Privacy Policy

When you connect your Canvas account and use AssignmentSync, we collect and store:

From Canvas (via your API token)

• Canvas API token — encrypted with AES-256-GCM before storage. We never store it in plaintext.
• Profile info — your name and avatar URL
• Course data — course names, codes, and enrollment info
• Assignment data — names, descriptions, due dates, submission statuses
• Grade data — scores, letter grades, points possible
• Announcements — course announcements and messages

Created by you in-app

• Personal tasks (titles, due dates, completion status)
• Assignment notes
• Study session records (duration, date)
• Theme, accent color, and notification preferences
• Course color customizations
• Push notification subscription endpoints (if enabled)

We want to be explicit about what we don't touch:

• Your Canvas password — we never see it. You authenticate via an API token you create in Canvas.
• Payment details — credit cards, bank info, and billing addresses are handled entirely by Stripe. We only receive a confirmation that payment succeeded.
• Browsing history — we don't track pages you visit outside of AssignmentSync
• Location data — we don't request or store your location
• Device fingerprints — no fingerprinting or cross-site tracking
• Analytics / telemetry — no Google Analytics, no Mixpanel, no tracking pixels

Your data is used for one purpose: running AssignmentSync.

• Syncing your Canvas assignments, courses, and grades to display in the dashboard
• Sending you push notifications about upcoming due dates (if you opt in)
• Storing your preferences so the app looks and works the way you set it up
• Calculating study stats from your focus timer sessions

Your data is never sold to third parties. It is never shared with advertisers. We don't run ads. We don't build advertising profiles. Our revenue comes from subscriptions, period.

• Database: PostgreSQL hosted on Neon (Azure West US 3 region)
• Encryption at rest: Neon encrypts all data at rest using AES-256
• Encryption in transit: all connections use TLS/SSL
• API token encryption: your Canvas token is encrypted with AES-256-GCM using a server-side key before storage
• Application hosting: Vercel (US region), serverless functions with no persistent local storage

Your data is kept for as long as your account is active. When you disconnect your Canvas account from the Settings page:

• Your encrypted Canvas API token is deleted immediately
• All synced data (assignments, courses, grades, announcements) is deleted
• All in-app data (tasks, notes, study sessions) is deleted
• Your user record and preferences are removed
• Push notification subscriptions are deleted

Deletion is permanent and happens immediately. We don't keep backups of individual user data after disconnection.

AssignmentSync uses a limited set of third-party services. Each receives only the minimum data required:

We do not use any analytics services, advertising networks, or social media tracking tools.

The Family Educational Rights and Privacy Act (FERPA) protects student education records. Here's how AssignmentSync fits in:

• You connect AssignmentSync using your own personal Canvas API token, generated from your own account
• We access only the data that Canvas makes available to you through that token
• Under FERPA, when a student voluntarily shares their own education records with a third-party service, the student controls that disclosure
• We act as a service provider processing data at your direction, not as a school official with independent access to education records
• We do not access data beyond what your token authorizes, and we never contact your institution directly

You have full control over your data:

• Access: View all your stored data directly in the app (dashboard, grades, settings)
• Export: Download your data as CSV or PDF from the Settings page at any time
• Delete: Disconnect your account from Settings to permanently delete all data
• Correct: Your Canvas data is synced from the source — corrections happen in Canvas and sync automatically

AssignmentSync uses one cookie:

That's it. No tracking cookies, no analytics cookies, no third-party cookies, no cookie consent banner needed.

If you're a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know: You can request what personal information we've collected. This policy covers everything we collect.
• Right to delete: You can delete all your data from the Settings page at any time.
• Right to opt out of sale: We do not sell your personal information. Never have, never will.
• Non-discrimination: We won't treat you differently for exercising your privacy rights.

AssignmentSync is designed for college and university students. We do not knowingly collect data from children under 13. If you believe a child under 13 has connected an account, contact us and we'll delete it immediately.

We may update this privacy policy from time to time. When we make significant changes:

• We'll update the "Last updated" date at the top
• We'll notify active users via email or in-app notification
• Material changes (new data collection, new third-party services) will be communicated at least 30 days in advance

Questions about your privacy or this policy? Email us at privacy@assignmentsync.app.

For general support or account issues: support@assignmentsync.app.