Overhead

Overhead is an iPad document camera app built by RSU 87 for use in its own classrooms. It is distributed privately to district staff through Apple School Manager and is not available on the public App Store.

This policy describes exactly what the app does with information. Every statement below is a description of how the app is built, not a general assurance.

What Overhead does not collect

• No analytics or usage tracking. The app contains no analytics service and no third-party crash reporting.
• Apple's own crash reporting is the one exception worth naming. If a user has turned on sharing with app developers in iOS settings, Apple may pass RSU 87 anonymous crash reports — a stack trace and device model, provided by Apple, not collected by the app. Overhead has no code that gathers or sends this, and the reports contain no images, boards, scans or account details.
• No advertising and no tracking identifiers. No ads are shown, and the app does not request the advertising identifier or track users across apps or websites.
• No third-party SDKs. The app depends on no external libraries — only Apple's own frameworks and, if a teacher signs in, Google's published web APIs.
• No accounts. Overhead has no sign-up, no username and no password.
• No location data, contacts, microphone or health data. The app never requests these.
• No Drive contents. Although sign-in grants access to the whole of a teacher's Drive (see below), the app reads only folder names when browsing. It never reads, copies or transmits the contents of any document.

This is the basis for the Data Not Collected declaration on the app's App Store page.

What the app stores, and where

Everything Overhead creates is stored on the iPad, inside the app's own storage.

None of this is transmitted anywhere by the app. Deleting the app removes all of it from the device.

Note that a district iPad may be included in the district's own device backup or management arrangements. That is a property of the iPad, not of Overhead.

Camera

Overhead requests camera access to do its job: showing a page, book or object on the classroom display. The live image is shown on screen and, when a second display is connected, on that display. It is not recorded, and nothing is transmitted. A still image exists only when a teacher freezes the picture, and only persists if the teacher saves it.

Photos

Overhead requests add-only access to Photos. This lets it save a frozen frame or a marked-up page to the teacher's photo library at the teacher's request. The app cannot read, browse or delete existing photos, because add-only access does not grant that.

Separately, a teacher may choose a photo to import and mark up. That uses the system photo picker, which hands the app the one image the teacher picked and grants no access to the rest of the library.

Optional Google sign-in

If the district enables it, a teacher may sign in with their district Google account so pages and scanned PDFs can be saved to their own Google Drive, and so documents and slide decks already in Drive can be opened for markup. This is optional, and every other feature works without it.

When a teacher signs in:

• Overhead requests three permissions: openid and email (to confirm which account signed in), and drive.
• drive is full access to that account's Google Drive. Stated plainly: the permission a teacher grants allows the app to read, create and modify any file in their Drive, not only files it created. This is broader than a document camera needs for saving a page, and it is the honest description of what is being granted.
• Why it is requested. Teachers asked to save pages into folders they already have, to browse My Drive and shared drives to pick one, and to open a worksheet or slide deck that already exists in Drive. Google's narrower drive.file permission only ever exposes files the app itself created, so a folder browser under it can show nothing else, and an existing deck could not be opened at all — the limitation is in the permission, not the app.
• What the app actually does with it. List folders, list shared drives, search by name, create a folder, upload a file, and — only for a file the teacher has explicitly picked — download or export that one file so it can be marked up. Overhead does not index, bulk-read or modify existing documents, and it contains no code to do so.
• Sign-in uses the standard OAuth 2.0 authorization-code flow with PKCE, in a system browser session. Overhead never sees the account password.
• The resulting refresh token is stored in the iPad's Keychain and is used only to keep the teacher signed in. Signing out removes it.
• Uploads go to My Drive by default, or to a folder the teacher picked. Files placed there are then governed by Google Workspace and district policy, the same as anything else in a staff member's Drive.
• Where the district has configured domain restriction, only accounts in the district's Google Workspace domain can sign in. This exists to stop school material being saved into a personal Google account.

Signing out removes the stored token from the device. Files already uploaded remain in Drive, because they belong to the teacher's Drive — remove them there.

Network activity

With no Google account signed in, Overhead makes no network requests. It needs no internet connection to run.

If a teacher signs in, the app contacts only:

• accounts.google.com — sign-in
• oauth2.googleapis.com — token exchange and refresh
• www.googleapis.com — listing and searching folders and shared drives, creating folders, uploading files, and exporting a picked document or deck to PDF

No RSU 87 server is involved in any of the above, and no data is sent to the app's developers. The one capability that would contact a district server is described next, and it is switched off.

Overhead pins nothing to an RSU 87 host and has no telemetry endpoint. If you are auditing the binary, those three Google hostnames are the complete list of what an unconfigured install can reach.

Class sessions

A capability present in the app, off by default, and not in use today.

Overhead contains the beginnings of a class session feature: a teacher displays a page with answer boxes on it, students join from their own device and type or write an answer, and the answers appear on the teacher's board. This is the only part of Overhead that would involve a district server.

It is documented here rather than left until later because the design decisions that protect students were made up front, and they are the reason the feature is shaped the way it is:

• Nothing is retained. A session lives in the relay's memory for the length of the lesson and is gone when it ends. The relay has no database, so there is nothing stored to breach, to purge or to produce on request.
• A student's name is used for attribution and never saved. It exists in memory for the lesson so the teacher can see who answered. It is never written into a saved board, an export or a thumbnail — a board saved after a session carries the answers, not the names.
• The relay holds no roster and no credentials. It never receives a class list, a Google account or a password. Students join a live session with a room code; they do not have accounts on it.
• What actually transits is a student's display name, the answer text they typed, and pen strokes as normalised coordinates — nothing else. No camera image, no photo and no file is sent.
• Encrypted in transit. The app refuses a relay address that is not a secure WebSocket, so student work cannot cross a school network in the clear.
• Only district iPads can start a session. Starting one requires a shared secret pushed by management, which stops anyone else opening sessions on the district's relay.

This policy will be revised, and staff told, before the feature is enabled on any classroom iPad.

Student information

A document camera is usually pointed at classroom material, and that material may include student work bearing student names.

Overhead does not identify, analyse or transmit anything in an image. It does not perform text recognition, face detection or any other analysis of what the camera sees. An image is only ever a picture.

Because that picture can contain student information, two things matter:

1. Nothing leaves the iPad unless a teacher chooses to save or upload it.
2. When a teacher does upload to Google Drive, the resulting file is subject to district policy and applicable student-records law, including FERPA, exactly as it would be if the teacher had photographed the page and uploaded it themselves.

Staff should apply the district's existing guidance on student records when deciding what to save or share.

Children

Overhead is a tool for staff, used on teacher-managed iPads. It contains no advertising, no in-app purchases, no third-party content, no messaging or chat, no user-generated content shared between users and no unrestricted web access. It collects no information from anyone, including children.

Accounts and deletion

Overhead has no account of its own to create or delete. The only sign-in is the optional Google one described above, and it uses an account the teacher already has.

• To disconnect Google from the app, sign out in Settings. The stored token is removed from the iPad.
• To revoke the app's access entirely, remove Overhead at myaccount.google.com/permissions. This works whether or not the app is still installed.
• To remove everything the app holds, delete Overhead from the iPad. Boards, imported documents and scans go with it.

District configuration

District IT can configure Overhead through mobile device management. The available settings are the Google client ID, whether sign-in is restricted to district domains, which domains are allowed, the Drive folder name, a board-count warning threshold, and a logo and name shown on a connected projector while no page is displayed. These are configuration values only — no information about users or devices is sent anywhere as a result of them.

The projector logo is supplied as image data in the configuration itself rather than as a web address, deliberately: fetching it would be a network request, and the app makes none unless a teacher signs in to Google.

Retaining and deleting information

Whiteboards, imported documents and scans stay on the iPad until deleted, deliberately: the point is that a worksheet can be reused next term and next year. Nothing is deleted automatically as routine housekeeping.

• To delete one item, remove it in the app's Boards & Scans library.
• To delete everything, delete the app from the iPad.
• To remove a Drive upload, delete the file in Google Drive.

Selling or sharing information

RSU 87 does not sell, rent or share information from Overhead. There is no information collected to sell, and no third party receives anything from the app.

Contact

Questions about this policy, or about Overhead:

Changes

If the app's behaviour changes in a way that affects this policy, the policy will be updated and the effective date above revised.

Other STO Apps

This policy covers Overhead. The other apps described on the apps page are internal district tools, distributed to staff devices through the district's own management and not published to any app store. They are governed by RSU 87's district policies rather than by this document; ask the Technology Department for specifics on any one of them.