FOR SCHOOL IT ADMINISTRATORS
StudyFlow is an educational student-planning application.
Production domain: study.marcelipawlinski.co.uk. StudyFlow helps students manage timetables, homework, revision, assessments, coursework and academic progress.
Compact network allow-list
| Domain | Required? | Purpose | Data |
|---|---|---|---|
| study.marcelipawlinski.co.uk | Required | Main application and first-party PWA assets over HTTPS (443) | Planner/application traffic |
| www.gstatic.com | Conditional | Firebase browser libraries | Application code only |
| identitytoolkit.googleapis.com | Optional | Email/Google Firebase Authentication | Authentication data |
| securetoken.googleapis.com | Optional | Firebase session token refresh | Authentication session data |
| firestore.googleapis.com | Optional | Private planner sync when the student enables it | Student’s synced planner record |
| accounts.google.com | Optional | Google sign-in account selection | Google authentication data |
| apis.google.com | Conditional | Google sign-in support library | Authentication flow only |
| www.google.com | Optional | reCAPTCHA Enterprise browser attestation for Firebase App Check | Anti-abuse attestation only |
| content-firebaseappcheck.googleapis.com | Optional | Firebase App Check token exchange | App Check attestation |
| firebasevertexai.googleapis.com | Optional | Firebase AI Logic Gemini homework, grade or calendar suggestion requested by a student | Only the relevant user-approved planner details |
Blocking optional Firebase or Gemini domains leaves the local planner usable but prevents the related optional feature. No third-party analytics, advertising, tracking pixels, WebSockets or remote-browser connections are used by the core planner.
Privacy and product boundaries
StudyFlow is local-first. It can be used without cloud synchronisation; optional accounts store one private planner record per signed-in user using Firebase Authentication and Google Cloud Firestore. StudyFlow is not a VPN, proxy, tunnel, anonymous browser or public file-sharing service, and it does not bypass filtering or network restrictions.
Security posture
The domain uses HTTPS, modern TLS and standard browser protections including HSTS, Content Security Policy, frame protection and restrictive permissions. The service worker caches only the public application shell for offline use.
Filtering and access
StudyFlow does not try to evade categorisation or filtering. If access is restricted, please assess this page, the educational purpose, privacy information and security overview under your normal policy.