Privacy
Last updated 8 September 2026
OpenGrader is a free, open-source grading assistant. It has no accounts, no database, and no analytics. This page describes exactly what happens to everything you put into it. It is written so you can check it against the source code rather than take it on trust — the relevant files are named throughout, and the whole project is public.
The short version
Nothing you put into OpenGrader is stored on our servers. Your rubric and your students’ writing pass through the site on their way to the AI provider you choose, exist in memory for the length of one request, and are then gone. Your work is kept in the tab you are working in, and is deleted when you close it. We keep no copies, no logs of content, and no record that you were here.
What passes through our server, and why
When you press Grade, the rubric, one student’s submission and your API key are sent to /api/grade on this site, which forwards them to the AI provider you picked and returns the answer. This step exists because a browser cannot call those provider APIs directly.
That route holds all three in memory for the duration of the request and nothing more. It writes nothing to disk, keeps no queue, and logs no request or response bodies — no rubric, no student writing, no key, no names. The only state that outlives a request anywhere on the server is an in-memory counter of how many requests an IP address has made in the last minute, used to stop abuse, which expires within that minute.
Your API key
The key is yours and the bill is yours. It is kept in your browser’s sessionStorage by default, which is erased when you close the tab. It moves to longer-term storage only if you tick “Remember this key on this device” yourself, which is never ticked for you. It is sent to our server only as part of a grading request, and only ever forwarded to the provider you selected.
Student writing
Rubrics, submissions, grades and any feedback you edit are kept in the tab you are working in, so that reloading the page does not cost you an evening’s work. That storage is scoped to the single tab and is deleted when you close it. It is deliberately not longer-term browser storage: teachers work on shared staffroom machines and laptop carts, and a class set of student writing should not be sitting on that disk for whoever opens the browser next.
Google Drive, if you use it
Connecting Google Drive is optional and the rest of OpenGrader works without it. If you do connect it, we request a single permission: drive.file. That is the narrowest access Google offers. It does not grant access to your Drive. It grants access only to the specific documents you hand over, one at a time, through Google’s own file picker — and to nothing else.
With that permission OpenGrader reads the documents you pick: their text, who owns them (so a student’s name is right rather than guessed from a filename) and, when you ask for it on a particular student, that document’s edit history. Reading the edit history goes through our server, because Google does not permit a browser to fetch it directly. That request carries your Google access token, is used once, and is not stored or logged. The full history is summarised on the server and only the summary comes back, so the bulk of a student’s writing never leaves that function.
You can withdraw this at any time from your Google account permissions page, without asking us.
Limited Use
OpenGrader’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google APIs is used only to provide the features you have asked for, in your browser and in the moment you ask. It is never sold, never transferred to anyone except the AI provider whose key you supplied and only for the request you initiated, never used for advertising, and never used to train any model. No human at OpenGrader reads it, because it is not kept anywhere for anyone to read.
Who else sees your data
The AI provider you choose — Anthropic, OpenAI or Google — receives the rubric and the submission being graded, because that is what grading is. Their handling is governed by their own terms and by the account your key belongs to. Google receives the requests for the documents you pick, as your own account. There is no one else: no analytics provider, no error-reporting service, no advertiser, no third party of any kind.
Children’s data
Submissions you grade will usually be written by children. We hold none of it. OpenGrader stores no student work, keeps no identifiers, and builds no profiles, so there is nothing retained about any pupil. Whether it is appropriate to send a particular student’s writing to a particular AI provider is a decision for you and your school, and your school’s data protection rules apply to it.
Cookies and tracking
None. There are no cookies, no tracking pixels, no analytics and no fingerprinting. Nothing follows you between visits, and there is no record on our side that a visit happened.
Changes
If this page ever stops matching what the code does, the code is right and this page is a bug. It is versioned alongside the source, so the history of what it said is public.
Contact
OpenGrader is an open-source project. Questions, corrections and privacy requests can be raised as an issue on the project repository.