Last updated: 2026-11-14
In one sentence: your homework data lives on your own computer. Only two things leave it, and both are your decision — the control pairing you switch on yourself, and the platform statistics you can turn off in settings.
1. What is stored locally
| What | Where (under the application data directory) | Notes |
|---|---|---|
| Assignments and notes | data/board/<year>/<month>/<day>/*.cbnote | One file per assignment, rich text and handwriting included |
| Replay history | data/history/board/ | Append-only log behind the replay view |
| Settings | data/config/settings.json | Interface, board and update preferences |
| Device ID | data/config/sectl-device.json | A randomly generated UUID used to tell devices apart |
| Pending counters | data/config/usage-stats.json | Usage increments not yet sent |
None of it is uploaded to any cloud storage. Deleting the application data directory wipes the local data.
2. What control pairing sends
Control only dials out if you turn it on in Settings → Control; the master switch is off by default.
- When pairing: the client hands the location ID and pairing code issued by the console to the control platform and receives credentials in return (stored locally, encrypted with AES-GCM).
- After pairing: the platform knows the device is online, which is what the console uses to show status and select devices by class.
- Not sent: note contents, handwriting, subjects, class lists or file names.
- After revoking: the local credentials are cleared and the device stops reconnecting.
See Control for the details.
3. Platform statistics (can be switched off)
The application reports three kinds of data to SECTL's aggregation endpoint, POST https://sectl.cn/api/stats/report:
| Kind | Contents | Frequency |
|---|---|---|
| Online heartbeat | Platform identifier, random device ID, device type (e.g. windows-desktop) | Every 2 minutes |
| Version report | Application version, random device ID | Once per launch |
| Usage | Launches today, assignments created today, exports today (counts only) | Batched |
A few clarifications:
- The heartbeat contains no IP address, city or account; the online count is a rough figure derived by the server from the request address.
- Usage counts record how many times something happened, never what was written or exported.
- To turn it off: Settings → Basic → Privacy, where the options are Normal, Anonymous and Off. With Off the application makes no network request at all.
- The updater requests a signed manifest and packages from GitHub (or the
ghproxy.sectl.cnmirror). That request is read-only and uploads nothing.
4. This website
This site is static:
- No third-party analytics, no ads, no tracking cookies.
- Two outbound requests can happen: the download page reads the GitHub API for the releases list (read-only, used to show version numbers and file names), and icons that are not bundled ask the Iconify public icon service for icon data.
- Server access logs are kept by the operator (SECTL) as needed for troubleshooting and security incidents.
5. Contact
Questions about privacy, or about a specific piece of data collection: open an issue at GitHub Issues, or reach SECTL through sectl.cn.
When this notice changes, the "last updated" date above changes with it; any material change to what is collected is also noted in the application's release notes.