Privacy statement

Last updated: November 2025

form reflector. is a reflection-management web application used by schools for IB-style RPPF and similar forms. This page outlines what information the app stores, how it is used, and the responsibilities of users and schools.

1. Scope

This privacy statement applies to all users of form reflector., including students, teachers, and administrators.

The application is securely hosted and maintained by the service provider on Canadian-based infrastructure. Schools and organizations using the service remain responsible for how they use and manage student and teacher data within the system.

2. Information collected

The following data may be stored in the application database:

• Account data: Google-authenticated email address, internal role (student / teacher / admin), and school assignment.
• Student RPPF data: candidate name, candidate code (optional), three reflection entries, month and DP year for each entry, supervisor initials, and (for teachers/admins) supervisor comments.
• School configuration: school name, configured cohorts or programs, and optional access tokens used to join a school.
• Technical / audit data: timestamps for creation and last update, and limited diagnostic logs.

We do not collect IB marks or the full extended essay. The focus is only on reflection data required to complete official IB-style reflection forms.

3. Authentication

The application uses Google OAuth for login only. We use the Google account to verify your identity and to match you to a role in your school. We do not read your Google Drive, Gmail, or other Google data.

4. Data storage

All data is securely hosted and managed by the service provider on servers located in Canada. The hosting environment follows standard best practices for data security and privacy, including encryption in transit and restricted administrative access.

Schools using the application retain control over their own student and staff data within the system.

5. How data is used

• to allow students to complete and save their reflection form (RPPF);
• to allow teachers to review, add supervisor initials, and add internal comments;
• to allow admins to manage cohorts, schools, and export RPPFs to PDF or CSV for assessment;
• to support authenticity and record keeping around IB extended essays or similar projects.

Data is not sold, shared for advertising, or used for unrelated analytics.

6. PDF generation

When a user triggers an export, the app fills a secure PDF template (for example, the official EE RPPF PDF) using the reflection data already stored in the database. This is done on the server using secure PDF processing libraries. Generated PDFs are returned only to the logged-in user and are not made public.

7. Access control

• Students can access only their own reflection records.
• Teachers can view students assigned to them or to their school/cohort.
• Admins can view and export all students in their school configuration.

These access rules mirror the roles already defined in the application.

8. Retention and deletion

Student reflection data is retained as long as the school or organization requires it for assessment or exporting to PDF. Admins can remove students or users through the admin interface, which also removes their related reflection data from the application database.

9. Contact

For questions about this privacy statement or to request removal of data, contact your school administrator or the service provider for form reflector.