← Back to the main privacy policy

What the tools record

The lists on this page — every kind of event, every column, every field your browser may send, which tools ask first, which tools do not read their own labels — are generated from the running code, not written by hand. If someone adds a field tomorrow, it appears here tomorrow. The prose around them is written by us and can go stale like any prose; if it ever disagrees with a generated list, believe the list.

The short version

• We record that you used something — a station you opened, a control you moved, a button you pressed.
• We never record what you entered. Nothing you type is ever sent, and no column holds a field's value. What the free-text columns hold is the name of a part of the page; on most tools that name can be taken from visible text, and on the tools that hold personal work we switch that off entirely (see below).
• You can turn all of it off, from the control on any tool page. Off means nothing on the page is patched and nothing is sent — not collected-and-discarded (see below for exactly what “off” does and does not stop).

If you are signed in, we are not going to pretend otherwise

Some of these pages are behind a login and some are not: a /tools/ page generally is, while an /x/ page is public and can be opened by anyone, signed in or not. The event record does not care either way: if you are signed in, the event is stored against your account (the student_id column), and if you are not, it is not. That link is what lets us delete your data if you ask for it.

Every event — signed in or not — also carries session_hash, which appears in the column list below. It is a salted, one-way hash of your IP address and your browser's user-agent string, and it exists so we can tell one visit from another without storing an IP address. It is deliberately not your account: it groups visits, not people. It cannot be turned back into an IP address, and it is not a name.

Nothing in the analytics ever shows anyone your name — the reports only ever count people. Linked and identifying are different things, and the safeguard is what the reports are allowed to look at, not whether the record is linked to your account.

Two different rules, and which tools use which

Not every tool here works the same way, and pretending otherwise would be the kind of tidy summary that is wrong for most readers.

First, the size of the thing. There are 12 tools under /tools/: campaign-workbench, context-workbench, data-activism-companion, data-crimes, front-page-audit, method-picker, offer-designer, outreach, pipeline, pricing-bench, propaganda, social-budget. The two rules below cover the 6 Founding Federation benches that declare a rule of their own. The other 6 declare none, which means the ordinary default: they count usage unless you switch it off, exactly like the second group. This list is read from the tools directory, so a tool added tomorrow appears here tomorrow.

Some tools ask first and collect nothing until you say yes. Generated from the code that sets the flag, these are: offer-designer, outreach, pipeline. Pipeline, Outreach and the Offer Designer told you plainly that nothing you did in them was ever sent anywhere — no network request of any kind, nothing sent anywhere. When we added usage counting, that stopped being true, so rather than quietly reword the promise, those three tools now ask. Until you answer, they record nothing at all: not a page open, not a step, nothing. If you say no, that is the end of it. You can change your mind either way from the control on any tool page.

The rest count usage unless you turn it off. Of the benches, that is: pricing-bench, propaganda, social-budget — again generated from the code, not from memory. The Pricing Bench and the Social Budget always said your work saves in this browser, and it still does — nothing you type has ever been sent from them. They count which steps people reach unless you switch that off, and the switch is on every one of them. So do the other 6 tools listed above, which never made a narrower promise.

We are telling you which is which because the honest version of this page is more useful than a neat one.

The consent answer is not per-tool

Answering the ask on one of these tools covers the school's learning tools as a whole, not just that one page. The in-page ask says this too. If any copy on the site implies you have to answer separately on each tool, that copy is wrong.

What actually travels

• Which steps or stations someone reaches, and whether they finish one.
• The closed-set archetype and motion someone picked, if they picked one. Archetype is one of A, B, C, D, E, F, G, H. Motion is one of funding, jobseeking, selling. Anything outside those lists is discarded rather than saved, so the field cannot quietly become a place where free text ends up. Answering is optional and every tool works identically without it.
• Whether a text field had anything in it (filled), and a coarse size band for how much was written (length_bucket: empty, 1–20, 21–100, or over 100 characters) — never the text itself. A length bucket is a fact about what someone wrote, and hiding that would be less honest than disclosing it.

Every kind of thing we record

Read directly from tool_events.KINDS — the whitelist the server enforces on every incoming event:

• archetype_set
• click
• draft_load
• draft_save
• example_loaded
• export_click
• export_clipboard
• export_file
• field_adjusted
• field_touched
• form_opened
• frame_viewed
• local_save
• outbound_click
• section_dwell
• section_viewed
• station_completed
• station_reached
• submit_attempt
• submit_result
• tool_close
• tool_open
• view_dwell
• view_opened

Every column we can store

Read directly from tool_events.INSERT_COLS and tool_events.SERVER_SET_COLS — every column a stored row has, not only the ones an event fills in. If a field is not in this list, there is no place in the database for it to go:

• action
• archetype
• depth
• dim_source
• dwell_ms
• element
• field
• filled
• frame_index
• frame_total
• host
• id
• is_staff
• item_count
• kind
• label_source
• length_bucket
• mode
• motion
• occurred_at
• ok
• path
• section
• section_label
• session_hash
• since_open_ms
• student_id
• tool
• view_id
• view_label

id and occurred_at are set by the database itself, not sent by your browser — a row number and the time the event arrived. They were missing from this list until someone checked it against the table; that is what “the full set” is supposed to mean.

Every field the page is allowed to send

Read directly from tool-engagement.js's ALLOWED_KEYS — the whitelist your browser enforces before anything leaves it, independent of the server-side one above:

• action
• archetype
• count
• depth
• dwell_ms
• element
• field
• filled
• host
• index
• kind
• label_source
• length_bucket
• mode
• motion
• ok
• section
• section_label
• since_open_ms
• source
• tool
• total
• view
• view_label

Why it is built this way

There is no value column

Not "we choose not to write to it" — it does not exist. A rule you have to remember is a rule you will eventually forget; a column that was never created cannot be filled in by someone in a hurry. The list above is the whole table, so you can check this yourself rather than take our word for it.

What the free-text columns (section, section_label, action, field) do hold is a name for a part of the page — "the floor and flinch station", "the recalculate button". On most tools that name may be taken from the page's own visible text, which is why the next section exists: a heading can be built from something you typed, and on the tools where that is a real risk we stop reading visible text at all.

We do not record whether you ticked a checkbox

On a checklist tool, the ticks are the answer. Recording "which boxes are checked" would be recording your responses while calling it usage data. Checkboxes, radio buttons, dropdowns, sliders and number fields report only that they changed.

Typing is recorded as a size, not a length

A field reports "empty", "1–20", "21–100" or "100+". Even an exact character count says more than it should — it is a fingerprint of a specific answer.

A link you follow records the site, never the address

If you click through to a source from one of these tools, we store arxiv.org and not the URL. Query strings are exactly where tracking ids, session tokens and sometimes email addresses ride along. The site name answers "did people go and read it"; the rest is risk for nothing.

Some tools do not read their own labels

Usually a control or a part of the page can be named from its visible text. On a tool holding personal work that is unsafe, because a label or a heading can be built from what you typed — the name you gave a person or a group. Those tools take names only from labels written by us in the page's code, never from what is on screen: not the control's text, not the heading above it, not a slide title.

Generated from the code that sets the flag, the tools with visible-text naming switched off are:

• offer-designer
• outreach
• pipeline
• pricing-bench
• propaganda
• social-budget

That is 6 of the 12 tools. This page used to say it was two, which was true when it was written and stopped being true without anyone noticing — hence generating it.

Turning it off, or on

Every tool page carries a small control: Usage analytics: on · what we collect · turn it off. On the ask-first tools the same control is where you change an earlier yes or no. If you are signed in, the choice follows you to your other devices.

What "off" stops. No usage event is sent, no Umami event is sent, and the page-view counter does not fire on tool pages. Nothing on your page is modified: the script checks your answer before it wraps anything, so fetch, clipboard.writeText, URL.createObjectURL and Storage.setItem are left exactly as your browser made them. You can confirm that in developer tools. It is not collect-and-discard; there is nothing to discard.

What "off" does not stop, said plainly. The script file itself is still loaded by the page — it has to be, because it is what draws the control you use to change your mind — and the few lines that read your answer and draw that control do run. On the Founding Federation benches a second, bundled copy of the same check runs too, for the same reason. So the honest sentence is no global is patched and nothing is sent. This page used to promise something stronger and less accurate — that nothing at all would execute — and that was never true of any tool page.

For the account-level rules on deletion, retention and everything else we collect across the site, see the main privacy policy.