Privacy Policy

Effective date: June 26, 2026

Version: 1.0

Extension version: 1.5.1

Published by: Digital Accessibility Services (DASH), University of Georgia

Overview

The UGA Digital Accessibility Checker is a Chrome browser extension that helps University of Georgia staff evaluate web pages and PDF documents for accessibility conformance against WCAG 2.1 and 2.2 guidelines. This privacy policy describes what data the extension accesses, how it is processed, and what protections are in place.

In summary: this extension processes all data locally in your browser. It does not collect, store, or transmit any personal information, page content, or scan results to any external server.

Data Processing

What the extension accesses

When you activate the extension by clicking its icon, it accesses the following data on the current page:

• Page DOM structure — HTML elements, attributes, and text content are analyzed in-place by the axe-core accessibility engine to detect WCAG violations
• Page CSS — Computed styles are read to evaluate color contrast, text sizing, and visual presentation
• PDF document structure — When scanning a PDF, the extension reads document metadata (title, author, language), structural tags, bookmarks, form field labels, and text content to assess accessibility
• Link URLs — URLs of links on the page are checked for reachability via standard HTTP HEAD requests

How data is processed

All accessibility analysis runs entirely within your browser tab. The extension operates the same way browser Developer Tools do — it inspects what is already loaded in your browser.

• The axe-core engine runs against the page DOM in the tab’s JavaScript context. Results are held in temporary in-memory variables and displayed in the sidebar. They are never serialized to disk or transmitted over the network.
• PDF analysis uses Mozilla’s PDF.js library to parse the PDF file locally. The PDF bytes are fetched using a standard browser request (identical to what happens when you open the PDF normally) and analyzed in-memory.
• Export reports (HTML, XLSX, CSV) are generated as local files and delivered through the browser’s built-in download mechanism. No upload or external transmission occurs.

What is stored locally

The extension stores a small amount of non-sensitive configuration data using Chrome’s chrome.storage.local API:

This data stays on your computer in Chrome’s extension storage. It is never transmitted externally and can be cleared at any time by removing the extension.

What is NOT collected

This extension does not collect, store, or transmit:

• Personal information (names, email addresses, student IDs, employee IDs)
• Authentication credentials, session tokens, or cookies
• Page content, text, images, or HTML source
• Browsing history or navigation patterns
• Scan results or accessibility findings
• Analytics, telemetry, or usage statistics
• Device identifiers or fingerprinting data
• Location data

Network Activity

The extension makes only two types of network requests, both initiated by the user:

The extension does not contact any external API, analytics service, telemetry endpoint, or server operated by the extension developers or the University of Georgia.

Third-Party Libraries

The extension bundles three open-source libraries locally within the extension package. None of these libraries make network calls, send telemetry, or collect data:

• axe-core 4.11.1 (Deque Systems) — WCAG accessibility rule engine, MIT licensed
• PDF.js 3.11.174 (Mozilla) — PDF document parser, Apache 2.0 licensed
• SheetJS 0.18.5 — Spreadsheet generation for XLSX exports, Apache 2.0 licensed

No external CDN or runtime dependency loading occurs. The Content Security Policy (script-src 'self'; object-src 'none') enforces that only scripts bundled within the extension can execute.

SHA-256 integrity hashes for all bundled libraries are documented in SECURITY.md for enterprise verification.

Use in Authenticated Environments

This extension is designed to be safe for use on pages accessed through UGA CAS single sign-on (SSO) or other authentication systems:

• The extension does not request the cookies browser permission
• It never reads document.cookie or accesses session storage
• Authentication tokens and session identifiers are never accessed, cached, or transmitted
• Content scripts run in Chrome’s isolated world, separated from the page’s authentication context
• The extension activates only when the user clicks its icon — there is no persistent background monitoring of authenticated sessions

FERPA Compliance

The extension may be used on pages containing student education records protected under the Family Educational Rights and Privacy Act (FERPA). Because all data processing occurs locally within the user’s browser and no data is transmitted to external parties, use of this extension does not constitute a disclosure of education records under FERPA. The extension functions identically to a browser’s built-in Developer Tools — it inspects content the user is already authorized to view.

SOC 2 Alignment

This extension is designed to align with SOC 2 Trust Service Criteria. A detailed compliance mapping is provided in SECURITY.md. Key points:

• Security (CC6): Least-privilege permissions, strict CSP, input sanitization, Shadow DOM isolation, no external script loading
• Availability (CC7): On-demand activation only, no background resource consumption
• Processing Integrity (CC8): Bundled libraries with verifiable SRI hashes, deterministic local processing
• Privacy (P1): No personal information collected, no data transmission, no tracking

Data Retention

• In-memory scan results are discarded when the tab is closed or the page is navigated away from
• Stored checklist states persist in Chrome’s local extension storage until the user uninstalls the extension or clears extension data
• No server-side data exists — there is nothing to retain or delete on any server

User Rights

Because this extension does not collect personal data, there is no personal data to access, correct, or delete. Users can:

• Clear all stored data by removing the extension from Chrome or clearing extension storage in Chrome settings
• Disable the extension at any time through Chrome’s extension management page (chrome://extensions)
• Review the source code — the extension is not obfuscated and all source files are readable

Changes to This Policy

Changes to this privacy policy will be documented with a new version number and effective date. Material changes will be communicated through the extension’s release notes.

Contact

For questions about this privacy policy or the extension’s data handling practices:

Digital Accessibility Services (DASH)

University of Georgia

https://dash.uga.edu