Privacy Policy — TecerTools PBD Extension

01Introduction

TecerTools PBD ("the extension") is a Chrome browser extension built by TecerTools to help teachers in Malaysia automate PBD (Pentaksiran Bilik Darjah) data entry on the official MOE/IDME portal (*.moe.gov.my, sppb.moe.gov.my). The responsible data controller is TecerTools, operated by its developer.

This extension is part of the TecerTools service and is subject to the same PDPA framework as our main Privacy Policy (linked below).

02Summary

• The extension only reads and fills in data on IDME pages that you, the signed-in teacher, are already viewing in your own browser.
• It never sends data to MOE servers on its own — it only interacts with IDME’s own on-page form fields, the same way you would by typing into them yourself.
• The only data that ever leaves your browser is: (a) your sign-in details if you choose to sign in, either your email and password sent (HTTPS) to TecerTools’ own sign-in service hosted in Kulai, Johor, Malaysia, or a Google sign-in in Google’s own window; and (b) an optional data pull from your own TecerTools account, only if you use that specific feature.
• We do not sell data, run ads, or use analytics/tracking scripts in the extension.

03What data the extension accesses

While active on an IDME page, the extension reads what’s already rendered on that page in order to automate data entry, including:

• Student names and IC (identification card) numbers, as shown in the class roster table
• TP (Tahap Penguasaan) levels and markah (marks) values entered on the page
• Class/subject labels needed to locate the right rows and fields

This data is read directly from the webpage in your browser session (via a content script) and used only to fill in TP levels, kemahiran (skills) assessments, and comments on the same page. It is processed locally and is not transmitted anywhere by this step.

04What data is stored

Chrome local storage (chrome.storage.local), on your own device only:

• Your cached login session (email, display name, profile picture if you signed in with Google, TecerTools session token) if you sign in
• A one-time flag that shows a welcome message after a Google sign-in, deleted once the message is closed

Chrome session storage (chrome.storage.session), cleared when the browser closes:

• In-progress form selections in the extension popup (e.g. which TP level you were about to apply), so you don’t lose your place if the popup loses focus

None of this is readable by MOE, IDME, or any other website — it is scoped to the extension itself.

05Permissions requested

As declared in the extension’s manifest, the following permissions are requested, each for a specific function:

• storage — to keep the cached login session on your device
• activeTab — to run automation on the active IDME tab when you use the extension
• identity — to open the Google sign-in window when you choose "Log masuk dengan Google", and to receive the TecerTools sign-in code back afterwards. It does not give access to your Google account, email, or files.
• Host permissions include *.moe.gov.my and sppb.moe.gov.my for IDME pages, plus the TecerTools server (supabase.tecertools.my) for sign-in and the optional pull feature

06Account sign-in

Signing in is optional and only required for certain advanced features (see below). Manual PBD entry works without an account.

• Sign-in is handled by TecerTools’ own sign-in service (Supabase Auth), hosted in Kulai, Johor, Malaysia, via email and password or a Google account.
• If you choose to sign in with Google, you sign in to Google in Google’s own window; the extension never sees your Google password. Google shares your name, email address, and profile picture with TecerTools’ sign-in service. If you don’t have a TecerTools account yet, a free one is created with these details. The extension does not store a Google access token.
• We store your email address and a session token to keep you signed in.
• Your password is sent over HTTPS to TecerTools’ sign-in service and stored there only as a hash; the extension does not store it.

TecerTools’ sign-in service and API are hosted on servers in Kulai, Johor, Malaysia. Apart from a Google sign-in you choose yourself, the extension does not send your data to Google or any other third party. Student data from IDME is never sent to Google.

07Optional feature: pulling your own TecerTools records

If you have a TecerTools account at tecertools.my and use the extension’s "pull from source" feature, the extension will:

• Send a request, authenticated with your TecerTools login, to a TecerTools backend endpoint to fetch your own previously saved student records
• Use the returned records (names, IC numbers, TP/markah values) to fill in the IDME page, matching rows by IC number or student name

This request only happens when you actively choose to use this feature. No IDME page data is sent to TecerTools as part of this — it only pulls your existing records down to fill the page.

08Limited Use

The use of information received by this extension adheres to the Chrome Web Store Limited Use requirements. Specifically:

• We only use data to provide and improve the features described in this policy.
• We do not transfer or sell data to third parties for advertising, marketing, or unrelated purposes.
• We do not use data for any purpose other than those disclosed, and do not allow humans to read your data except with your consent or as required by law.

09What we don’t do

• We do not sell, rent, or share your data with third parties for advertising or marketing.
• We do not run analytics, ad, or third-party tracking scripts inside the extension.
• We do not transmit IDME/MOE student data to any TecerTools server as part of manual entry — that data only ever moves between the IDME page and the extension, locally in your browser.
• We do not access any webpage other than the MOE/IDME domains this extension is built for.

10Data retention & deletion

• Local extension data (cached login session) stays on your device until you sign out or remove the extension, at which point it is cleared.
• Records stored in your TecerTools account (used only for the optional pull feature) are retained per your TecerTools account settings. You can request deletion of your TecerTools account and associated data by contacting us.

11Children’s data

This extension is a professional tool for teachers. While it processes student names and IC numbers as part of assessment data entry, this happens entirely within the teacher’s own authorized MOE/IDME session and is not collected, stored, or transmitted by TecerTools except as described above (i.e., only when the teacher’s own saved records are pulled back into IDME at their request).

12Changes to this policy

If this policy changes, the "Last updated" date above will be revised. Material changes will be reflected here before they take effect.

13Contact

Questions about this policy or your data can be sent to: tecertools@gmail.com