Overview
CanvasProof (“we,” “us,” or “our”) helps students see deadlines, grades, and course materials from Canvas in one place. This Privacy Policy explains what information we collect, how we use it, and the choices you have when you use canvasproof.com and related services (the “Service”).
CanvasProof is not affiliated with, endorsed by, or sponsored by Instructure or Canvas LMS. When you connect Canvas, we access your Canvas account only with the credentials you provide.
Information we collect
Account information
When you create an account, we collect your email address and authentication credentials through our identity provider (Supabase Auth). You may also provide a display name, avatar, and timezone in your profile.
Canvas connection data
To sync your courses, assignments, grades, and course files, you provide your Canvas instance URL and a personal access token. Your token is encrypted at rest before storage. We use it only to fetch data from Canvas on your behalf while your account is active.
Data retrieved from Canvas may include course names, assignment titles and due dates, submission status, grades, and links to course materials. We store what is needed to power the Service, such as calendar views, grade summaries, and assignment prep features.
Google Workspace (optional)
If you choose to connect Google Workspace, we receive your Google account email and an OAuth refresh token (encrypted at rest) with the scopes you approve. We use this only to create or open Google Docs related to assignment prep. You can disconnect Google at any time in Settings.
Usage and product data
We record how you use CanvasProof to improve the product and show you relevant information, including:
- Prep sessions and study activity within the app
- Which course materials you open or mark as reviewed
- Notification preferences and delivery logs
- Subscription and trial status
Academic Rhythm sharing (opt-in)
If you turn on public sharing, we generate an opaque share link that may display your first name, weekly progress score, streak, and ring summary. We do not include course names, assignment titles, or grades on public share pages unless you explicitly choose to share that information elsewhere.
Payment information
Paid plans are processed by Stripe. We receive your email, plan type, and payment status from Stripe. We do not store full credit card numbers on our servers.
Communications
We send transactional emails (account verification, password resets, deadline reminders, and trial notices) to the address on your account. You can adjust notification preferences in Settings.
Technical data
Like most web services, our hosting provider may automatically collect standard log data such as IP address, browser type, request timestamps, and error reports needed to operate and secure the Service.
How we use information
We use the information above to:
- Authenticate you and maintain your account
- Sync and display your Canvas coursework, grades, and deadlines
- Send reminders and digests you have opted into
- Provide AI-assisted assignment prep when you request it
- Process payments and manage subscriptions
- Detect abuse, prevent fraud, and keep the Service secure
- Improve features and fix bugs
We do not sell your personal information. We do not use your Canvas coursework to train general-purpose AI models.
AI features
When you use assignment prep or related intelligence features, we may send relevant assignment context (such as title, description, and your notes) to OpenAI to generate suggestions. That processing is tied to your request and is not used to advertise to you.
Service providers
We rely on trusted vendors who process data on our behalf, including:
- Supabase — authentication and database hosting
- Vercel — application hosting and infrastructure
- Stripe — payment processing
- Resend — transactional email delivery
- OpenAI — AI-generated prep content on request
- Google — optional Google Docs integration
These providers are permitted to handle your information only as needed to perform services for us and are subject to their own privacy policies.
How we protect data
Canvas and Google tokens are encrypted before storage. Access to production data is limited to systems and personnel who need it to operate the Service. No method of transmission or storage is 100% secure, but we use industry-standard safeguards appropriate to the data we handle.
Retention
We keep your information while your account is active and as needed to provide the Service. If you disconnect Canvas or Google, we remove the associated tokens. If you delete your account, we delete or anonymize personal data within a reasonable period, except where we must retain records for legal, security, or billing purposes.
Your choices
- Canvas & Google: Connect or disconnect integrations in Settings at any time.
- Notifications: Control digest, exam, and trial emails in Settings.
- Public sharing: Academic Rhythm sharing is off by default and can be disabled anytime.
- Access & deletion: Email us to request a copy of your data or deletion of your account.
Regional rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. To exercise these rights, contact us at the email below. We will respond within the time required by applicable law.
If you are in the European Economic Area or United Kingdom, we process personal data based on contract performance (providing the Service), legitimate interests (security and product improvement), and consent where required (such as optional sharing features).
If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know what we collect and the right to opt out of sale — we do not sell personal information.
Children
CanvasProof is intended for students who can lawfully enter into our terms of use. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.
International transfers
We operate from the United States and use service providers that may process data in the U.S. and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may also be communicated by email or in-app notice.
Contact us
Questions about this Privacy Policy or your data? Email Canvas@canvasproof.com.