Privacy policy

Last updated 19 October 2026

1. About this policy

Marcus is a web app that marks multiple-choice tests, available at getmarcus.co. T Freeman operates Marcus from Victoria, Australia ("we", "us"). This policy explains what personal information we collect, why, and what we do with it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

If you have a question or a request about your privacy, email admin@getmarcus.co.

2. What stays on your computer

Marcus is designed so that student work does not leave the teacher's device. Marcus opens your scans or photos and reads every answer inside your browser. We never receive or store:

• scans, photos or PDFs of tests;
• students' answers, scores or results files;
• student names you type, or class lists you upload (except as described for AI name reading in section 5).

Downloading, copying and sharing results

Marcus builds results files (Excel, CSV and PDF reports) on your device. When you download them, copy the results table, or use the Share button on the Export screen, the results go straight from your device to the place you choose: your Downloads folder, the clipboard, or the app you pick from your device's share menu (for example your email, Messages or a cloud drive). Sharing does not go through Marcus's servers, and we never see, receive or keep the files you share. Once shared, the app you chose and its provider handle the file under their own terms, so share results only in ways your school allows.

Marcus keeps your archive of marked tests, your review progress and a copy of your settings in your browser's storage on that computer, with a separate store for each teacher who logs in. We cannot see or recover this information. If you clear your browser's data or use a different computer, it stays behind.

3. Information we collect

Your account

• Your name, email address and school, which you give us when you create an account or update My Profile.
• Your password, stored only as a one-way scrambled value (PBKDF2). Nobody, including us, can read it back.
• Your account status (waiting, approved or switched off), whether you are an administrator, and the monthly limits on your account.
• Who invited you, if you signed up with an invite link, and how many people signed up with yours.

Your settings

Your review setting, AI choices, saved export layouts and printer calibrations, so they follow you to any computer. These contain no student information.

Usage counts

After each test, Marcus tells our server how many students, pages and questions it marked, together with a "fingerprint" of the scan files. The fingerprint is a short code that lets us count the same class set once; it cannot be turned back into the scans. We also record each AI request: the type of job, the amount of text processed and its cost.

Security records

• A login cookie that keeps you signed in. Our server stores only a scrambled copy of it, with the time you last used Marcus. You are logged out after 2 hours without activity, and after 30 days in any case, so a computer left signed in does not show your students' information to the next person.
• Failed log-in and sign-up attempts, recorded against the email address and the network (IP) address used, to slow down password guessing. We delete these records within a day.

Technical information

Like any website, Cloudflare, which runs Marcus for us, processes technical details such as your IP address and browser type when you connect, to deliver the site and protect it from attacks.

Visit statistics

We use Cloudflare Web Analytics to count visits to getmarcus.co, so we can see how many people find Marcus and how quickly its pages load. When a page opens, a small Cloudflare script sends the page address, the site you came from, your browser, operating system and device type, your country, and how long the page took to load. It does not use cookies or other storage on your device, and Cloudflare does not use it to identify you or follow you across other websites. It never receives your scans, students' answers, scores or names, which stay in your browser. Marcus removes password-reset codes from the page address before the statistics are sent.

4. How we use your information

• To create and run your account, including approving new accounts.
• To send you emails about your account: approval, password resets, and notices such as a change of email address. We do not send marketing emails.
• To apply the monthly limits on students marked and AI use, and to understand how much Marcus is used.
• To keep Marcus secure and prevent misuse.
• To answer your questions and requests.

We do not sell personal information, and Marcus contains no advertising or third-party tracking.

5. AI features

Marcus does its work on your computer, without AI, wherever it can. It reads every student's answers, finds the answer options on bubble and letter answer sheets, and reads answer keys you type or upload as a spreadsheet, all without AI. It uses AI for three jobs only, and only when you choose to. Marcus administrators decide which jobs are offered, and you can turn each one off in Settings.

Our server sends each AI request to the Claude Haiku model from Anthropic, a company based in the United States. Anthropic may process a request on its servers in the United States or in other countries, and stores data in the United States. Our server writes the instructions; your browser never contacts Anthropic itself. Requests reach Anthropic from Marcus, not from your computer, and they do not include your name, email address or school. Here is exactly what each job sends and receives.

Reading students' handwritten names

• When: only for a test where you choose "Use AI to read students' names" on the Upload screen. Marcus asks before every test, and sends nothing for that test if you say no.
• Sent: a picture made of small snippets, each cut tightly around one student's handwritten name (typically about 1% of the page, from the name area, never the answers), up to 8 students per picture. If you added a class list, the students' names from it are sent so the AI can match them; student IDs and other columns are not sent. A sheet where Marcus finds no handwritten name is skipped, and nothing from it is sent.
• Received: each name as the AI read it, the matching name on your class list, and how confident the AI is.

Reading an answer key from a photo or PDF

• When: only when you drop a photo or PDF into the box labelled "Or let the AI read a photo or PDF of the key".
• Sent: the whole picture you upload, up to its first 3 pages. If the picture shows anything besides the answers, such as a student's name or work, that is sent too, so crop it out first.
• Received: a list of question numbers and their correct answers.

Finding the answer options on a question paper

• When: only when you choose "Find the options with AI". Marcus offers this only for question papers it cannot lay out by itself.
• Sent: one picture of each page of the test with no student work on it. If you uploaded a blank copy of the test, Marcus sends that. Otherwise it builds a clean page by combining the class's scans so that every student's marks disappear, and it only does this when at least 5 students' copies of that page exist. With fewer copies, Marcus asks you for a blank copy instead and sends nothing.
• Received: where each question's answer options sit on the page, and where the name box is.

For every AI job

• Marcus never sends students' answers or scores, full scans of students' pages, student IDs, or the name of the test.
• Our server keeps nothing from the pictures or the AI's reply. It records only which job ran, for which teacher account, when, how much text the AI processed, and the cost, so it can apply the monthly limits.
• The AI's readings appear on your screen for you to check and correct before you rely on them.
• Anthropic's commercial terms govern what it does with the requests it receives.

Names read by the AI are student personal information. Check your school's rules before you use name reading or upload photos that show students' details.

6. Who we share information with

We share personal information only with the service providers that help us run Marcus, and only as much as each one needs:

• Cloudflare (United States) hosts Marcus and its database, and counts visits to the site (section 3). The database is kept in Cloudflare's Sydney data centre, and Cloudflare's worldwide network delivers the site.
• Resend (United States) sends our emails, so it receives your email address and the message.
• Anthropic (United States) receives AI requests, only when you use an AI feature, as described in section 5. It may process them in the United States or other countries.

Marcus administrators (the people who run Marcus) can see each teacher's name, email, school, account status, limits, usage counts and referrals, so they can approve accounts and manage limits. They cannot see your tests, scans or students.

We may also disclose information if the law requires it, or to protect the safety and security of Marcus and its users.

Because some of these providers are overseas, your information may be handled in the United States and, for AI requests, in other countries where Anthropic runs its servers. We choose providers that protect information with security measures appropriate to its sensitivity.

7. Cookies and browser storage

Marcus uses one cookie: the login cookie described above, which Marcus needs to work. It uses your browser's storage to keep your archive, review progress and settings on your computer, to remember an invite code while you sign up or a password-reset code while you choose a new password, and to note that someone is signed in on this browser so the home page opens the app straight away. Marcus uses no analytics or advertising cookies: the visit statistics in section 3 work without cookies.

8. Student information

Marcus is for teachers and school staff, not students. When you mark a class set, you and your school decide how students' information is used, and you remain responsible for following your school's policies and the privacy laws that apply to you. Marcus helps by keeping student work on your computer. If you use AI features, the information described in section 5 leaves your computer: snippets of students' handwritten names, class list names, and any picture you upload for the AI to read.

9. Security

We protect your information with encrypted connections (HTTPS), one-way scrambled passwords and login cookies, limits on repeated log-in attempts, and checks that every change comes from Marcus's own pages. Only Marcus administrators can see account details, and the AI key stays on our server. No system can promise complete security. If a data breach could cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the law requires.

10. How long we keep information

• We keep your account, settings and usage counts while your account is open.
• When you delete your account in My Profile, we delete your account, usage records and settings straight away. Copies may remain in Cloudflare's database backups for up to 30 days before they are removed.
• Failed log-in records are deleted within a day. A login ends after 2 hours without activity or after 30 days, whichever comes first, and we then delete its record.
• Information in your browser stays until you delete it from the archive, delete your account on that computer, or clear your browser's data.

11. Seeing, correcting and deleting your information

You can see and update your name, school and email address in My Profile, and delete your account there. To ask for a copy of the information we hold about you, or for any other correction, email admin@getmarcus.co. We will reply within 30 days.

12. Complaints

If you are concerned about how we have handled your personal information, email admin@getmarcus.co and we will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes to this policy

We may update this policy as Marcus changes. We will update the date at the top, and if a change is significant, we will tell you by email or in Marcus before it takes effect.

Marcus · Operated by T Freeman, Victoria, Australia · admin@getmarcus.co · Terms of use · FAQ