region), inside the European Union; only the website's static content (pages, scripts, images, no personal data) is delivered from Vercel's global network. These providers are companies headquartered in the United States: any access from outside the European Economic Area (for example, technical support) is covered by the European Commission's standard contractual clauses incorporated into their processing agreements (Art. 46(2)(c) GDPR).

If you choose “Continue with Google”, Google handles your sign-in as an independent controller under its own privacy policy. We receive from Google only your name, verified email and an identifier.

The AI assistants you talk to (OpenAI, Anthropic, Google, xAI, DeepSeek) are independent controllers of what you send them. The extension sends them nothing extra and does not alter what you write.

We may disclose data to public authorities when the law requires it (Art. 6(1)(c) GDPR). There is no other recipient: the extension has no analytics, advertising or AI providers.

You have the rights set out in Arts. 15 to 22 GDPR and Arts. 12 to 18 LOPDGDD: access, rectification, erasure, restriction, portability, objection and withdrawal of consent. The most useful ones are already built into the product:

• Delete a reference: in the extension panel (“Delete” button) or at teachaiflow.com/account/extension, section “My references”. It is removed from the server and the code stops working.
• Delete a certification: at teachaiflow.com/account/extension, section “My certifications”. It is removed from the server and the TV code stops working.
• Sign out or unlink a device: from the panel (“Sign out”) or from /account/extension, section “Linked devices”. The token is revoked and the captures in that browser are deleted. The private fingerprints stay, tied to your account: delete them with “Delete fingerprints” if you do not want them.
• Delete the fingerprints or change how long they last: in the panel, “Delete fingerprints” and the duration (90, 180 or 365 days).
• Delete everything local (captures, fingerprints and check results): “Delete all” button in the panel, or uninstall the extension.
• Portability (Art. 20 GDPR): “Export” in the panel downloads your captures and references as JSON; “Download” does the same for a single reference. Fingerprints are not exported because they contain nothing readable.
• See what we hold about you: at /account/extension you can see your linked devices, your references and your certifications, with their code and hash.

For any other request (full access, including the log of who has looked up your codes; rectification of your account data; account deletion; objection), write to teachaiflowapp@gmail.com from your account's email address. We reply within one month at most (Art. 12(3) GDPR).

If you believe we have not honoured your rights, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country (Art. 77 GDPR).

The extension runs only on the following addresses, declared in its manifest (host_permissions). On any other website it does not load and cannot read anything:

• chatgpt.com and chat.openai.com (ChatGPT, OpenAI).
• claude.ai (Claude, Anthropic).
• gemini.google.com (Gemini, Google).
• grok.com (Grok, xAI).
• chat.deepseek.com (DeepSeek).
• notebooklm.google.com and notebook.google.com (NotebookLM, Google).
• teachaiflow.com: the /flow path (TeachAIFlow's Flow chat) for capture, and /account/extension to link the account from the website and for the checker (/account/extension/verificar). The rest of the domain is only used to talk to our server (API).

Browser permissions and what they are for: storage and unlimitedStorage (keeping captures, references and private fingerprints in your browser without the default quota truncating them; fingerprints can last up to a year) and sidePanel (the side panel). Those three are the only ones this version requests: it asks for no permissions over tabs, browsing history, cookies or downloads, runs no remote code, and “Continue with Google” is not available in it (if a future version enables it, that version will also request the identity permission and you will see it when updating). The uninstall notice in section 5 needs no permission.

The extension, the checker and the /ref pages use no AI model. The seal is a SHA-256 hash with a timestamp; the check is a literal comparison of text fragments; fingerprints are hashes of 5-word fragments compared one by one. There is no probabilistic “AI detector”, no score and no student profile.

We make no automated decisions with legal or similarly significant effects about you (Art. 22 GDPR). If a teacher makes an academic decision, the teacher makes it, with the reference or certification as evidence of what you chose to show.

Because the extension embeds no AI system, the transparency obligations of Regulation (EU) 2024/1689 (the AI Act) do not apply to it. The AI tools of the TeachAIFlow platform have their own AI Transparency page.

Technical and organisational measures (Art. 32 GDPR) behind this policy:

• All communication with the server is encrypted (HTTPS). The extension rejects any server other than https://teachaiflow.com.
• Device tokens are stored hashed and compared in constant time; they expire, can be revoked from the website, and are revoked automatically on uninstall.
• Passwords are stored hashed; the extension never keeps yours.
• Fingerprints are computed with a secret key that is born and dies in your browser; the installation identifier is a random 128-bit value that only allows revoking that installation's tokens.
• Extension routes authenticate only by token and website routes only by session cookie: a stolen token does not open the website and a cookie cannot seal or certify from elsewhere. A certification can only be requested by the extension, for a result it computed itself less than 30 minutes earlier.
• Per-minute rate limits on sign-in, sealing, certification, /ref reads and checks, plus a strict limit on non-existent codes to stop codes being tried at random.
• The server recomputes the hash and code of every reference: it does not trust what the client declares.

Known limits: malware with access to your browser's storage could use your token; if you suspect it, unlink the device from /account/extension and change your password. Someone who modifies their own extension could send false figures to a certification; that is why the certification is presented as an assisted statement and shows since when there has been evidence. If we detect a security breach affecting your data, we will notify it in accordance with Arts. 33 and 34 GDPR.

TeachAIFlow Trace complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically: we only use user data to provide or improve the extension's single purpose (recording, referencing and checking your use of AI assistants in your assignments), which is visible from its own interface; we only transfer it to third parties where necessary to provide that purpose, to comply with the law, to protect against fraud or abuse, or as part of a merger or acquisition with prior notice; we do not use or transfer it to serve advertising, to determine creditworthiness or for lending purposes; and no human reads that data except with your explicit consent, for security purposes, to comply with the law, or in aggregated and anonymised form for internal operations.

The use of information received from Chrome APIs and, where Google sign-in is used, from Google APIs by TeachAIFlow Trace will adhere to the Chrome Web Store User Data Policy and to the Google API Services User Data Policy, including the Limited Use requirements.

We will update this policy when the extension changes which data it processes, where or for how long, or when the law changes. If the change is material we will make it visible to you, in the extension panel or by email. The date in the header identifies the version in force.

For questions about this policy, write to teachaiflowapp@gmail.com. If your university or school wants a data processing agreement or information for its students about the extension, write to the same address.