📚 Behaviour Book

Privacy & Data Security

A complete technical and legal overview of how Behaviour Book handles student data. Designed to be shared with IT administrators and school leadership.

Last updated: 10 May 2026

Summary for Administrators

Technical Architecture

How the app works

Behaviour Book is a single HTML file (~3,500 lines) containing all HTML, CSS, and JavaScript. When a teacher opens it in a browser, the entire application runs locally on their device. There is no server component.

Data flow

Teacher's device (browser tab) ← all data lives here
↓ Save button → downloads a .json file to the device's file system
↑ Load button → reads a .json file from the device's file system
↕ No network requests are made to send or receive student data

What happens in memory

All student names, behaviour entries, notes, and settings exist only in the browser tab's JavaScript memory. When the tab is closed, the data is gone — unless the teacher has saved it to a file.

What's in the saved file

The .json file is a plain-text file containing:

The file is human-readable. Teachers can open it in any text editor to inspect exactly what's stored. No data is encrypted, obfuscated, or hidden.

For IT admins: The file contains no executable code. It's a standard JSON document. It can be safely stored on network drives, USBs, or any file storage your school uses.

Network Activity

What the app loads from the internet

When a teacher opens the HTML file in a browser with internet access, two resources are loaded:

ResourceFromPurposeData sent to them
Nunito + Fraunces fonts fonts.googleapis.com Typography Standard HTTP request headers only (IP address, user agent). No student data.
Alpine.js v3.14.9 cdn.jsdelivr.net UI framework (reactivity) Standard HTTP request headers only. No student data.

What the app does NOT do

Verification

IT administrators can verify this by opening the browser's Developer Tools (F12) → Network tab while using the app. After the initial page load, you will see zero network requests during normal use (logging entries, viewing students, etc.). The Save function uses URL.createObjectURL() to generate a local download — no upload occurs.

Fully offline mode

The app can run with no internet connection at all. If the HTML file is opened locally and the fonts/Alpine.js have been cached by the browser (from a previous session), or if Alpine.js is embedded directly into the file, the app works entirely offline. The only difference is that fonts may fall back to system defaults.

Data Storage & Persistence

What is NOT used

Storage mechanismUsed?Reason
CookiesNoNot used. No tracking, no session management.
localStorageNoDeliberately avoided — not reliable across all school device configurations.
sessionStorageNoNot used.
IndexedDBNoNot used.
Cloud storageNoNo server exists. No cloud integration of any kind.
Browser cacheNo student dataThe browser may cache the HTML file and fonts, but student data is never written to cache.

What IS used

File download/upload only. The teacher explicitly saves their data as a .json file using the browser's download function (or the device's share sheet on mobile). Loading data requires the teacher to explicitly select a file. At no point is data persisted automatically.

Important: If a teacher closes the browser tab without saving, all unsaved data is lost. The app warns about this via a browser-native "unsaved changes" prompt, but it cannot prevent data loss if the teacher dismisses the warning or the browser crashes.

Where the file lives

The saved .json file is stored wherever the teacher chooses to save it — typically:

Behaviour Book has no knowledge of where the file is stored after download. It does not access the file system, watch for changes, or sync in the background.

What Data Is Collected

Behaviour Book collects only what the teacher explicitly types in. There is no automated data collection of any kind.

Data typeExamplesEntered bySent anywhere?
Student name"Emma T.", "Liam N."TeacherNo
Grade/class"Year 3"TeacherNo
Student notes"Has an IEP"TeacherNo
Behaviour entriesType, category, location, description, actionTeacherNo
TimestampsDate/time of entryAuto-generated locallyNo
Follow-up notes"Call mum on Friday"TeacherNo
Teacher notes"Met with parents today"TeacherNo
SettingsExpectations, categoriesTeacherNo

What is NOT collected

Australian Privacy Compliance

Behaviour Book's architecture is designed to sit outside the scope of most data protection obligations because it does not collect, transmit, or store data on any system controlled by a third party. However, teachers and schools should be aware of the following:

Privacy Act 1988 & Australian Privacy Principles (APPs)

PrincipleRequirementBehaviour Book
APP 1 Open and transparent management of personal information This privacy page. The data file is human-readable JSON.
APP 3 Collection of solicited personal information must be necessary Only behaviour-relevant data is collected. No extraneous fields.
APP 5 Notification of collection The teacher themselves enters all data. No covert collection occurs.
APP 6 Use or disclosure of personal information Data is never disclosed to any third party. It exists only on the teacher's device.
APP 8 Cross-border disclosure Not applicable. No data leaves the device. Google Fonts and jsDelivr receive standard HTTP headers (IP address) but no student data.
APP 11 Security of personal information Data security is the responsibility of the teacher/school's device and file management. The app cannot be breached because there is nothing to breach — no server, no database.

State and territory legislation

Government schools are subject to state/territory privacy legislation rather than the federal Privacy Act. Because Behaviour Book does not transmit or store data externally, it does not introduce new privacy obligations beyond those the school already has for managing student records on school devices.

Recommendation: Schools should treat the saved .json file with the same care as any other document containing student names and behaviour information — store it securely, don't share it with unauthorised persons, and delete it when no longer needed.

Children's Online Privacy Code 2026

The OAIC's Children's Online Privacy Code (expected December 2026) applies to online services that collect children's personal information. Behaviour Book does not collect children's information itself — the teacher records observations about student behaviour on their own device. The app has no interaction with students and no online service component. However, schools should confirm with their legal advisors whether their use of any classroom tool falls within the Code's scope.

Security Considerations for IT Administrators

Risk assessment

RiskLikelihoodMitigation
Data breach via server compromise Impossible No server exists. There is nothing to compromise.
Unauthorised access to student data Same as any local file Governed by device access controls (password, biometrics) and file permissions. Same risk profile as a Word document.
Data loss (teacher loses file) Moderate The app prompts to save regularly. Teachers should keep dated backup copies. The file is small (<100KB typically) and can be emailed to oneself.
Malicious code in the HTML file Very low The file can be inspected in any text editor. It loads Alpine.js from a pinned CDN version (3.14.9). No other scripts are loaded.
Supply chain attack (compromised CDN) Very low Alpine.js is loaded from jsDelivr with a pinned version. For maximum security, the school can inline the Alpine.js script directly into the HTML file (~20KB).

Recommended deployment for schools

  1. Host the HTML file on your school intranet or SharePoint. Teachers access it via a local URL. No internet needed after first load.
  2. Or distribute the file directly. Email it, put it on a shared drive, or install it on school-managed devices.
  3. Establish a save location policy. Recommend teachers save their data files to a specific school drive or folder that is backed up and access-controlled.
  4. For maximum isolation: Download Alpine.js, embed it inline in the HTML file, and remove the CDN link. The app then requires zero internet access.
Content Security Policy recommendation

If hosting on a school web server, you can add a strict CSP header:
Content-Security-Policy: default-src 'self'; script-src 'self' cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src fonts.gstatic.com;

Source Code Transparency

Behaviour Book is a single HTML file. All code — HTML structure, CSS styling, and JavaScript logic — is visible in the file itself. There is no compiled code, no minified bundles, and no obfuscation.

Any technically competent person can open the file in a text editor and verify:

Frequently Asked Questions

Can the developer see my data?

No. There is no mechanism for anyone other than the teacher to access the data. There is no server to send it to, no account to associate it with, and no analytics to capture it.

Is student data encrypted?

The saved JSON file is not encrypted. It's plain text. If your school requires encryption, save the file to an encrypted drive or folder (e.g. BitLocker on Windows, FileVault on Mac, or an encrypted school network share).

What happens if a teacher loses their file?

The data is gone. There is no cloud backup and no recovery mechanism. We recommend teachers keep multiple dated copies and use their school's standard backup procedures.

Can multiple teachers share a file?

Yes, but only one teacher should edit the file at a time. The file can be shared via email, USB, or shared drives. There is no real-time collaboration — each save creates a new file.

Does the app work on school-managed devices (Chromebooks, iPads)?

Yes. It runs in any modern browser (Chrome, Safari, Firefox, Edge). No software installation is required. On managed devices, the IT admin can whitelist the two CDN domains (fonts.googleapis.com, cdn.jsdelivr.net) or host the file locally with embedded dependencies.

Does the app comply with GDPR?

Behaviour Book does not process personal data in the GDPR sense — it does not collect, store, or transmit data to any data controller or processor. The teacher's local device is the only place data exists. However, schools with EU obligations should consult their DPO.

Can I audit the app's network activity?

Yes. Open your browser's Developer Tools (F12), go to the Network tab, and use the app normally. After the initial page load (fonts + Alpine.js), you will see zero network requests. Every action — logging, viewing, saving — happens locally.

Contact

For privacy questions, technical queries, or to report a concern:

Email: nicolas@shelfengineering.com

References