FOR SCHOOL TECHNOLOGY TEAMS
Review the facts.
Choose with confidence.
Educational IT, networking, AI literacy, and ethical cybersecurity simulations for grades 7–12. This page is readable without JavaScript and is intended for district review—not an automatic approval or security certification.
Operator: Alan “Al” Cole · Updated October 16, 2026
Purpose and boundaries
The 15 investigations use fictional computers, settings, accounts, logs, code, and AI examples. Students inspect evidence, make controlled changes, test, and explain the result. Cybersecurity cases teach authorization, least privilege, remediation, and responsible reporting within the simulation. No live scanning, attacks against external systems, terminal execution, or live AI service is part of a lab.
Classroom collection is locked for privacy review
Independent labs, local report exports, and fictional demonstrations are available. This production release rejects real classroom API requests before reading service configuration or contacting a classroom database or identity service. Hosting settings, a teacher email, a class code, or an enrollment checkbox cannot approve collection. A reviewed code release is required after applicable privacy obligations, school agreements, and operational safeguards are satisfied.
Student and educator information has a defined purpose
Cole Learning Labs does not sell or rent student or educator information, use it for advertising or behavioral profiling, or send lab work for AI-model training. Future classroom records must be limited to a specifically approved educational purpose and authorized recipients, with necessary service providers disclosed and restricted. Aliases and metadata may still identify people; they are included in privacy review.
COPPA, FERPA, New York Education Law §2-d and 8 NYCRR Part 121, and other applicable protections are release requirements. For covered New York school data, this includes the required agency agreement, Parents’ Bill of Rights, security/privacy plan, and supplemental disclosures. Further jurisdictions need their own applicable-law assessment. No completed legal compliance determination, worldwide approval, or NYSED vendor certification is claimed. See NYSED vendor guidance, the current COPPA Rule, and the record of release requirements and open work.
Data practices at a glance
| Feature | Information and destination |
|---|---|
| Independent practice | State, clues, explanations, reflections, and action timestamps stay in the browser profile. No application upload of lab records; no student account required. |
| Exports | A report is copied to the clipboard or downloaded as text. Students or teachers choose whether to submit it through Google Classroom, Teams, or another approved system. There is no automatic LMS connection. |
| Optional connected classroom | If enabled and explicitly joined: a student alias, assigned drafts, action history, submission snapshots, and teacher grades/feedback are held in Cloudflare D1 and scoped to that class. Teacher authentication and server access checks are required. Not currently accepting real enrollment. |
| Site delivery and protection | Cloudflare processes normal requests and security metadata, which can include IP address, requested path, browser, and traffic information. HTTPS does not mean no information is transmitted. |
| External services | Optional professional/project links open external services. The labs have no advertising, analytics SDK, remote font, embedded social feed, or live AI API. School-managed extensions and networks have their own data practices. |
| Recording and surveillance | No camera, microphone, screen recording, location tracking, or other-tab monitoring. Classroom progress, if enabled, is an in-lab work view rather than proof of attendance or independent authorship. |
Access, retention, and deletion
Independent records can be removed with a lab reset or the browser’s site-storage controls. Export needed work first, especially on a shared device. No central classroom database is active. The experimental backend’s 90-day expiry and request-triggered cleanup are development settings, not an approved retention policy. Necessary purpose/contract-specific deadlines, scheduled erasure, early return/deletion, backups, recovery windows, storage location, transfers, and rights procedures must be settled and tested before real collection. A short-lived join-abuse network hash is proposed and must also be covered by review.
The operator and school must establish usable privacy and incident contacts, required notices, appropriate authority, processor restrictions, and access/correction/export/deletion processes. Authentication, contract controls, risk assessment, encryption in transit and at rest, trained personnel, and incident response must be evidenced in the actual deployment. Applicable New York requirements reference NIST CSF 2.0 following the 2026 amendment; this site has not completed that assessment. See the official adoption notice. Avoid real names, passwords, health information, and confidential school details in practice notes.
Hostnames and browser requirements
The canonical address is https://www.colelearninglabs.com/. The apex colelearninglabs.com redirects to www. Images, fonts, styles, scripts, and optional classroom API calls use this same canonical website. Broad allowances for all GitHub or Cloudflare websites are not needed for independent labs.
Use supported Microsoft Edge on Windows or macOS and supported Chrome on Chromebooks. JavaScript is required for interactive labs; local storage supports resume. School policies can restrict clipboard, file downloads, or cookies, so review both report alternatives. Connected classrooms should open directly as a full browser page; strict session cookies and teacher anti-framing controls can prevent embedded sign-in.
Before a lesson, test a representative lab, keyboard/touch interaction, local resume, text zoom, report copy/download, and any enabled sign-in on a real managed device and student network. Browser compatibility and filtering approval are separate checks. See Microsoft’s supported Edge platforms.
GoGuardian and district filter review
A website cannot label itself “super secure” in a way that overrides school policy. HTTPS, accurate educational descriptions, and this review page support a district’s decision; access remains under the school’s control.
- An authorized GoGuardian administrator can test the exact canonical address and apex redirect in Filtering → Filtering Simulator for the actual student organizational unit and policy.
- If the category is incorrect, review Categories → Check URL → Share Category Feedback, or Suggest Category from a browsing record. A category suggestion does not immediately change access.
- If approved by the district, the administrator can add the specific website to the applicable policy’s URL allow rules while considering inherited and organizational-unit policies. A teacher’s local setting does not guarantee an override of district filtering.
Official GoGuardian guidance: Filtering Simulator, category review, and website allow rules.
Security controls and practical limits
Cloudflare supplies HTTPS and network protection; DNSSEC is enabled. The application restricts scripts and network connections with a Content Security Policy, disables unnecessary device permissions, avoids referrer transmission, and uses response-type protection. Optional classroom APIs use server authentication, ownership checks, scoped sessions, request-origin checks, bounded payloads, immutable submissions, and manual grading. These controls reduce risk; they are not a promise that any website is invulnerable.
The source is available in the public repository. GitHub stores code, not classroom records. Squarespace is the domain registrar. Cloudflare’s privacy policy describes hosting and service processing.
Review contact
Contact Alan Cole through the professional Connect page for an access review, accessibility barrier, data-practice question, or security concern. Do not include real student work or credentials in a public issue or initial message. Read the full privacy and accessibility information.