Using these tools in a school
This page is for a teacher, a school's IT staff or a district privacy reviewer deciding whether students may open one of the tools under Tools and games. For each tool it says what the page sends, what it keeps in the browser, what the device has to allow, and how that was checked.
What the tools have in common
Each tool is a static page that GitHub Pages serves from sgilson7.github.io. There is no account, no login and no server of mine behind any of them. Each tool page sets a Content-Security-Policy whose connect-src is 'self' and whose form-action is 'none', so the browser refuses a request from the page to another origin; the policy is in the page source for anyone to read.
GitHub logs the IP address of each visitor to a Pages site for security purposes, as GitHub's documentation states. That record is the host's. The tools themselves receive nothing.
The tools run their rules in WebAssembly. A Chrome policy that turns off JavaScript JIT (DefaultJavaScriptJitSetting) also turns off WebAssembly, and the student tools then show a message saying so. Where a tool saves or opens a file, Chrome's DownloadRestrictions and AllowFileSelectionDialogs policies can block that step, and the student tools say so beside the button.
Browser storage belongs to the whole of sgilson7.github.io, which also serves the games. The table says which tools keep anything in the browser. On a shared student device, prefer the tools that keep nothing.
Asking IT to allow a tool
A teacher can send this, with the tool's address filled in:
Please allow students to open https://sgilson7.github.io/TOOL/ during class. It is a static web page with no login and no account. Its Content-Security-Policy allows connections only to sgilson7.github.io, and what a student types or opens stays in their browser tab. It needs WebAssembly, and saving or opening files if the tool uses them. If the filter blocks github.io as a whole, an allow rule for the single host sgilson7.github.io is enough: github.io is on the Public Suffix List, so each user's host is its own site. What each tool sends and keeps is listed at https://sgilson7.github.io/schools/.
Tool by tool
| Tool | For | What leaves the device | Kept in the browser | The device has to allow | How it was checked |
|---|---|---|---|---|---|
| Practice Results | students, then the teacher | Nothing the student does. A result file is saved on the device under a nickname the student chooses | Nothing | WebAssembly; saving and opening files | A browser check in three engines fails on any request after the page is ready, any request to another origin, and anything left in browser storage; five planted leaks at two points were each caught |
| Warm-ups and Exit Tickets | the teacher builds a set, students answer | Nothing a student answers | Nothing | WebAssembly; saving and opening files | The same browser check and planted-leak proof |
| Packet Alley | students | Nothing: the simulated network is values in the game's core, which cannot reach a real network | Stars earned | WebAssembly | A browser check in three engines fails on any request after the page is ready, any request to another origin, and any browser storage beyond the saved stars; five planted leaks were each caught |
| Circus Math Lab | students | Nothing | The language choice | WebAssembly; WebGL 2 | The same strict browser check, with storage allowed only for the language choice; five planted leaks were each caught |
| BT Lab | the teacher demonstrates, students try | Nothing | The behaviour tree being edited | WebAssembly | A browser check in three engines fails on any Content-Security-Policy violation and on any request to another origin |
| Feedback Drafts | teachers | Nothing: names and notes stay in the open page | Nothing | WebAssembly; saving a file | A browser check in three engines fails on any request to another origin, and a source test bans browser storage |
| Status Trends | teachers | Nothing: the file you open stays in the tab | Nothing | WebAssembly; opening a file | A browser check fails on any request after the page is ready and on anything left in storage; five planted leaks were each caught |
| PDF Signature Adder | adults | Nothing: the PDF and the signature stay in the tab | Nothing | WebAssembly; opening and saving a file | The same strict browser check and planted-leak proof |
| PDF Redactor | teachers and researchers | Nothing: the PDF is opened, redacted and saved in the tab. Text recognition loads its files from this site on first use | A record of each export made of hashes and counts, which by design holds no names or document text | WebAssembly; opening and saving a file | Browser tests of opening, recognition and export fail on any policy violation or request to another origin |
| Perturbation Workbench | instructors and researchers | Nothing | The session, including question text and notes | WebAssembly; opening a file | Browser tests fail on any policy violation or request to another origin. Use it on your own device |
| MP4 to Transcript | researchers | Nothing: the recording stays on the computer, and the speech models load from this site | Nothing | WebAssembly; a large first download | A browser check in three engines |
| Research Discovery Lab | researchers | Nothing is sent by the page; links you choose open other sites | The profile IDs you type | nothing beyond a current browser | A browser check in three engines |
| YouTube to MP3 | adults preparing presentations | The page sends nothing. In Record it here, YouTube's embedded player loads from youtube-nocookie.com and makes its own requests | Nothing | screen sharing of a tab's sound; saving a file | Not meant for students: YouTube's terms limit downloading, and a school filter may class it as a downloader |
The accessibility of every tool page listed here was audited with axe-core against WCAG 2.1 A and AA on 19 October 2026, and the failures it found were fixed. That audit does not replace a test with a screen reader, which has not been done.