Operator: Justin Vogel, an individual.
Contact the operator through the private channel where access to this app was arranged.
Effective date: November 10, 2026.
This policy describes Google Classroom Grok Bot, a private connector for one authorized Google account. These pages do not name that account. Google describes its own handling of account data in the Google Privacy Policy.
The Classroom consent screen asks for these scopes. The short descriptions are Google's, from the Classroom authorization guide:
https://www.googleapis.com/auth/classroom.courses.readonly — view your Google Classroom classes.https://www.googleapis.com/auth/classroom.coursework.me.readonly — view your coursework and grades.https://www.googleapis.com/auth/classroom.student-submissions.me.readonly — view your coursework and grades.https://www.googleapis.com/auth/classroom.announcements.readonly — view announcements.https://www.googleapis.com/auth/classroom.courseworkmaterials.readonly — see classwork materials.https://www.googleapis.com/auth/classroom.topics.readonly — view topics.https://www.googleapis.com/auth/classroom.rosters.readonly — view class rosters.https://www.googleapis.com/auth/classroom.profile.emails — view the email addresses of people in your classes.https://www.googleapis.com/auth/classroom.guardianlinks.me.readonly — view your Google Classroom guardians.openid and email — used to check that the signed-in account is the account the consent link asked for. The connector does not see the Google password.Google's OpenID example can return https://www.googleapis.com/auth/userinfo.email in place of the short email scope. This connector accepts that address as the email scope. It does not accept profile or https://www.googleapis.com/auth/userinfo.profile. It does not accept a teacher scope, a student-submit scope, or any other scope that was not requested. If the returned set is outside that read-only set, no token is stored.
A separate sign-in, used only to identify the caller to this connector, asks Google for openid and email. That sign-in does not store a Classroom refresh token.
The connector uses the email to accept or refuse the account that signed in. It uses the Classroom scopes to perform the read that Grok Bot requested, and it returns Google's response for that request. It does not use Classroom data to sell a product, to show advertising, or to train a model of its own. That sentence describes this connector. It does not describe Google, Cloudflare, or the assistant provider.
The use of information received from Google Workspace scopes will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The Workspace policy states those requirements at Google Workspace user data and developer policy. This sentence is this connector's disclosure. It is not a certification by Google.
Google receives the consent and serves the Classroom API. Cloudflare hosts this connector and stores the records above in Workers KV. Grok Bot receives the authorized result when it calls the connector. A result can then appear in a Grok Bot conversation. This policy does not state how long Google, Cloudflare, or the assistant provider keep their own copies, and it does not state their advertising or model-training rules.
This connector's own code does not write request logs and does not load analytics. The public pages do not set cookies. MCP sign-in can set a short-lived consent cookie so the browser can finish the sign-in it started. That cookie is not analytics. This page does not describe logs that Cloudflare or the assistant provider may keep.
The account holder can remove this app's Google access at Google Account permissions or third-party connections. After Google rejects the stored refresh token, this connector can no longer call Classroom with it. Removing access at Google does not delete the copy stored in Cloudflare KV. The connector keeps that record, including the refresh token, and marks it refused. It does not delete the record on that refusal, and it has no scheduled deletion.
An authorized caller can run accounts_revoke. That deletes the stored token record and the short-lived access-token record for the account named in the call. The confirmation text has to be REVOKE followed by that account's email. The action does not call Google to revoke the grant, does not delete data held by Google, and does not delete MCP sign-in records or an assistant conversation. There is no separate deletion form on this site.
The connector is served over HTTPS. Tokens are not returned by its tools and are removed from error text when the configured secret values appear there. Public pages do not require a Google client secret.