A complete technical and legal overview of how Behaviour Book handles student data. Designed to be shared with IT administrators and school leadership.
Last updated: 10 May 2026
.json file to their device. Loading the app reads from that file. That's the only persistence mechanism.Behaviour Book is a single HTML file (~3,500 lines) containing all HTML, CSS, and JavaScript. When a teacher opens it in a browser, the entire application runs locally on their device. There is no server component.
Teacher's device (browser tab) ← all data lives here
↓ Save button → downloads a .json file to the device's file system
↑ Load button → reads a .json file from the device's file system
↕ No network requests are made to send or receive student data
All student names, behaviour entries, notes, and settings exist only in the browser tab's JavaScript memory. When the tab is closed, the data is gone — unless the teacher has saved it to a file.
The .json file is a plain-text file containing:
The file is human-readable. Teachers can open it in any text editor to inspect exactly what's stored. No data is encrypted, obfuscated, or hidden.
When a teacher opens the HTML file in a browser with internet access, two resources are loaded:
| Resource | From | Purpose | Data sent to them |
|---|---|---|---|
| Nunito + Fraunces fonts | fonts.googleapis.com | Typography | Standard HTTP request headers only (IP address, user agent). No student data. |
| Alpine.js v3.14.9 | cdn.jsdelivr.net | UI framework (reactivity) | Standard HTTP request headers only. No student data. |
fetch() or XMLHttpRequest calls to any serverIT administrators can verify this by opening the browser's Developer Tools (F12) → Network tab while using the app. After the initial page load, you will see zero network requests during normal use (logging entries, viewing students, etc.). The Save function uses URL.createObjectURL() to generate a local download — no upload occurs.
The app can run with no internet connection at all. If the HTML file is opened locally and the fonts/Alpine.js have been cached by the browser (from a previous session), or if Alpine.js is embedded directly into the file, the app works entirely offline. The only difference is that fonts may fall back to system defaults.
| Storage mechanism | Used? | Reason |
|---|---|---|
| Cookies | No | Not used. No tracking, no session management. |
| localStorage | No | Deliberately avoided — not reliable across all school device configurations. |
| sessionStorage | No | Not used. |
| IndexedDB | No | Not used. |
| Cloud storage | No | No server exists. No cloud integration of any kind. |
| Browser cache | No student data | The browser may cache the HTML file and fonts, but student data is never written to cache. |
File download/upload only. The teacher explicitly saves their data as a .json file using the browser's download function (or the device's share sheet on mobile). Loading data requires the teacher to explicitly select a file. At no point is data persisted automatically.
The saved .json file is stored wherever the teacher chooses to save it — typically:
Behaviour Book has no knowledge of where the file is stored after download. It does not access the file system, watch for changes, or sync in the background.
Behaviour Book collects only what the teacher explicitly types in. There is no automated data collection of any kind.
| Data type | Examples | Entered by | Sent anywhere? |
|---|---|---|---|
| Student name | "Emma T.", "Liam N." | Teacher | No |
| Grade/class | "Year 3" | Teacher | No |
| Student notes | "Has an IEP" | Teacher | No |
| Behaviour entries | Type, category, location, description, action | Teacher | No |
| Timestamps | Date/time of entry | Auto-generated locally | No |
| Follow-up notes | "Call mum on Friday" | Teacher | No |
| Teacher notes | "Met with parents today" | Teacher | No |
| Settings | Expectations, categories | Teacher | No |
Behaviour Book's architecture is designed to sit outside the scope of most data protection obligations because it does not collect, transmit, or store data on any system controlled by a third party. However, teachers and schools should be aware of the following:
| Principle | Requirement | Behaviour Book |
|---|---|---|
| APP 1 | Open and transparent management of personal information | This privacy page. The data file is human-readable JSON. |
| APP 3 | Collection of solicited personal information must be necessary | Only behaviour-relevant data is collected. No extraneous fields. |
| APP 5 | Notification of collection | The teacher themselves enters all data. No covert collection occurs. |
| APP 6 | Use or disclosure of personal information | Data is never disclosed to any third party. It exists only on the teacher's device. |
| APP 8 | Cross-border disclosure | Not applicable. No data leaves the device. Google Fonts and jsDelivr receive standard HTTP headers (IP address) but no student data. |
| APP 11 | Security of personal information | Data security is the responsibility of the teacher/school's device and file management. The app cannot be breached because there is nothing to breach — no server, no database. |
Government schools are subject to state/territory privacy legislation rather than the federal Privacy Act. Because Behaviour Book does not transmit or store data externally, it does not introduce new privacy obligations beyond those the school already has for managing student records on school devices.
.json file with the same care as any other document containing student names and behaviour information — store it securely, don't share it with unauthorised persons, and delete it when no longer needed.
The OAIC's Children's Online Privacy Code (expected December 2026) applies to online services that collect children's personal information. Behaviour Book does not collect children's information itself — the teacher records observations about student behaviour on their own device. The app has no interaction with students and no online service component. However, schools should confirm with their legal advisors whether their use of any classroom tool falls within the Code's scope.
| Risk | Likelihood | Mitigation |
|---|---|---|
| Data breach via server compromise | Impossible | No server exists. There is nothing to compromise. |
| Unauthorised access to student data | Same as any local file | Governed by device access controls (password, biometrics) and file permissions. Same risk profile as a Word document. |
| Data loss (teacher loses file) | Moderate | The app prompts to save regularly. Teachers should keep dated backup copies. The file is small (<100KB typically) and can be emailed to oneself. |
| Malicious code in the HTML file | Very low | The file can be inspected in any text editor. It loads Alpine.js from a pinned CDN version (3.14.9). No other scripts are loaded. |
| Supply chain attack (compromised CDN) | Very low | Alpine.js is loaded from jsDelivr with a pinned version. For maximum security, the school can inline the Alpine.js script directly into the HTML file (~20KB). |
If hosting on a school web server, you can add a strict CSP header:
Content-Security-Policy: default-src 'self'; script-src 'self' cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src fonts.gstatic.com;
Behaviour Book is a single HTML file. All code — HTML structure, CSS styling, and JavaScript logic — is visible in the file itself. There is no compiled code, no minified bundles, and no obfuscation.
Any technically competent person can open the file in a text editor and verify:
No. There is no mechanism for anyone other than the teacher to access the data. There is no server to send it to, no account to associate it with, and no analytics to capture it.
The saved JSON file is not encrypted. It's plain text. If your school requires encryption, save the file to an encrypted drive or folder (e.g. BitLocker on Windows, FileVault on Mac, or an encrypted school network share).
The data is gone. There is no cloud backup and no recovery mechanism. We recommend teachers keep multiple dated copies and use their school's standard backup procedures.
Yes, but only one teacher should edit the file at a time. The file can be shared via email, USB, or shared drives. There is no real-time collaboration — each save creates a new file.
Yes. It runs in any modern browser (Chrome, Safari, Firefox, Edge). No software installation is required. On managed devices, the IT admin can whitelist the two CDN domains (fonts.googleapis.com, cdn.jsdelivr.net) or host the file locally with embedded dependencies.
Behaviour Book does not process personal data in the GDPR sense — it does not collect, store, or transmit data to any data controller or processor. The teacher's local device is the only place data exists. However, schools with EU obligations should consult their DPO.
Yes. Open your browser's Developer Tools (F12), go to the Network tab, and use the app normally. After the initial page load (fonts + Alpine.js), you will see zero network requests. Every action — logging, viewing, saving — happens locally.
For privacy questions, technical queries, or to report a concern:
Email: nicolas@shelfengineering.com