Privacy Policy

Privacy Policy for Pantas PBD Helper

Last Updated: July 18, 2026 Developer: CikguAimeDotCom Contact: [aimansic97@gmail.com]

Overview

Pantas PBD Helper (formerly IDME PBD Helper) is a Chrome extension designed to help Malaysian teachers automate the input of student performance data (PBD/UASA) in the Ministry of Education’s IDME/SPPB system. Since v4.1.0, it also offers an optional, free integration with the Sistem e-Rekod platform for teachers who use both products. Since v4.7.0, PRO users may optionally use an AI feature to suggest Malay comment (Ulasan) text for review before saving (see item 6 and the External Services section).

Data Collection and Usage

What Data We Collect

1. License Information (PRO version only)

License key for subscription validation
License expiry date
Validation status
Storage: Locally in Chrome browser using chrome.storage.local API
External transmission: License key is sent to our validation server ONLY during activation/validation

2. Device Fingerprint (PRO version only - since v3.1.0)

What it is: A unique identifier generated from your browser/system characteristics
Components used: Browser type, operating system, screen resolution and color depth, timezone offset, language, CPU core count, touch support, and a canvas rendering fingerprint (NO personal information)
Purpose: Prevent license key sharing. The limit depends on when your license was issued: licenses issued from 6 July 2026 allow 1 device; licenses issued before that date allow 3 devices, as stated at the time of purchase
Storage: Locally in Chrome browser using chrome.storage.local API
External transmission: Device ID and device name sent ONLY during license validation
Note: This is NOT tracking. It is used only to enforce the per-license device limit

3. e-Rekod Integration Data (optional, free feature since v4.1.0)

What it is: If you choose to connect your Sistem e-Rekod account, the extension sends your e-Rekod API key to erekod.my to fetch your own students’ TP/marks and teacher remarks for the subject and class you select
Purpose: Auto-fill the same data you already recorded in e-Rekod into the MOE IDME system, so you don’t have to re-enter it
Storage: API key stored locally in chrome.storage.local; fetched student data is held in memory for the current popup session only (not persisted)
External transmission: API key sent to erekod.my (your own account, gated by your e-Rekod subscription) to retrieve data; the retrieved TP/marks/remarks are then written directly to the MOE IDME system using your own logged-in session — none of this data is sent to or stored on our servers
Note: This feature is entirely optional. Without connecting an e-Rekod API key, no data is exchanged with erekod.my

4. Student Selection Data

Student names (pulled from the IDME system, not collected by us)
Student selections (checkboxes)
Custom Usaha settings per student
Storage: Locally in Chrome browser only
External transmission: NEVER transmitted to our servers (see item 3 for the optional e-Rekod path, which goes directly between your browser, erekod.my, and MOE IDME — not through us)

5. User Preferences

Selected TP (Tahap Penguasaan) levels
Ulasan categories
Custom ulasan text
Operation mode preferences
Storage: Locally in Chrome browser only
External transmission: Not transmitted externally, with one exception — if you use the optional AI Comment Suggestions feature (item 6), the TP level (1–6) is sent anonymously (linked only to an index number, never to a student name) to generate suggestions

6. AI Comment Suggestions (PRO version only - since v4.7.0)

What it is: An optional, opt-in feature that suggests Malay comment (Ulasan) text for you to review and edit before saving. It requires a one-time Chrome permission consent on first use.
Data Sent: An anonymous student index (a number such as 0, 1, 2 — NOT a name or ID), the teacher-selected TP level (1–6), and the subject name. This is sent to our proxy server (portfolio.cikguaime.com), which calls the Google Gemini API.
Data NOT Sent: Student names, identification/IC numbers, or any data linking the index to a real student. The index-to-student mapping stays only in your browser and is never transmitted.
Data Received: Suggested Malay comment text, per anonymous index.
Storage: We log only usage metadata — a one-way hash of the license key (not the key itself), the product, the month, the number of students, token counts, the model name, estimated cost, and success status — to enforce the monthly quota and record costs. We do NOT store the TP values, the subject, or the generated comment text.
Note: This feature is entirely optional. Without using it, no data is sent for AI processing.

What Data We DO NOT Collect

We DO NOT collect any personal information about teachers
We DO NOT store student grades or academic records on our own servers (for the optional AI feature, the TP level is sent anonymously to generate a suggestion but is not stored — see item 6)
We DO NOT track browsing history
We DO NOT use cookies
We DO NOT sell or share any data with third parties
We DO NOT store any data on our servers, except license validation records, (for PRO users) device fingerprints used to enforce the device limit, and (for PRO users who use the AI feature) anonymous AI usage metadata used to enforce the monthly quota

External Services

License Validation API (PRO version only)

Service: Supabase (PostgreSQL Database + Edge Functions)
URL: https://kgksqhyqygepulsqpyen.supabase.co
Purpose: Validate PRO license keys, check expiry dates, and enforce device limits
Data Sent: License key, device ID (fingerprint), device name (e.g., “Chrome on Windows”)
Data Received: Validation status, expiry date, subscription status, registered device count
Security: HTTPS encrypted connection with JWT authentication
Data Retention: License validation logs and device info retained for support purposes
Device Limit: Per license (anti-sharing protection). Licenses issued from 6 July 2026 allow 1 device; licenses issued before that date allow 3 devices, as stated at the time of purchase
Infrastructure: Hosted on Supabase (AWS infrastructure) with SOC2 compliance

e-Rekod Integration API (optional, free feature since v4.1.0)

Service: Sistem e-Rekod (erekod.my), a separate product by the same developer
URL: https://erekod.my/api/export/\*
Purpose: Let teachers who subscribe to e-Rekod re-use their own already-entered TP/marks/remarks to auto-fill MOE IDME, instead of typing the same data twice
Data Sent: Your e-Rekod API key (authenticates as you, scoped to your own account)
Data Received: Your own students’ TP, marks, and teacher remarks for the subject/class you selected
Security: HTTPS encrypted connection, authenticated via a per-teacher API key you generate yourself in e-Rekod settings
Access control: Requires an active e-Rekod subscription to generate the API key; this extension does not create, sell, or manage e-Rekod accounts
Note: This is an optional feature. If you don’t enter an e-Rekod API key, this extension never contacts erekod.my

AI Comment Suggestions Proxy (PRO version only - since v4.7.0)

Service: Our proxy hosted on Vercel (portfolio.cikguaime.com), which forwards to the Google Gemini API
URL: https://portfolio.cikguaime.com/api/idme/ai-ulasan
Purpose: Generate Malay comment (Ulasan) suggestions that you review and edit before saving
Data Sent: An anonymous student index, the TP level (1–6), and the subject name — no student names or identifiers
Data Received: Suggested Malay comment text, per index
Security: HTTPS encrypted; PRO license validated server-side; a monthly quota is enforced (20 calls per license per month)
Data Retention: Only usage metadata is stored — a one-way hash of the license key, product, month, number of students, token counts, model name, estimated cost, and success status. The TP values, subject, and generated comment text are NOT stored.
Third party: The anonymous data is processed by the Google Gemini API under Google’s privacy terms
Note: This feature is optional and opt-in. It requires a one-time Chrome permission consent on first use; if you do not use it, this proxy is never contacted.

Purchase/Renewal Page

Service: External website (cikguaime.com)
Purpose: License purchase and renewal
Action: Opens external page when user clicks “Beli License” link
Note: This is a separate website with its own privacy policy

Data Storage

All data is stored locally on your device using Chrome’s storage API:

Location: Chrome browser’s local storage
Persistence: Data persists across browser sessions
Deletion: Data is deleted when extension is uninstalled
Access: Only this extension can access its stored data

Data Security

All external API calls use HTTPS encryption
License keys are validated server-side using Supabase RPC functions
e-Rekod data is fetched using a per-teacher API key over HTTPS, directly from your browser to erekod.my — never routed through our servers
All student data processing happens locally in the browser

User Rights

You have the right to:

Access: View all stored data via Chrome DevTools → Application → Storage
Delete: Remove all data by uninstalling the extension
Control: Choose whether to use PRO features that require license validation, or connect an optional e-Rekod API key
Opt-out: Use the FREE version without any external data transmission

Permissions Explanation

This extension requires the following Chrome permissions:

1. activeTab

Why: Access current tab to interact with IDME system forms
Usage: Read student names from tables, select TP radio buttons, fill Usaha Murid dropdowns, interact with Ulasan Guru dialogs
Limitation: Only active when you click the extension icon

2. storage

Why: Save your preferences and license information locally
Usage: Store TP selections, custom ulasan text, license key, student selections, Kemahiran settings, e-Rekod API key

3. *host_permissions (*.moe.gov.my, sppb.moe.gov.my, kgksqhyqygepulsqpyen.supabase.co, erekod.my)

Why: Extension only works on Malaysian government education sites, our license validation server, and (optionally) the e-Rekod integration server
Usage: Access IDME/SPPB systems for automation, validate PRO licenses, and (if connected) fetch your own e-Rekod data
Limitation: Cannot access any websites outside these domains
Note: Extension remains inactive on all other websites

4. optional_host_permissions (portfolio.cikguaime.com)

Why: Only for the optional AI Comment Suggestions feature (PRO). This permission is NOT granted by default — it is requested at runtime, with a Chrome consent prompt, the first time you use the AI feature
Usage: Send an anonymous student index, TP level, and subject name to our proxy (which calls Google Gemini) and receive suggested comment text
Limitation: If you never use the AI feature, this permission is never requested and the proxy is never contacted

Children’s Privacy

This extension is designed for teachers (adults) and does not knowingly collect information from children. Student names displayed are pulled from the IDME system and stored only locally.

Changes to Privacy Policy

We may update this privacy policy from time to time. Updates will be posted on:

Chrome Web Store listing
GitHub repository
Extension update notes

Data Breach Policy

In the unlikely event of a data breach affecting license validation:

Users will be notified within 72 hours via Chrome Web Store listing
Affected users will receive new license keys free of charge
Security measures will be immediately enhanced

Contact Us

If you have questions about this privacy policy:

Website: https://www.cikguaime.com
Email: aimansic97@gmail.com
Support: Contact via Chrome Web Store support tab

Compliance

This extension complies with:

Chrome Web Store Developer Program Policies
Google’s Privacy Policy requirements for extensions
Malaysian Personal Data Protection Act 2010 (PDPA)

By installing and using this extension, you consent to:

Local storage of preferences and settings
License validation via external API (PRO version only)
e-Rekod data retrieval via external API (optional, only if you connect an e-Rekod API key)
AI comment suggestions via external API (PRO version only, optional, only if you use the AI feature and grant the Chrome permission consent)
Processing of data as described in this policy

You can withdraw consent at any time by uninstalling the extension.