CANVAS COMPASS
Privacy policy
Scope
Canvas Compass is an independent browser extension for viewing learning-platform deadlines, planning ahead, and optionally copying selected deadlines to Google Calendar. This policy covers the extension and its Compass support and private digest-pilot service. Development features may differ from the currently published Chrome Web Store version. Canvas support is the primary path; Brightspace is an experimental, limited-coverage pilot and is not a promise of compatibility with every school. We are not affiliated with universities, Instructure, D2L, or Google.
Learning-platform access and local data
You choose an HTTPS learning-platform address and grant access to that site. The extension uses your existing signed-in browser session for read-only requests. It does not ask for your school password, export session cookies, submit assignments, or change school records. Depending on the connector and permissions available, local snapshots can contain profile name and ID, course names and IDs, assignment titles and IDs, source links, due/availability/lock dates, points possible, and submission state, timestamps, or excused status. Brightspace calendar-only coverage does not establish completion; unknown remains unknown.
Snapshots, connection state, refresh times/errors, selected courses, themes, planning preferences, digest preferences and recipient, Calendar mappings, and optional notification credentials are saved in chrome.storage.local in your Chrome profile. There is no advertising, analytics tracker, sale of personal data, or remote executable code. These local settings and credentials are not additionally encrypted by the extension. Browser/device access therefore matters.
Optional Google Calendar
When you connect Google, selected course names, assignment titles, exact due times, source links, completion labels, stable source/user/course/assignment identifiers, and chosen reminder or study-session settings are sent to Google Calendar. The extension requests calendar.app.created access and creates dedicated course calendars and updates its own events. Normal sync does not delete events. Explicit course consolidation, where offered, copies verified events and retains original calendars. Existing unrelated events and reminders are retained unless you explicitly choose to apply new reminders to existing managed events. Study sessions do not check your availability; review clashes and timezone changes yourself.
Chrome manages OAuth access tokens. Disconnect stops extension sync and removes its cached token; revoke access separately in your Google account permissions. Disconnect, local reset, and uninstall do not delete Google Calendar events or calendars. Removing local calendar mappings may lead to duplicate calendars if you reconnect.
Optional Pushover
If you configure and allow Pushover alerts, the extension sends your Pushover application token and user key, a short sign-out/test message, and the school homepage address to api.pushover.net. Those alerts do not include your profile name, course titles, grades, or assignment details. Pushover operates under https://pushover.net/privacy. Tokens and keys remain locally stored until cleared.
Private hosted email-digest pilot
Hosted delivery is currently a restricted, operator-provisioned self-test, not general public email signup. The current sender accepts only the pilot operator's authorized recipient. A local preview alone sends nothing. Connecting the pilot stores a private account credential locally and requests access to the pinned Compass service on Cloudflare. The server stores a hash of that credential, account preferences, recipient/verification state, consent state, and delivery records.
Verification and delivery-test emails send your chosen address and email content through Resend. A delivery test contains no coursework. Scheduled digests require a verified address, explicit permission to upload assignment details, and a separate enable action. With that permission, the upload includes selected course names, assignment titles, due times, completion flags, snapshot verification time and partial-coverage status. It excludes grades, submission files/content, school credentials, login tokens, and source URLs. Cloudflare Workers and D1 store this minimized snapshot; Resend receives the recipient, subject and message content for email delivery.
Uploaded snapshots are retained for up to seven days, with expiry cleanup on scheduled service runs. Account/preferences and delivery records remain until hosted account deletion; provider-held email/log records follow provider policies. Uncertain sends are recorded to prevent duplicate retries. Scheduled mail can use the uploaded snapshot while Chrome is closed; it cannot fetch fresh school information then. Uploads currently occur when you explicitly enable delivery; refresh and upload again to keep saved data current.
Pause stops future scheduled digests but retains account data. Withdrawing upload consent disables delivery and deletes the stored snapshot. Hosted account deletion removes that account, snapshot, and delivery records from the Compass database; contact support for help if this control is not available in your build. Unsubscribe links stop scheduled delivery. Local reset and uninstall do not delete a hosted account or cancel it, so pause/unsubscribe before removing your local connection. Emails already delivered and provider-held records are not deleted by these actions.
Cloudflare privacy: https://www.cloudflare.com/privacypolicy/
Resend privacy: https://resend.com/legal/privacy-policy
Support, feedback and questions
Support email sent to canvascompasscontact@gmail.com is stored in that Google/Gmail mailbox. The authorized automated support assistant may read support messages and send routine same-thread replies from this address; sensitive or uncertain cases go to the owner for review. Gmail messages are separate from web-form reports and are not covered by the web form’s 30-day database cleanup. They remain until removed from the mailbox, subject to Google’s retention policies. Do not send passwords, verification codes or private coursework.
Use https://compass-digest-pilot.canvas-compass.workers.dev/support. The form sends your category, message, optional reply email, consent and a generated reference number to Compass support on Cloudflare D1. Reports are private and retained for up to 30 days, with scheduled cleanup. Keep your reference number and private status link. New reports receive a secret link showing only the support response and status, not the original report or reply address. Anyone with the link can read that response; do not share it. Only a hash of the link secret is stored. The form does not automatically attach files, school snapshots, device diagnostics, grades, or credentials. Do not include passwords, login codes, notification keys, or private coursework. Theme links carry only a preset theme/school label, not your school login or course data.
Cloudflare processes network request metadata. For abuse prevention, the service derives a daily keyed hash from the request IP address; it does not store the raw IP in the report or rate-limit database. Rate-limit counters are cleaned on scheduled service runs after two days. Reports are reviewed for support; receipt does not guarantee a response time. An automated support agent may review reports and post routine factual responses on private status pages. Sensitive or uncertain requests are escalated to the owner. Responses and access expire after 30 days. Web-form replies appear on the private status page. To contact support by email, use canvascompasscontact@gmail.com.
Exports, controls and limitations
JSON exports may contain private profile, course and assignment information. You choose where to save them and control later sharing. Local reset removes saved extension data/settings and disables local monitoring and automatic Calendar sync. It does not delete downloaded files, Google data, hosted accounts, or information already received by email/Pushover providers. Uninstall removes extension-local storage.
Browser sleep, offline periods, access restrictions and expired sessions can delay checks. Partial or stale snapshots are not proof of current deadlines or completion. Confirm important dates in your learning platform. For access, deletion, privacy questions, or an unexpected message, contact Compass support using the link above; do not send secrets. We will update this policy when data practices change.