For school IT teams

How to whitelist Scripto

Last updated: October 2026

Scripto runs in the browser. Students do not install an app. If a school filter blocks it, allow the domains below over HTTPS (port 443).

Domains to allow

• app.thisisscripto.comThe practice app.
• thisisscripto.comThis website.
• www.thisisscripto.comRedirects to this website.
• tggxhyuzyrjbqgepaceh.supabase.coSign-in, saved practice, and handwriting photos.

Listening, marking, and invite email happen on our servers. Student devices do not need extra domains for those. Error reports also stay on app.thisisscripto.com.

What a student needs

A current browser, sound for the sentence, and a camera or photo library for the handwritten answer. There is nothing to download from an app store.

What we collect

• Name, email, role, and class membership
• Student gender, used only to choose the dictation voice
• An optional phone number for tutors, when an admin adds one
• Sentences, scores, feedback, and optional handwriting photos
• A sign-in cookie, and server logs that do not include names or emails

We use this only to run the practice. Sentence marking and speech are sent to the providers that do those jobs. We do not sell student data.

Where it is stored

The database and photos are on Supabase in the EU (Frankfurt or London). Photos sit in private storage and are opened with short-lived links. Data is encrypted at rest, and traffic uses TLS.

Cookies

Sign-in cookies only. There are no marketing or tracking cookies.

Deletion

Practice is kept while the student account is active. A tutor or admin can permanently delete the account, which removes the login, attempts, photos, and class membership. Bulk import files are cleared 90 days after the import finishes.

The full notice is on the practice app: app.thisisscripto.com/privacy.