Privacy Policy — Maxisave

The short version

Maxisave itself does not collect, transmit, sell, or share any data, and has no servers, analytics, or telemetry of its own — but two other parties are involved. Sign in with Google is required to use the extension's saving features at all: signed in, drafts, attachments, and submission history live in a hidden, app-only folder in your own Google Drive, not on any server Maxisave operates. Format with AI is a separate, genuinely opt-in feature: only if you click its button does it send the incident description and involved parties' names/ID numbers to an AI you pick, in a small separate window, under your own account there. See below for exactly what each sends and to whom.

What is stored, and where

Two layers: an internal local buffer on this machine, written the moment you type (so a brief network problem can't lose your work), and — once you sign in — your own Google Drive, which is where this data is actually meant to live going forward.

Report text

localStorage on cm.maxient.com, and once signed in, a hidden folder in your own Google Drive.

Attachments — automatic, no opt-in

IndexedDB (maxisave → attachments) locally; base64-encoded into that draft's own Drive entry once signed in.

Submission history

localStorage, and once signed in, the same Drive file — so you can look back at it and find the report number later, from any computer you're signed in on.

The local buffer is per-browser and per-machine — nothing about it moves between computers on its own. Signing in with Google is what makes drafts, attachments, and history follow you between computers; see "Sync with Google" below.

What is deliberately never stored

Session security tokens (x_requestor_token, x_requestor_ip, x_requestor_starttime) and the reCAPTCHA response.
Any field of type password.

How long it is kept

A draft is deleted when you submit the form, when you press Clear, or automatically 14 days after it was last saved — whichever comes first. You can also remove it at any time by clearing site data for cm.maxient.com in Chrome.

Submission history is different: it doesn't expire on its own. It's meant to be a record you can come back to, so it's kept until you delete it yourself — one entry at a time, or all at once with Clear all — or until it's pushed out by newer submissions once the record holds 50. Each entry keeps everything you wrote in that report, not only the report number.

Format with AI

The Format with AI button above the incident description is opt-in and does nothing until you pick an AI in the extension's settings popup and click it on the form. When you do, it sends the description text plus each involved party's name and ID number only — not role, date of birth, email, or hall address — to that AI in a small separate window, under whatever account is signed in there. That account is yours, not Maxisave's; there is no Maxisave server and it never sees the exchange. The reply replaces the description field if it parses as expected, otherwise nothing changes.

A note on FERPA. Incident reports on this form are education records about named students. A personal ChatGPT, Claude, or Gemini account is not automatically covered by the kind of data-processing agreement an institution's enterprise AI tooling would have. Check your institution's policy on using consumer AI accounts with student conduct data before using Format with AI on a real report.

Sync with Google

Signing in with Sign in with Google is the front door: the form shows only a sign-in button until you do, not a working autosave interface. Signed in, Maxisave requests exactly one Google OAuth scope — drive.appdata — access to a hidden, app-only folder in your own Google Drive that Maxisave can't see any other file in, that doesn't appear in your normal Drive view, and that nothing else in your Drive can see into either. That folder holds one file containing the same drafts and submission history described above, plus attachments (base64-encoded into that draft's own entry) — nothing more. There is no Maxisave server in this path — the extension talks directly to Google's Drive API with your account's own OAuth token. Sync runs shortly after every save, with a 30-second backstop and one more right after a submission, but only once you've signed in; it never prompts for anything on its own. The same FERPA note above applies here too, since synced content now includes attachments as well as text.

Permissions

Maxisave's core autosave feature requests no Chrome permissions and only runs a content script on cm.maxient.com/reportingform.php*. Format with AI additionally needs storage (to remember which AI you picked), scripting and tabs (to open that AI's site and paste the prompt in), and host access to chatgpt.com, claude.ai, and gemini.google.com. Sync with Google needs identity (Chrome's own OAuth sign-in) and host access to googleapis.com (to talk to the Drive API, drive.appdata scope only). Maxisave cannot see or act on any other site.

A note on sensitive content. Incident reports contain personal information about named individuals. While Maxisave is saving a draft, that text sits unencrypted in your browser profile until you submit, clear it, or the 14 days elapse — the same way an unsent draft sits in any application. Submission history is kept even longer, since unlike a draft it's meant to persist. On a shared or lab computer, press Clear before you walk away, and clear submission history from the Submitted tab if you don't need to keep it.

Changes

Any change to this policy will be published at this URL and reflected in the extension's Chrome Web Store listing.

Contact

Scalere Design — via the GitHub issue tracker

Maxisave is an independent tool. It is not affiliated with, endorsed by, or sponsored by Maxient LLC or Arizona State University.