Test 1: watch the network
- Open a TotClassroom tool, for example the math worksheets.
- Open the developer tools (F12, or Ctrl+Shift+I; on a Mac, Cmd+Option+I) and go to the Network tab. In Safari, first turn on the Develop menu in Settings.
- Clear the request list, fill in the form and press the button to create the PDF.
- Look at the list: no request sends what you typed anywhere. Uploads are POST or PUT requests, and none carries your data.
Test 2: go offline
- Open any tool after visiting the site once before.
- Turn on airplane mode or switch off Wi-Fi.
- The tool keeps working and the PDF is still created, because everything happens on your device.
Test 3: read the page’s rules
- In the Network tab, click the page request and find the content-security-policy header.
- You will see that connect-src only allows TotClassroom’s own site, blob: and data:. There are no third-party domains.
What you should see
You will see requests that download the page, the code and the fonts. Those are downloads to load the tool, not uploads of what you type. After the first visit, a copy of the site’s code stays saved in the browser so it can work offline.
What this shows and what it does not
It shows that your browser sends what you type nowhere while you use the tool. It does not protect against browser extensions or a compromised device, and the server sees the normal requests that load the website, like any other site. More detail on the privacy page.