This guide is for school IT. It puts the extension on every teacher's Chrome from the Chrome Web Store, with nothing for teachers to install and no Developer mode. Chrome keeps it up to date.

Extension ID	`ofliokikjmkkdkinbdnadbjjdmkjdjfi`
Store listing	chromewebstore.google.com/detail/ofliokikjmkkdkinbdnadbjjdmkjdjfi
Update URL	`https://clients2.google.com/service/update2/crx` (the Chrome Web Store's own)
Privacy policy	learning.nyuchi.com/legal/privacy

In the Google Admin console

You need admin access to the school's Google Workspace or Chrome Enterprise domain.

Go to Devices → Chrome → Apps & extensions → Users & browsers.
Pick the organisational unit your teachers are in. Don't apply it at the root unless you mean students too. The extension reads gradebook data, and a student account has no use for it.
Click ＋ → Add Chrome app or extension by ID. Enter ofliokikjmkkdkinbdnadbjjdmkjdjfi, leave the source as From the Chrome Web Store, and click Save.
Set the installation policy:
- Force install: it installs on its own, and teachers can't remove it. Choose this for a rollout IT owns.
- Allow install: teachers add it from the store themselves. Choose this when using it is up to each teacher, or when your policy blocks extensions that aren't allowed.
Optionally, turn on Pin to browser toolbar. The toolbar icon opens the extension's menu: its switches, the licence, help and feedback.
Save. The policy reaches browsers within minutes to a few hours, and Chrome also picks it up on restart.

A Users & browsers policy applies to teachers signed in to Chrome with their school account, or to browsers enrolled in Chrome Enterprise Core.

Updates come from the store automatically. IT has nothing to do when a new version ships, and teachers have nothing to click.

First run. On each teacher's first install, the extension opens one welcome tab. It explains the features and has a box for the licence key. It doesn't open again on updates.

Checking it worked

On a teacher's computer:

chrome://extensions lists Toddle Enhancement Extension with Installed by enterprise policy.
chrome://policy lists ofliokikjmkkdkinbdnadbjjdmkjdjfi among the extension policies, under ExtensionInstallForcelist for Force install. Reload policies fetches the policy now if it isn't there yet.

Windows and macOS without the Admin console

The same policy can be set directly. Each entry is the extension ID and the store's update URL, separated by a semicolon:

ofliokikjmkkdkinbdnadbjjdmkjdjfi;https://clients2.google.com/service/update2/crx

Windows, Group Policy. Install the Google Chrome ADMX templates. Then go to Computer Configuration → Administrative Templates → Google → Google Chrome → Extensions → Configure the list of force-installed apps and extensions. Enable it and add the line above. That writes the registry value HKLM\Software\Policies\Google\Chrome\ExtensionInstallForcelist (name 1, type REG_SZ).
Windows, Intune. Use a Settings catalog profile with Google Chrome → Extensions → Configure the list of force-installed apps and extensions, and the same line.
macOS. Use a configuration profile, through your MDM, for the preference domain com.google.Chrome, with the line above as a string in the ExtensionInstallForcelist array.

To allow the extension without forcing it, add the bare ID to ExtensionInstallAllowlist instead.

"Not trusted by Enhanced Safe Browsing"

A teacher who opens the store listing with Chrome's Enhanced Safe Browsing on may see a notice that the extension is not trusted by Enhanced Safe Browsing. That notice is about the publisher, not about anything the extension does: Chrome shows it for publishers who are new to the Chrome Web Store and have not yet built up a track record. It goes away with time, as the publisher stays in good standing.

It does not block a deployment. A force-install or allow-install through Google Admin, or through the policies above, works as normal.

Licences for a school

Concealing student flags and the My classes filter are free. Gradebook columns, CSV export, the student sidebar, primary teacher names and the Attendance dashboard details need a licence.

An organisation licence is one key for the school's email domain. Anyone signed in to Toddle with an address at that domain is covered.
The match is exact. A key for school.org covers [email protected], but not [email protected].
A school with several domains has them all on the same key.
The domain is checked against the account signed in to Toddle, not the Chrome profile.
Staff enter the key themselves. They paste it into the welcome page, or open the toolbar menu → Enter a licence key. The key is checked on the teacher's own computer, against a signature, without contacting a server.
The key can't be pushed by policy. The extension doesn't read managed storage, so the Admin console can't set the key for teachers. Send staff the key with a short note on where to paste it.

Buying one is covered in Licences, pricing, and activating your key. Licences, key reissues and adding a domain: [email protected].

What IT needs to know

Permissions. It has storage, to keep each teacher's switch settings and licence key on their own computer, and host access to https://web.toddleapp.com/* only. It has no access to any other site.

What it does on Toddle. It reads through Toddle's own interface, using the session the teacher is already signed in with. It never sees or stores a password. It writes nothing back to Toddle. The CSV export is made in the browser and saved to the teacher's downloads.

No Toddle data leaves the browser. There's no analytics, no telemetry and no remote code. The extension makes two outside connections, and neither carries anything from Toddle:

The feedback form, opt-in. "Send feedback" in the toolbar menu sends only what the teacher types (a topic, a message, and an email if they give one) plus the extension's version. It goes to Nyuchi's feedback form, processed by Formspree, and nothing is sent until they press Send.
The licence revocation list. Once a day, and only while a licence key is stored, the extension sends a plain GET to https://licences.nyuchi.dev/v1/revocations. The request carries no key, email, cookies or query string. It fetches a signed list of revoked keys and checks it on the computer. If the request is blocked, licences keep working on the last result. If your network filters outbound traffic, allowlist licences.nyuchi.dev so revocations stay current.

Data processing. A data processing agreement is available on request from [email protected]. For the full picture of what is read, kept and sent, see What the extension can and cannot see.

Tell teachers about the flags switch

Concealing flags is a lid, not a lock. It changes what Toddle draws, so a Toddle release can change what it covers, and it doesn't hide what a teacher opens on purpose. Ask teachers to switch it on before they share their screen and check it is on, rather than assuming it still is. See Concealing student flags for a shared screen.

Questions

Rollouts, invoices and anything above: [email protected].

Deploying the extension to your whole school with Google Admin