Privacy Policy

This summary is not a substitute for the sections below, but it is accurate.

• Anchor has one server, and it only knows your name. Signing in creates an Anchor account holding your email address and name. There is no server anywhere that receives a roster, a score, a transcript or a student's name — see Your Anchor account.
• We never receive student data. Not names, not grades, not speech, not engagement scores. It is technically impossible for us to, because the app never sends student data anywhere.
• No video is analysed and no facial recognition is used. Anchor reads whether a camera is on or off — a true/false flag from Zoom — and never looks at the picture.
• Speech is never written to disk. Live captions are held in memory during a class, in a bounded window, and are discarded when the meeting ends.
• No analytics, no telemetry, no advertising, no data sales. Anchor contains no third-party tracking of any kind.

Anchor is a macOS application built and operated by an individual developer, Rishab Reddy Paili ("Anchor", "we", "us"), reachable at rishabreddy0809@gmail.com.

This policy covers the Anchor macOS application and this website. Because Anchor processes data only on your own computer, for most purposes under data protection law you — or your school — are the data controller, and Anchor is software you run rather than a service that holds your data.

Anchor asks you to create an account the first time you open it. This is the only part of Anchor that involves a server of ours at all, so it is worth being exact about what it holds and what it does not.

What the account holds

• Your email address
• Your name, if you give one — or the name on your Google account, if you choose to sign in with Google
• An identifier Anchor uses to recognise you when you sign in again

What the account does not hold

No student names, no rosters, no engagement scores, no session history, no transcripts, and nothing read from Zoom or Google Classroom. None of that is uploaded when you sign in, and none of it is linked to your account. It stays on your Mac exactly as described in the sections below. Creating an account does not change where a single piece of classroom data lives.

Who operates it

Accounts run on Firebase Authentication, a Google service acting as a processor on our behalf. The email address and name above are stored on Google's servers for that purpose and are not used for advertising.

If you sign in with Google, Anchor asks Google only to confirm who you are — your name and email address, and no other permission. That is a separate request from connecting Google Classroom, and neither one implies the other. You can sign in with Google without ever connecting Classroom, connect Classroom without signing in with Google, and revoke either without affecting the other.

Deleting it

Email rishabreddy0809@gmail.com and we will delete your account. That removes the email address and name described above. It does not touch anything on your Mac — that data is yours and was never ours to delete; Settings → Data & Privacy is where you clear it.

To read in-meeting state, Anchor joins your Zoom meeting as an additional participant named "Anchor (engagement assistant)". This is deliberate: participant state such as mute and camera status is only visible to a client inside the meeting. The bot is visible in the participant list to everyone in the call, exactly like any other attendee. Anchor does not join silently.

Signals read from the meeting

• Microphone state, and how long a participant has been unmuted
• Whether a participant is currently speaking, and for how long
• Camera on or off — a state flag only; no video frame is ever read
• Hand-raise state and how many times a hand has been raised
• The length of chat messages — a character count, not the message text
• From Zoom's live caption stream: counts of hesitation markers, whether an utterance was a question, and a derived confidence estimate

How captions are handled

Captions are speech by children in a classroom, and are treated accordingly. The transcript exists in memory only, is limited to a recent window rather than the whole lesson, is dropped when the meeting ends, and is never written to disk. The only thing derived from a lesson that persists is the lesson topic, if you type one in yourself.

Connecting Google Classroom is optional. Anchor works on Zoom signals alone; Classroom adds academic context. If you connect it, Anchor requests these scopes:

• classroom.courses.readonly — your course list
• classroom.rosters.readonly — student rosters, to match students to meeting participants
• classroom.student-submissions.students.readonly — submission and grade state
• classroom.coursework.students — coursework. Google's console does not offer a read-only variant of this scope for our configuration, so the broader one is requested. Anchor makes only read requests and never writes to your Classroom.
• userinfo.email — your own email, to show which account is connected

Anchor does not request your students' email addresses. It used to, to match a Classroom roster entry to the right person in the Zoom call. That was the only permission on this list Google classes as sensitive, and it was removed on 17 August 2026. Anchor now matches students by name instead, which is less certain — so it only accepts an unambiguous name, shows any such match as unverified, and asks you to confirm the rest yourself. Two students whose names look alike are both left unmatched rather than one of them being guessed at.

Google shows these as individual checkboxes and grants only what you tick. Anchor checks afterwards what was actually granted and degrades rather than failing.

From this data Anchor derives five academic signals: missing assignments, grade average, grade trend, days since last submission and late submissions.

Anchor's use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Classroom data is used solely to display engagement and risk information to you, is never transferred to us or any third party, is never used for advertising, and is never used to train any model outside your own Mac.

• Session history — a JSON file in your Mac's Application Support directory. It records engagement scores and Zoom signals. It never contains a line of speech. Anchor deletes each session's record 120 days after the class ends, and removes its own leftover copies of the file on the same schedule. You can change the window, or turn the deletion off, in Settings → Data & Privacy.
• Your Google refresh token — the macOS Keychain. The short-lived access token is held in memory only and never written to disk.
• Your Zoom sign-in — the macOS Keychain, if you connect Zoom. Anchor keeps the refresh token, the current access token and its expiry, the permissions Zoom granted, and the account name shown in Settings. Unlike the Google token above, the Zoom access token is stored rather than held in memory, so that reopening Anchor does not send you back through Zoom's sign-in page mid-lesson.
• Your calendar — nothing is stored. If you connect it, Anchor reads today's events from the calendars you pick, through macOS's own Calendar permission, and holds them in memory to show on your dashboard. They are never written to disk, never sent anywhere, and never given to any model. Anchor asks macOS rather than Google, so no additional Google permission is involved. Turn it off in Settings → Integrations, or in System Settings → Privacy & Security → Calendars.
• Your Anchor account session — the macOS Keychain. Signing in stores a token that keeps you signed in between launches. It identifies you to Anchor and carries no classroom data. Signing out removes it.
• Settings and onboarding state — standard macOS preferences.
• Live transcript — memory only, for the duration of the meeting.

All of this is on your machine, under your account, protected by your Mac's own file permissions and disk encryption. If you use FileVault, it is encrypted at rest by FileVault.

Anchor connects to exactly four destinations, all of them necessary:

• Firebase Authentication — to create your Anchor account and keep you signed in. It receives your email address and name, and never any classroom data
• Zoom — to join the meeting and receive participant state
• Google — sign-in and Classroom reads, only if you connect Classroom
• An OAuth redirect page we host, which exists solely to hand the sign-in result back to the app and receives no student data

There are no other network destinations in the application. Anchor contains no analytics SDK, no crash reporter that transmits off-device, no advertising identifier and no third-party tracking.

Anchor's struggle detection is a Core ML model that runs on your Mac. The lesson-assistant features use Apple's on-device Foundation Models via Apple Intelligence, which also run locally.

No student data is sent to any external AI service. No prompt, transcript, score or roster leaves your machine for inference. Anchor does not use OpenAI, Anthropic, Google Gemini or any other hosted model provider.

Anchor does not use your classroom data to train or improve any model we distribute. If you choose to export training data to retrain the model yourself, that export is a file you create, on your machine, that you control.

Anchor is used in classrooms that include children. This deserves a direct answer rather than a hedge.

Under FERPA, education records stay under the control of the school. Anchor is positioned as a tool operated by a school official — you — under the school's direct control. Because student information is never transmitted to us, we never become a recipient or holder of education records.

Under COPPA, the operator obligations that attach to collecting personal information from children under 13 are triggered by collection by the operator. Anchor performs no such collection: we receive nothing. This does not remove your school's own obligations to notify parents and obtain consent where its policy or state law requires it.

Several US states impose additional student-privacy duties on schools and vendors. Because the answer to "what does the vendor receive" is "nothing", Anchor is straightforward to assess — but the assessment is still your school's to make.

This section describes how the software behaves. It is not legal advice, and it has not been reviewed by an attorney. Have counsel review this policy and your school's data agreements before running a pilot with real students.

Anchor gives you information about students. Using it lawfully and decently is your part of the arrangement:

• Tell participants that Anchor is in the meeting. The bot is visible, but visible is not the same as disclosed, and several jurisdictions require notice before captions or meeting content are processed.
• Follow your school's policy and any applicable state student-privacy law before connecting Classroom or running a session.
• Confirm you are authorised to connect the Zoom and Google accounts you connect.
• Treat what Anchor shows you as an estimate that prompts a human check, never as a finding about a child. See the limitations section of the Terms.

We hold nothing about your classes, so there is nothing of theirs for us to delete. Everything below is under your control, and the one thing we do hold is at the end of the list:

• Live transcripts — discarded automatically when the meeting ends.
• Session history — deleted automatically 120 days after each class ends. You can shorten that to nothing, extend it to a school year, or switch automatic deletion off entirely in Settings → Data & Privacy. You can also delete any session or class immediately in the app, or delete the whole file yourself.
• Google connection — disconnect in the app, and revoke Anchor's access at myaccount.google.com/permissions. Revoking at Google invalidates the stored refresh token immediately.
• Zoom connection — disconnect in the app. Anchor asks Zoom to revoke the grant and then deletes it from the Keychain, and it deletes its own copy even when that request cannot reach Zoom, so Disconnect never leaves you still connected. You can also remove Anchor yourself at marketplace.zoom.us/user/installed.
• Everything — deleting the app and its Application Support directory removes all locally stored Anchor data.
• Your Anchor account — the one item on this list that is ours rather than yours. Email rishabreddy0809@gmail.com and we will delete it. See Your Anchor account for what it holds; deleting the app does not remove it, because it does not live on your Mac.

Depending on where you live you may have rights to access, correct, export or delete personal data held about you, and to object to its processing.

For data inside Anchor these rights are satisfied directly: the data is on your Mac, in files you can read, copy and delete without asking us.

For the two things we do hold — your Anchor account (your email address and name), and any correspondence if you email us about the pilot — write to rishabreddy0809@gmail.com and we will provide, correct or delete it.

This website is served as static files. It sets no cookies, runs no analytics and does not fingerprint visitors. Our host records standard server logs, including IP addresses, for delivery and security.

If this policy changes materially — particularly if Anchor ever gains a backend, or begins transmitting data anywhere it does not today — we will update the date at the top of this page and notify pilot teachers by email before the change takes effect.

Anchor requires macOS 14 or later. Changes to the underlying Zoom or Google APIs may change what signals are available; we will keep this page accurate as that happens.

Questions about this policy, or about anything Anchor does with data, go to rishabreddy0809@gmail.com. Questions from a school's privacy officer or counsel are welcome and will get a direct answer.