Who a student is stays out of the grading request.
Stored names, student IDs, and cover pages are left out of every grading request. This page shows every path data can take out of the app, and what the instructor is responsible for.
The boundary
Rubrica can read each cover page with a model running on the Mac. The instructor confirms the name, and the app links it to a random eight-character code. Grading requests carry that code, the answer pages without the cover page, and the rubric.
The link between each code and each student is stored on the Mac and is left out of every grading request. It is also in any saved version, in spreadsheet exports, and in cloud backups if the instructor turns those on.
On the instructor's Mac
Sent for grading
Only when the instructor acts
Every path out
Every way data can leave the app, where it goes, and what identity travels with it.
| What | Goes to | When | Identity attached |
|---|---|---|---|
| Answer pages without the cover page, rubric, random code | Anthropic (Claude) | Grading and follow-up checks | Random code. Anything written on the page goes with it |
| Sample answer pages from up to three graded exams, rubric, text the instructor types | Anthropic | When the instructor runs rubric tools | No stored identity. Typed text goes as written |
| Blank-exam files, sent whole including the first page, and short feedback excerpts from saved audit results | Anthropic | When the instructor runs rubric tools | No student on a blank exam. Excerpts are free text |
| Class statistics and up to ten feedback comments per question | Anthropic | When the instructor generates the class diagnostic | No names or codes. Feedback is free text |
| The instructor's question and a fixed list of fields | Anthropic | When the instructor uses the in-app assistant | Random code |
| Answer pages, rubric | Google or OpenAI, or a second Anthropic model | Only if the instructor runs the optional audit | Random code |
| PDF report with name, score and feedback | The student, through the instructor's Gmail | When the instructor sends | The student's own record |
| A note saying how a regrade request was resolved | The student, through the instructor's Gmail | When the instructor resolves a request and sends the note | First name, random code, question, result, any reason typed |
| A test email | An address the instructor chooses, through Gmail | When the instructor sends a test | Whatever that email contains |
| Google ID token: email, name, account ID | Rubrica's license server, through Cloudflare | At each Google sign-in | The instructor's own |
| Sign-in and Gmail authorization codes and tokens | At sign-in, connecting Gmail, sending, and disconnecting | The instructor's own Google account | |
| Request for a version file | Rubrica's server | When the instructor clicks to check for updates | None |
| Name-reading model download | Ollama model registry | When the instructor installs that model | None |
| Saved workspace: database, exam PDFs, log | The instructor's own iCloud Drive, OneDrive or chosen folder | Only if the instructor turns on cloud backup. Off by default | Full: names, IDs, scans, grades |
Step by step
| Step | What is involved | Where |
|---|---|---|
| Scan | Exam pages are added to the app. | On the Mac |
| Identify | Cover page is read on the Mac, the instructor confirms the name, and it is linked to a random code. | On the Mac |
| Grade | Random code, answer pages without the cover page, and rubric are scored. | Anthropic |
| Review | The instructor checks flags and can change any score or comment. | On the Mac |
| Send | The instructor emails reports to students. | Instructor's Gmail |
Cover reading is optional for each upload. The bundled reader needs macOS 14 or later. On macOS 12 and 13, it needs Ollama installed separately. If a cover page cannot be read, the fields are left blank and the instructor types them in.
Access
Only approved Google accounts can open a workspace. The first account to sign in becomes the owner, and the owner adds or removes teaching assistants by email. A PIN is also required each time the app opens, and the app can be locked at any time.
Sign-in and the PIN control the app. They do not encrypt the files on disk, and API keys are stored as ordinary files readable only by the instructor's account.
The app is installed like any other Mac app. Each release is signed with an Apple Developer ID and notarized by Apple.
What can block access
If the license lapses and cannot be renewed, the app stops responding to that user, exports included, until it is renewed. Five wrong PIN entries lock a user. The owner can clear a grader's lock, and the owner's own lock needs help from Rubrica's developer. The window locks after 15 minutes without input, and unsaved text in an open form can be lost. None of these deletes or encrypts anything. The database and exam files stay on the Mac in standard formats.
Reports and email
Each student receives a PDF report with their score, a card for each question, and written feedback on each question, based on the rubric. Reports are sent from the instructor's own Gmail account, so no Rubrica server handles them. They do pass through Google, and they carry the student's name, score, and feedback. Rubrica never emails a grade on its own. The instructor can disconnect Gmail and revoke access at any time.
License check
At each Google sign-in, which is about once a week, the app sends the instructor's Google ID token (email address, name, and Google account ID) to a server we run, through Cloudflare, to confirm the account is approved. It carries no student data. Between sign-ins the license is checked on the Mac and nothing is sent.
Cloud backup
Cloud backup copies the saved workspace, including names, IDs, scans, and grades, to the instructor's own iCloud Drive, OneDrive, or a folder they choose. It is optional and off unless the instructor turns it on.
Security review
Rubrica has had internal code reviews. No independent security review has been completed.
Instructor responsibilities
Rubrica limits what goes into grading requests, but it cannot protect a computer that is not protected. Instructors should:
- Keep their macOS account password-protected and disk encryption (FileVault) turned on. Rubrica does not encrypt its local data folder.
- Check answer pages and rubrics for names or other identifiers before grading. Rubrica does not detect or remove them.
- Ask students to write their name only on the cover page.
- Remove saved versions, backups, and exported files separately when deleting student data.
- Follow their institution's policies on student records and approved software.
Using Rubrica does not by itself make a course or institution compliant with FERPA or other privacy laws. We are glad to answer questions from IT and compliance reviewers.