How the report builder handles data
- No server processing. The report builder is a static page. Everything you enter — names, initials, skill levels — is processed by JavaScript running in your own browser. There is no form submission and no API call carrying student data.
- No accounts, no database. We have no user accounts and no backend database. There is nothing to breach.
- "Save draft" is local only. The save button uses your browser's localStorage on your device. It never syncs anywhere. Clearing your browser data deletes it.
- Downloads are generated locally. The Word/print exports are created in your browser from the page content and saved directly to your device.
How this fits FERPA
A completed OT report is part of a student's education record, protected by the Family Educational Rights and Privacy Act — FERPA (20 U.S.C. §1232g; 34 CFR Part 99). FERPA restricts how those records may be stored and disclosed, and the surest way to protect a record is data minimization — not transmitting or storing it where it isn't needed.
That is exactly how this tool is built. Because nothing you type is ever sent off your device, using the builder creates no student record held by us — there is no copy on our servers to secure, breach, subpoena, or disclose. The only record that exists is the final report you place in your district's system.
FERPA compliance is ultimately the responsibility of your school and district (the educational agency), not of any drafting tool. This tool is built to keep you on the safe side of it by not collecting student data in the first place — but you must still follow your district's records policy for the finished report.
What the site does collect
Standard web-server access logs (IP address, page requested, timestamp) are kept by our hosting provider for security and are not linked to anything you type into the builder.
This site uses Google Analytics 4 (measurement ID
G-T4GXN2FZ5R) on every page, including the report builder, for anonymous,
aggregate page-view statistics — which pages are visited and roughly how many people visit.
Analytics never sees your work. No report content, student names or initials, checkbox selections, or anything else you enter in the builder is sent to Google Analytics or to any server — the builder is client-side only, and your inputs stay in your browser. If you use a content blocker that blocks Google Analytics, every feature of the site works exactly the same.
The site also loads a small feedback widget (from feedback.milanswers.com, operated by us) so you can report problems. It sends nothing unless you type a message into it and press Send.
Your professional obligations still apply
Even with a privacy-first tool, follow your district's documentation policy: prefer initials while drafting, review generated text before it enters the student record, and store final reports only in your district's approved systems. See the report-writing guide for a privacy-safe workflow.
Questions about this policy: contact the site operator via the domain's registered contact. Last updated July 2026.