The safest data is the data we never have.

A static site, run in the browser

• No server code. classda.sh is HTML, JavaScript, CSS, pictures and sounds, built ahead of time and served as files. There is no application server, no API of ours and no database. The host can only hand out files.
• No accounts. Nobody signs in, so there are no passwords, sessions or tokens to steal, and no way for one teacher's browser to reach another's class.
• Data stays on the device. The class is saved in the browser's own storage (IndexedDB) for classda.sh, in that browser profile, on that computer. Clearing the site's data removes all of it. The privacy policy lists exactly what's stored.
• Offline after the first visit. A service worker keeps a copy of the app on the device, so the board runs without a connection and keeps working if our site is unreachable.
• Two windows, one computer. Present shows the board in a second window; the windows talk through the browser (BroadcastChannel), never over the network. There is no pairing service and no relay.
• No third-party scripts. Fonts, icons, sounds and code are part of the app and served from classda.sh. The visit counter is a script served from classda.sh too.

Every address the board can reach

The board connects to classda.sh (the app itself, the state standards lists, the US town list for the weather set-up and the visit counter) and, if the teacher turns the weather on, to the US National Weather Service at api.weather.gov, sending only the town's coordinates. Videos and slides a teacher chooses to play load inside the board only from these players: www.youtube-nocookie.com, player.vimeo.com, docs.google.com, drive.google.com, www.canva.com, padlet.com, www.desmos.com, www.geogebra.org. Each is sandboxed: it can't read the class, move the board's page or put anything over it. Any other link a teacher taps opens in its own tab under the school's filter as usual.

This list isn't just a policy. The Content Security Policy below names these addresses, and the browser refuses any other connection. The full table, with what each address receives, is on the IT page.

What every response carries

• HTTPS only. The site is served over TLS by Vercel, with certificates issued and renewed automatically, and every page asks the browser to upgrade any insecure request.
• Content-Security-Policy: scripts, styles, fonts, pictures, sounds and workers from classda.sh only; connections only to classda.sh and api.weather.gov; frames only from the players above; no plug-ins (object-src 'none'); forms only to classda.sh; the site may not be framed by another site. Each page also carries its own policy that allows only its own inline scripts, by hash.
• Permissions-Policy: the camera, microphone, screen capture and full screen are allowed for classda.sh alone (the Doc cam, noise meter, Show a tab and Fullscreen); location, payment and USB are off.
• X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin and Cross-Origin-Opener-Policy: same-origin-allow-popups (so Present's board window can be opened and nothing else can reach back in).
• Caching. Code files are named by their contents and cached for a year; the service worker and pages are always checked for a new version.

You can confirm every header from any browser's developer tools (Network, then the page's response headers) or with a header-checking site of your choice.

Where there's something to encrypt

• In transit: TLS for everything the site serves.
• The classroom file (.classdash, the teacher's backup) can be locked with a passphrase. The file is encrypted on the device with AES-256-GCM; the key is derived from the passphrase with PBKDF2 (SHA-256, 250,000 iterations) and a random 16-byte salt, with a random 12-byte nonce per file, using the browser's built-in Web Crypto. We never see the file or the passphrase and cannot recover either.
• The teacher PIN (the lock on reports, minus points, private notes and deleting) is stored on the device only as a salted PBKDF2-SHA-256 hash (250,000 iterations), never as the digits, and it never travels in a classroom file.
• At rest in the browser: IndexedDB is stored by the browser in the user's profile and protected the way that device and account are. We recommend each teacher use their own login on a shared computer, and that devices follow the school's usual disk encryption and screen-lock policies. A teacher can erase the class from a device at any time.

How the code is built and shipped

• The app is built with Next.js and React and a small number of well-known open-source libraries, installed from a locked list of exact versions (npm ci), so a build can't silently pick up a different package.
• Dependencies are checked for known vulnerabilities (npm audit) before each release; a release doesn't ship with a known one open.
• The source code lives in a private GitHub repository and deploys to Vercel from it. The accounts that can change the site (GitHub, Vercel and the domain registrar) belong to one person and are protected with two-factor authentication.
• The site includes no advertising, tracking or analytics code from other companies. The compiled code is served unobfuscated, so a reviewer can read what runs.

Who else is involved, and what they see

No provider receives student information, because none exists outside the teacher's browser. If this list ever changes, the privacy policy changes first.

COPPA, FERPA, state student-privacy laws

• COPPA governs online services that collect personal information from children under 13. ClassDa.sh collects none, from anyone; children never have accounts and never send us anything.
• FERPA binds schools and those who hold education records on their behalf. We never receive, store or have access to education records; what a teacher enters stays on the school's or teacher's own device, under the school's control.
• State laws such as California's SOPIPA, New York's Education Law §2-d and Illinois's SOPPA regulate operators who collect or hold student data. Our answer to each of their requirements is the same: we don't collect it, hold it, use it for advertising, profile with it, sell it or share it. We will still sign the agreements those laws expect, including a Parents' Bill of Rights supplement for New York districts, so your file is complete.
• Data privacy agreements. We're happy to sign the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) or your district's own. Email david@classda.sh; a signed copy usually comes back within a week.
• Wording. We say ClassDa.sh is built so no student data ever reaches us, not “FERPA or COPPA certified”, because no such certification exists and we'd rather you trust the design than a badge.

What we have, and what we don't

ClassDa.sh has no SOC 2 report, ISO 27001 certificate or third-party penetration test, and we want to be straight about why. Those assess how an organisation protects the data it stores and processes on its systems. ClassDa.sh stores and processes none; the whole application runs on the school's own devices, and our only systems are a file host (Vercel, which publishes its own security and compliance information) and a code repository. An audit of our side would be an audit of a folder of files.

What a reviewer can do instead, today: read the privacy policy and this page, confirm the headers and the Content Security Policy from a browser, watch the board's network traffic in developer tools while it runs (there isn't much), and ask us anything at david@classda.sh. If your district needs a specific document, tell us what it is; we would rather write one than lose a teacher to a form.

Incidents and availability

• What a breach could mean. Because we hold no student or teacher data, the worst case for our side is someone altering the files we serve. If that happened we would take the site down, fix it, and say what happened on this page and the About page, and tell any school that had contacted us. A teacher's own class on their own device is not reachable from our side.
• Notice. If we ever learned of an incident involving information from a school (for instance an email to us), we would notify that school without unreasonable delay and in any case within the time its agreement with us requires.
• Availability. The site is served from Vercel's global network (status). After a teacher's first visit the board runs from the copy on their device, so an outage on our side doesn't stop a school day; the class is still there and the records are still theirs.
• Backups. There is nothing of yours for us to back up. Teachers back up with the classroom file, and in Chrome and Edge the board can save one to a folder they choose every day.

We'd like to hear it

If you find a security or privacy problem in ClassDa.sh, please email david@classda.sh with what you found and how to see it. We'll acknowledge within three business days, keep you posted, fix confirmed problems as fast as we can and credit you if you'd like. The same contact is published at /.well-known/security.txt. We don't run a paid bounty programme.

Good-faith research is welcome: testing against your own browser and your own test class, without disrupting the site or anyone else's use of it, and giving us a reasonable time to fix a problem before publishing it. We won't pursue anyone who does that. Please never test with a real class list, and don't send us one.

One person, in the open

ClassDa.sh is made and run by David, a former teacher, in the United States; why it's free explains how it's paid for. Questions about anything on this page: david@classda.sh.

Last updated October 24, 2026