Privacy Policy

Effective Date: January 1, 2025

Hello. We are the developers behind Canvas Help, an independent browser extension available on the Chrome Web Store and Firefox. We believe privacy policies should be easy to read and completely honest about what happens to your data.

This policy explains exactly what data we collect, what we don't collect, and how we keep your information safe.

The short version

We collect the bare minimum required to run your account and process your subscription. We do not collect your browsing history, page content, or Canvas quiz data. The extension does its job locally on your device.

What data we collect

We only collect data that is strictly necessary to provide our service. This data is split into two categories: data stored on our servers, and data stored locally on your device.

Account Data (Stored on our servers)

Name and Email: Used to create your account, log you in, and communicate with you.
Password: We never store your password in plain text. It is securely hashed using bcrypt before it ever touches our database.
Account Metadata: Your internal user ID, subscription plan tier (Free or Pro), subscription expiration date, and the date you created your account.

Payment Data (Stored on our servers)

Paddle Customer ID: If you upgrade to Pro, we store a reference ID provided by Paddle to link your account to your subscription.
Note: We never see, handle, or store your actual credit card number or billing details. All of that is handled securely by Paddle.

Local Browser Data & Permissions (Stored on your device)

To function, the Canvas Help extension requires certain browser permissions and stores data locally on your computer using chrome.storage.local. We do not use traditional browser cookies for the extension's core functionality.

Authentication Token: A JWT token to keep you logged in.
User Preferences: Your basic profile info (name, email, plan) and whether the extension toggle is currently turned on or off.
Activity Log: A temporary log of blocked detection attempts (event type and timestamp). This lives entirely in your browser's memory and is cleared when you reload the page or update the extension. It is never sent to our servers.
Host Permissions (<all_urls>): The extension requests permission to run on all URLs. This is strictly required because Canvas LMS instances are hosted on thousands of different custom university domains (e.g., canvas.yourschool.edu). We need this permission to inject our detection-blocking script wherever your specific Canvas instance lives.

What we do NOT collect

We want to be explicitly clear about what we do not track or store:

Browsing History: We do not track what websites you visit.
Page Content: We do not read, record, or transmit the content of the pages you are on.
Academic Data: We do not collect your Canvas quiz answers, grades, course names, or any other academic content.
Device Fingerprints: We do not attempt to uniquely fingerprint your device or browser.
IP Addresses: We do not actively log or store your IP address (beyond the temporary, automatic network logs generated by our hosting provider, Railway.app, for security and routing purposes).

How we use your data

We use the data we collect for the following purposes:

To create and manage your Canvas Help account.
To authenticate your login via the browser extension.
To process your Pro subscription and manage your billing status.
To provide customer support when you email us.

Third-party services

We rely on a few trusted third-party services to run Canvas Help. We only share the minimum data necessary for these services to function.

Paddle: We use Paddle to process payments for Pro subscriptions. When you upgrade, you are redirected to Paddle's secure checkout. You can read their privacy policy at www.paddle.com/legal/privacy.
Railway.app: Our backend database and server are hosted on Railway.app infrastructure. You can read their privacy policy at railway.app/legal/privacy.
Google Fonts: We use Google Fonts to load the Nunito font on our website. You can read their privacy policy at policies.google.com/privacy.

Data storage and security

Your account data is stored in a secure PostgreSQL database hosted by Railway.app. We protect your data by using industry-standard security practices, including hashing all passwords with bcrypt (10 salt rounds) and securing all communications between the extension and our servers with HTTPS.

Authentication is handled via JSON Web Tokens (JWT) signed with a secure secret key, which expire automatically after 30 days.

Your rights and data deletion

You own your data. You have the right to access, correct, or delete the personal information we hold about you.

If you would like to permanently delete your account and all associated data from our database, please email us at support@canvashelp.app from the email address associated with your account. We will process your deletion request within 30 days.

Children's privacy

Canvas Help is designed for university students. Our service is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information immediately.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our product or legal requirements. If we make significant changes, we will update the "Effective Date" at the top of this page. Your continued use of Canvas Help after any changes indicates your acceptance of the updated policy.

Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@canvashelp.app.