📋 TL;DR
- ✅ Zero data collection — We don't collect, store, or sell any of your information
- ✅ Local storage only — Everything stays on your device
- ✅ Official Canvas API — We only use approved, read-only Canvas APIs
- ✅ Optional AI — AI features are opt-in and can be disabled anytime
- ✅ Open source — Audit our code yourself on GitHub
- ✅ No tracking — No analytics, no ads, no third-party tracking
Introduction
Canvas Buddy ("we," "our," or "the extension") is committed to protecting your privacy. This Privacy Policy explains how Canvas Buddy handles your data when you use our Chrome extension.
Our Privacy Promise: We do not collect, store, transmit, or sell any of your personal information or academic data. Period.
Information Collection and Use
What We DON'T Collect
Canvas Buddy does NOT collect, store, or transmit:
- ❌ Personal information (name, email, student ID)
- ❌ Academic data (grades, assignments, course content)
- ❌ Canvas login credentials
- ❌ Browsing history or activity
- ❌ Analytics or tracking data
- ❌ Any data to external servers (except AI API calls, see below)
What Data Stays on Your Device
Canvas Buddy stores the following data locally on your device only using Chrome's local storage:
- ✅ Your Canvas instance URL (e.g., school.instructure.com)
- ✅ Extension preferences and settings
- ✅ Theme choices
- ✅ Cached course data for offline functionality
- ✅ AI query history (stored locally, never transmitted)
This data never leaves your device and is only accessible to you through your browser. It is automatically deleted when you uninstall the extension.
Canvas API Access
Canvas Buddy uses the official Canvas LMS REST API to access your course information. This is the same API used by Canvas' official mobile apps and other authorized tools.
What We Access Through Canvas API
When you use Canvas Buddy, the extension requests read-only access to:
- Your courses and enrollments
- Assignment details and due dates
- Grade information
- Announcement and module content
How We Use This Data
- All data fetched from Canvas is processed locally in your browser
- Data is never sent to our servers (we don't have servers!)
- Data is used only to display features like grade calculations and smart notifications
- You can revoke API access at any time through Canvas settings
AI Features
How AI Features Work
When you use AI-powered features (assignment assistant, quiz generator), Canvas Buddy sends your prompts to third-party AI services:
- OpenAI (GPT models) or Anthropic (Claude models)
- Only the specific text/content you choose to analyze is sent
- No identifying information, grades, or personal data is included
- AI providers process requests according to their own privacy policies
What We Send to AI Services
- ✅ Only the specific assignment text or content you explicitly choose to analyze
- ✅ Your prompt/question
What We DON'T Send to AI Services
- ❌ Your name, email, or student ID
- ❌ Your grades or GPA
- ❌ Course names or instructor information
- ❌ Any data you didn't explicitly select
AI Provider Privacy Policies
You can disable AI features entirely in Canvas Buddy settings if you prefer not to use them.
Data Security
Local Storage Security
- All data is stored using Chrome's secure storage APIs
- Data is encrypted by your browser's built-in encryption
- Only Canvas Buddy can access its own stored data
- No third parties can access your locally stored information
Permissions Explained
| Permission |
Why We Need It |
storage |
Store your preferences and settings locally |
activeTab |
Access Canvas pages to inject features |
https://*.instructure.com/* |
Access Canvas domains (the official Canvas LMS domain) |
notifications |
Show you smart notifications for assignments |
We request only the minimum permissions needed for functionality.
Third-Party Services
Canvas Buddy interacts with the following third-party services:
- Canvas LMS — Your school's Canvas instance (we use official APIs only)
- AI Providers (optional) — OpenAI/Anthropic for AI features (only if you use them)
We do NOT use:
- ❌ Analytics services (Google Analytics, Mixpanel, etc.)
- ❌ Advertising networks
- ❌ Tracking pixels or cookies
- ❌ Any other third-party data collection tools
Children's Privacy
Canvas Buddy is designed for students, including those under 18. We comply with COPPA (Children's Online Privacy Protection Act) by:
- Not collecting any personal information from users of any age
- Not requiring account creation or registration
- Processing all data locally on the user's device
Parents and guardians can review our open-source code at: github.com/Ketchio-dev/canvas-buddy
Your Rights and Control
You Have Full Control
- Access: All your data is stored locally — you can view it anytime in Chrome DevTools
- Delete: Uninstalling the extension immediately deletes all stored data
- Export: You can export your settings from the extension options page
- Opt-Out: You can disable any feature (including AI) in settings
How to Delete Your Data
- Disable AI features: Go to Canvas Buddy Settings → Turn off AI features
- Clear stored data: Settings → Advanced → Clear all data
- Complete removal: Uninstall the extension from Chrome
Changes to This Privacy Policy
We may update this Privacy Policy occasionally. When we do:
- We'll update the "Last Updated" date at the top
- Significant changes will be announced in the extension
- Continued use after changes means you accept the updated policy
You can always find the latest version at: github.com/Ketchio-dev/canvas-buddy/PRIVACY.md
Open Source Transparency
Canvas Buddy is open source software. You can:
Our code is licensed under GPL-3.0, ensuring transparency and community oversight.
Legal Compliance
FERPA Compliance
Canvas Buddy complies with FERPA (Family Educational Rights and Privacy Act) by not collecting or storing educational records. All data processing happens locally on your device.
GDPR Compliance
For users in the EU, Canvas Buddy complies with GDPR by:
- Not collecting personal data
- Processing all data locally (data never leaves your device)
- Providing full transparency through open-source code
- Allowing complete data deletion via uninstallation
California Privacy Rights (CCPA)
California residents: Because we don't collect personal information, there is no data to request, delete, or opt-out of selling (we don't sell any data).
Contact Us
If you have questions about this Privacy Policy or how Canvas Buddy handles data:
We're committed to transparency and will respond to privacy inquiries within 48 hours.
Canvas Buddy Team
Building better tools for students, with privacy first. 🔒