Sourcebook Saver Privacy Policy

Covers the Sourcebook Saver Chrome extension and the Sourcebook Saver add-on for Google Docs

Effective date: to be announced · Last updated: October 12, 2026

Contents

1. The short version
2. 1. Who we are
3. 2. What Sourcebook Saver does
4. 3. What information Sourcebook Saver uses
5. 4. Where information is stored
6. 5. Who can see it
7. 6. Outside services Sourcebook Saver contacts
8. 7. What we never do
9. 8. Security
10. 9. How long we keep information, and how to delete it
11. 10. Rights of parents, students and schools
12. 11. FERPA
13. 12. COPPA (children under 13)
14. 13. New York Education Law §2-d
15. 14. Other states and data privacy agreements
16. 15. If there is a data breach
17. 16. Changes to this policy
18. 17. Contact
19. A1. Parents' Bill of Rights for Data Privacy and Security
20. A2. Supplemental information about Sourcebook Saver (8 NYCRR §121.3(c))

The short version

• Sourcebook Saver keeps a student's sources in that student's own Google account. Sourcebook Saver has no servers or database of its own.
• We never sell student information, never show ads, never build advertising profiles, and never use student information to train AI.
• Teachers see only a short list of what their own students saved (titles, dates and counts), never the PDFs, highlights or notes.
• Schools stay in control. They can remove Sourcebook Saver at any time, and students' files stay in students' own Drive.

1. Who we are

Sourcebook Saver is a research and citation tool for students, made up of a Chrome extension and a Google Docs add-on. Sourcebook Saver is independent and is not run by any school. In this policy, "Sourcebook Saver," "we" and "us" mean Sourcebook Saver.

Privacy contact: privacy@sourcebooksaver.com

2. What Sourcebook Saver does

A student saves an article, web page or PDF with one click. Sourcebook Saver finds the full citation details, keeps a copy of the source with the student's highlights and notes, and lets the student insert citations and a bibliography into a Google Doc. Teachers can also use Teacher view, part of Sourcebook Saver Pro, to see a list of the sources each student in their classes has saved and follow the research process. Sourcebook Saver is always free for students. Sourcebook Saver Pro is a paid subscription for teachers, after a 30-day free trial.

3. What information Sourcebook Saver uses

From the student's or teacher's Google account

• Email address. Used to confirm who is signed in, to show teachers a "Teacher view" link, and, when Teacher view is on, to match a student to their Google Classroom classes. Sourcebook Saver does not ask for a birth date, home address or phone number.
• Files Sourcebook Saver created. Sourcebook Saver uses Google's limited "files this app created" permission (drive.file). It cannot see or open anything else in the student's Drive.
• The Google Doc that is open. Sourcebook Saver inserts and updates citations and the bibliography in the document the student is working in.

What the student saves

• Citation details (title, authors, year, journal or publisher, DOI and similar), the address of the page, a copy of the PDF or a readable copy of the web page, and the student's own highlights, notes, tags and "done" marks.

From Google Classroom (teachers using Teacher view)

• The classes the teacher teaches, the student rosters of the classes the teacher chooses, and those students' names and school email addresses. This is read-only, names are shown live and not stored, and Sourcebook Saver never changes anything in Classroom.

From teachers who subscribe to Sourcebook Saver Pro

• Name, email address, plan and payment status (see "Payments" in section 6).

What the Chrome extension reads

• Sourcebook Saver reads the page or PDF in the current tab only when the student clicks it, so it can build the citation and save a copy. On library databases (such as EBSCO), it uses the student's existing library sign-in to download the PDF. It does not track browsing history, and it does not read pages in the background.

4. Where information is stored

All of this lives on Google's systems under the school's Google Workspace accounts. Sourcebook Saver's program code runs in Google Apps Script, signed in as the person using it. Sourcebook Saver has no separate server, database or cloud account that collects student information.

5. Who can see it

• The student sees everything they saved.
• Teachers using Teacher view see a short listing for each student in the Classroom classes they teach and choose to connect: each source's title, authors, year, type, whether it has been cited, the date it was saved, its original link, the number of highlights and notes, and when the student was last active. Teachers never see the PDFs, the text of highlights or the text of notes through Sourcebook Saver. Every request checks with Google Classroom that the person viewing actually teaches that class. A teacher can export this listing for one class as a spreadsheet.
• The school account that runs the Teacher app holds the listing files in its Drive. The school should choose that account: a staff or administrator account under its control.
• The school's Google Workspace administrators can see data stored in school accounts, as with any school Google file.
• Sourcebook Saver does not receive or look at student data. The only exceptions are a school asking for help with a specific problem and granting access, or a legal requirement.
• No one else. We do not share student information with anyone else, except as described in section 6 or when required by law.

6. Outside services Sourcebook Saver contacts

To fill in citation details, Sourcebook Saver asks free public library and research catalogues about the source, not about the student.

These requests contain no name, email address, notes or highlights. Some lookups are made from the student's browser, so, as with any website, the service can see the browser's internet address. Others are made from Google's servers. Lookup results are public catalogue records and are cached for up to 6 hours.

Google. Sourcebook Saver runs on Google Workspace (Docs, Drive, Apps Script, Classroom) and Chrome. Google's handling of school data is covered by the school's agreement with Google.

Payments (Sourcebook Saver Pro). Teachers who subscribe to Sourcebook Saver Pro pay through a payment processor (to be announced). The payment processor collects the card and billing details directly. We receive only what we need to run the subscription: the teacher's name, email address, plan, payment status and, at most, the card type and last four digits. We never see or store full card numbers. Billing information never includes student data, and student information is never sent to the payment processor. We keep billing records as long as tax and accounting law requires.

There are no analytics, advertising, tracking pixels or third-party trackers in the Sourcebook Saver extension or add-on. Google Apps Script keeps a short technical log when something goes wrong (for example, "upload failed, trying again"). These logs are visible only to the project owner and do not contain notes or highlights.

7. What we never do

• We never sell or rent student information.
• We never use it for advertising, marketing or building profiles, and never show ads.
• We never use it to train or improve artificial intelligence or machine-learning models.
• We never share it with data brokers or use it to decide credit or lending.
• We never use it for any purpose other than running Sourcebook Saver for the student and the school.
• We never contact students for marketing. Messages about Sourcebook Saver Pro go only to teachers and schools.

Google API Services. Sourcebook Saver's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy. Sourcebook Saver's use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

8. Security

• All data is stored in Google Workspace, which encrypts it while it is stored (AES-256) and while it travels (HTTPS).
• Every connection Sourcebook Saver makes uses HTTPS.
• Sourcebook Saver asks only for the permissions it needs: its own files in Drive, the open document, read-only Classroom access for teachers, and the signed-in email address.
• Teacher view checks with Google Classroom on every request that the viewer teaches the class, and a student can only ever send their own listing, because Google identifies who the student is.
• We follow the NIST Cybersecurity Framework as a guide for keeping Sourcebook Saver secure, scaled to its size.

9. How long we keep information, and how to delete it

• Students' sources and notes stay in the student's own Drive for as long as the student or school keeps them. Students can delete any source by deleting it from the "Sourcebook Sources" folder, or delete everything by deleting that folder and "My notes (Sourcebook).json".
• Teacher view listings stay in the "Sourcebook class data" folder until a teacher or the school deletes them. In Teacher view, "Delete class data" moves a class's listings to the Drive trash, where they can be restored for 30 days, and disconnects the class. Listings of students who are also in another connected class stay. "Delete all Sourcebook data" does the same for every class. When a student is no longer in any connected class, their listing is moved to the trash automatically. A teacher or the school can also delete any listing by deleting its file in that folder. On request, we will help delete listings for a student, a class or a whole school within 30 days.
• When a school stops using Sourcebook Saver, the school removes the add-on and extension. Sourcebook Saver keeps no copy anywhere else. Students' files remain in their own Drive under the school's control, and citations already in papers stay as normal text.
• Lookup caches expire within 6 hours, and saves waiting in Chrome are deleted once they reach Drive.

10. Rights of parents, students and schools

Parents, eligible students (18 or older) and schools can:

• see the information Sourcebook Saver holds about a student (it is all in the student's Drive and the school's Teacher view folder);
• ask for corrections. Students can edit any citation detail themselves;
• ask for deletion (see section 9);
• ask questions or make a complaint by writing to the privacy contact in section 1.

Because the data belongs to the school and sits in the school's Google accounts, the fastest route is usually through the school. We will answer every request within 30 days, and sooner when the law requires it.

11. FERPA

When a school uses Sourcebook Saver, student information stays under the school's direct control, in the school's own Google Workspace. Sourcebook Saver acts only on the school's behalf, as a "school official" with a legitimate educational interest under FERPA (34 CFR 99.31(a)(1)(i)(B)). It uses student information only for the school's educational purposes and does not disclose it further. FERPA applies to schools that receive U.S. Department of Education funding; many private schools do not, but we follow the same rules for every school. Teachers who use Sourcebook Saver with their students should do so with their school's approval, so the school stays in control of its students' information.

12. COPPA (children under 13)

Sourcebook Saver is designed for high school students and is not directed to children under 13. If a school chooses to use it with students under 13, the school gives consent on the parents' behalf for this educational use, as the Federal Trade Commission's COPPA guidance allows, and Sourcebook Saver uses the information only for the school's educational purposes and no other commercial purpose. Parents may ask the school to review or delete their child's information at any time.

13. New York Education Law §2-d

For New York public schools, school districts and BOCES ("educational agencies" under §2-d), Sourcebook Saver will act as a third-party contractor. It will follow §2-d and Part 121 of the Commissioner's regulations and the school's data security and privacy policy, and sign the school's data privacy agreement. The Parents' Bill of Rights and Sourcebook Saver's supplemental information are in Appendix A. We apply the same commitments to New York private schools too.

14. Other states and data privacy agreements

Many states have their own student-privacy laws, such as California's SOPIPA, Illinois's SOPPA and Connecticut's student data privacy law. Their core requirements match this policy: use student data only for school purposes, never sell it or use it for targeted ads, protect it, delete it when the school asks, and report breaches. We are glad to sign the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) with a school's state-specific exhibit, or the school's own agreement.

15. If there is a data breach

If we learn that student information handled by Sourcebook Saver was accessed without permission, we will:

• notify each affected school promptly, and in any case within 7 calendar days of discovering it. That is the strictest deadline we know of, set by New York's Part 121;
• tell the school what happened, when, what information was involved, roughly how many students were affected, and what we are doing about it;
• cooperate with the school and law enforcement, and help the school notify families as its state's law requires.

16. Changes to this policy

If we change this policy, we will post the new version with a new date. If a change would let Sourcebook Saver use information in a new way, we will tell schools in advance and ask for consent where required before the change takes effect.

17. Contact

Questions, requests or complaints: privacy@sourcebooksaver.com

Appendix A. New York Education Law §2-d

Under §2-d, each educational agency publishes its own Parents' Bill of Rights and attaches it to every contract with a third-party contractor. The text below follows the elements required by Education Law §2-d(3) and 8 NYCRR §121.3, for a school to adopt or compare with its own.

A1. Parents' Bill of Rights for Data Privacy and Security

1. A student's personally identifiable information (PII) cannot be sold or released for any commercial or marketing purpose.
2. Parents have the right to inspect and review the complete contents of their child's education record.
3. State and federal laws, such as Education Law §2-d and FERPA, protect the confidentiality of students' PII. Safeguards that meet industry standards and best practices, including encryption, firewalls and password protection, must be in place when data is stored or transferred.
4. A complete list of all student data elements collected by New York State is available for public review at www.nysed.gov/data-privacy-security, or by writing to the Office of Information and Reporting Services, New York State Education Department, 89 Washington Avenue, Albany, NY 12234.
5. Parents have the right to have complaints about possible breaches and unauthorized disclosures of student data addressed. Complaints may be made to the school and to the NYSED Chief Privacy Officer at www.nysed.gov/data-privacy-security, by email to privacy@nysed.gov, by mail to the Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234, or by phone at 518-474-0937.
6. Parents have the right to be notified, in accordance with applicable laws and regulations, if a breach or unauthorized release of their child's PII occurs.
7. Educational agency workers who handle PII will receive training on applicable state and federal laws, policies and safeguards.
8. Educational agencies' contracts with vendors that receive PII will address statutory and regulatory data privacy and security requirements.

A2. Supplemental information about Sourcebook Saver (8 NYCRR §121.3(c))

---

Sources this policy was checked against (October 2026): the U.S. Department of Education's FERPA guidance (studentprivacy.ed.gov) and 34 CFR 99.31; the FTC's COPPA Rule (amended April 2025) and COPPA FAQs; NY Education Law §2-d, 8 NYCRR Part 121 and NYSED's data privacy FAQ; Google's API Services User Data Policy, its Workspace API User Data and Developer Policy, its OAuth brand-verification requirements and Workspace Marketplace listing requirements; the Chrome Web Store User Data Policy; California SOPIPA (Bus. & Prof. Code §22584); Illinois SOPPA (105 ILCS 85); Connecticut General Statutes §10-234aa to §10-234dd; and the SDPC National Data Privacy Agreement v2.