How Grademaxxing handles your information

Signing in

Your browser sends your credentials over HTTPS to this Grademaxxing server. The server uses them to establish a session with the official StudentVUE portal, then discards the password. It is never written to our disk, logs, or server session.

While you are signed in

The active StudentVUE session state is encrypted and authenticated inside a secure, HTTP-only app cookie for up to 12 hours. The server uses it only to proxy read-only student information, and browser scripts cannot read it.

Local data and signing out

If you choose “Keep me signed in,” your district, username, and password are encrypted on this device. The encryption key is held in IndexedDB as a non-exportable browser key, while only ciphertext is stored in browser storage. Grade data used by the interface may also be cached on your device. Signing out deletes the active server session, saved credentials, and local caches.

Max conversations

Max saves up to 20 recent chats on this device, encrypted with a non-exportable browser key. Each chat expires 30 days after its last update. Each chat keeps at most its latest 120 messages; this message limit does not extend the expiration period. You can reopen, delete, or clear them from the chat sidebar. Signing out clears this device’s saved chats with the other local caches. Conversation context and relevant saved-chat excerpts may be sent to AI providers when you ask Max a question. Max can retrieve requested assignment details and teacher notes, attendance, schedule, school and profile fields, mail senders, recipients and bodies, document text, and feedback conversations available through your saved receipts. These lookups use your signed-in app access; authentication secrets and administrator-only records are excluded. File formats without extractable text are not read visually. Current app records remain the source for current grades and attendance.

Max companion

When the optional Max workspace is enabled, its chats, replies, uploaded files, notes, and settings are stored by the separate chat service under an opaque account identity. These are separate from Max's encrypted device archive and are not deleted by signing out of Grademaxxing. Delete chats and files in Max to remove them; the legacy 30-day expiration does not apply to this service. Importing old chats copies them to this service. Relevant conversation and file excerpts may be sent through the same AI providers when you ask a question. Portal credentials are not provided to Max. Current app data remains the source of truth for grades and calculations.

If you use the microphone or voice mode, your recording is sent to Google Gemini for transcription. The transcript becomes a chat message when submitted. Spoken replies are generated by sending the reply text to Gemini's speech service. Grademaxxing's audio adapter processes recordings in memory and does not save raw audio. Your browser asks for microphone permission before recording.

Max reliability diagnostics

Administrators can review request times, broad question topics, provider/model attempts, tool names and outcomes, timings, error codes, output character counts, and reliability flags. These diagnostics exclude AI replies, conversation history, retrieved school records, tool arguments/results, account identifiers, IP addresses, and credentials. Automatic flags identify technical symptoms, not whether an answer is factually correct. You can report an empty, incorrect, unhelpful, or poorly formatted reply; only the issue category is attached to its diagnostic record.

The public production app does not include question text in these diagnostics. In the local development testing setup, user questions are automatically included for the developer to diagnose Max; AI replies and other conversation context remain excluded. Basic email, link, account-name and secret redaction reduces accidental exposure but does not guarantee anonymity. Avoid personal details or school records in test questions. Diagnostics have a 7-day review window; expired rows are deleted on the next diagnostic read or write. Administrators can clear all diagnostics sooner. Signing out clears local chats but does not delete existing diagnostics.

Invite-only referrals

Invited referrers are created privately by the administrator using their name and email. Visitors opening a referral link go directly to the standard StudentVUE sign-in and are counted only if Grademaxxing's one-way protected student key shows they are a new user. We do not store the referred student's name or email for referrals. Referral attribution stays separate from StudentVUE credentials, grades, and school records.