Is MagicSchool AI - AI Assistant for Teachers safe?

Medium risk

MagicSchool AI sends user action telemetry and auth session tokens to app.magicschool.ai on every interaction across all sites.

The extension's content script runs on every website and forwards user action events — including logins, tool usage, and clipboard copies — to app.magicschool.ai via an Amplitude telemetry relay in the background service worker. On every authentication state change, the service worker broadcasts the full session object (access token, refresh token, and user email) to all open tabs, including third-party sites. Auth session tokens and cookies are also stored in chrome.storage.sync, syncing them across all Chrome instances signed in to the same Google account.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

MagicSchool AIv2.4.3Chrome Web Store
40Risk
Who publishes it

Magic School Inc - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
MagicSchool AI
Declared legal entity
Magic School Inc
Registered address
Tejon St, Denver, CO 80211, US
Registered contact
Adeel

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed MagicSchool AI contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • app.magicschool.ai

    MagicSchool AI sends data to app.magicschool.ai. No other extension we have analysed sends data here.

  • auth.magicschool.ai

    MagicSchool AI sends data to auth.magicschool.ai. No other extension we have analysed sends data here.

Updated 30 September 2026oplfencnkfofaoeedbmphcbplaceplim