Best Student Canvas — Privacy Policy
Effective date: September 13, 2026 Version: 1.0.0 Publisher: ND Studio (Tylor Chacon) Contact: gamerdevguild@gmail.com

Best Student Canvas is a paid browser extension that changes how the Canvas learning management system looks and behaves in your own browser. This policy explains what it does with information. It is written to be understandable without a legal background.

The short version
Best Student Canvas has no server of its own. There is no account, no login, and nowhere for your coursework to be sent. Everything the extension stores stays in your own browser.

The extension reads your Canvas data using the session you are already signed in to, the same way the Canvas page itself does, and shows it back to you in a different arrangement. It never sends that data anywhere.

There are exactly two situations where the extension contacts anyone other than your school's Canvas server:

The license check. To confirm your purchase, the extension sends your license key and a random device identifier to the payment provider, Lemon Squeezy. Nothing else is in that request — not your name, email, Canvas account, grades, or browsing. It runs when you activate, about twice a day afterwards, and when you deactivate.
Google Fonts. If you choose a Google Font by name, the extension asks Google for that font file. That is off by default.
We do not sell information. We do not advertise. We do not track you. There is no analytics, telemetry, crash reporting, or usage measurement of any kind in this extension. These are verifiable facts about the code, and §9 explains how to verify them yourself.

1. Who is responsible
   Best Student Canvas is written, sold, and maintained by ND Studio, the studio of Tylor Chacon, a classroom teacher. Questions, complaints, and requests about this policy go to gamerdevguild@gmail.com.

Your purchase itself — your email address, payment details, and receipt — is handled by Lemon Squeezy under its own privacy policy. The extension never sees any of that; it sees only the license key you paste into it.

1. What the extension stores, and where
   Everything below is stored in your browser. Nothing is transmitted to the publisher.

2.1 Your settings — browser sync storage
Stored under the key bsc:settings. If you are signed in to your browser, it may replicate this to your browser account so your settings follow you between devices. That is the browser's own sync feature and is governed by its maker's privacy policy, not this one. You can prevent it by turning off extension sync, or by signing out of the browser.

What is in it:

What Example Notes
Appearance choices theme, dark mode, font, text size No personal information
Feature switches which panels are on, reminder lead times No personal information
Keyboard shortcuts g d, t No personal information
Sticky notes whatever you type into them Free text you wrote
Your own tasks task titles and due dates you typed Free text you wrote
Branding text a school name or motto, if you typed one Free text you wrote
Hidden courses a list of Canvas course ID numbers Numbers only, no names
Card colors course ID → color Numbers only, no names
Credit hours course ID → number of hours Numbers only, no names
Custom CSS styling rules you wrote, if you use that feature Free text you wrote
Progress marks which assignments you marked started or finished ID numbers only, no titles
The sticky notes and task list are the most sensitive things here, because they hold whatever you decide to type. Treat a sticky note the way you would treat a note in any synced app.

Your settings do not contain your name, your Canvas user ID, your email address, any grade or score, or the name of any course or assignment.

2.2 Caches — local storage on this device only
These never sync and never leave the device.

Key What it holds When it exists How long
bsc:license Your license key, the device identifier the license server assigned, when it was last confirmed, and its status From activation Until you deactivate, or use Delete all my data
bsc:upcoming Titles of upcoming assignments, course names, due dates, point values, and whether you have submitted Only if you turn on Reminders (off by default) Deleted the moment you turn Reminders off
bsc:courses Course ID, name, and code for your active courses Whenever you visit your dashboard Dropped after 180 days
bsc:notified Which reminders have already fired Only with Reminders on Pruned 7 days after an item is due
bsc:fonts The font file, if you chose a Google Font Only if you chose one Refreshed after 90 days; one family at a time
bsc:ui:collapsedSections Which settings sections you folded up Always Until you delete it
bsc:cardImages Pictures you chose for your course cards, from your own device Only if you add one Until you remove it, or use Delete all my data
bsc:localFonts Font files you imported from your own device Only if you import one Until you remove it, or use Delete all my data
bsc:accountImage A picture you chose for your own account avatar, from your own device Only if you choose one Until you remove it, or use Delete all my data
bsc:upcoming is the only cache that holds academic content, and it exists only if you switch on the reminder feature.

About the account picture. If you set one, it is stored on this computer and shown only in this browser. It does not change your Canvas profile picture — your teachers and classmates still see whatever Canvas has for you. This extension only ever reads from Canvas and never writes to it. Your chosen picture is never uploaded anywhere.

2.3 What is never stored
No grade or score is written to disk anywhere by this extension. Grades are read from Canvas, used to draw a panel on the screen, and discarded when the page closes.

1. What the extension reads from Canvas
   The extension calls the Canvas API in your browser using the session you are already signed in with. It can see only what you can see. Every request is a read (GET); the extension never writes anything back to Canvas — it cannot submit work, change a grade, post a message, or alter your account.

It reads:

Your list of active courses, with names and current scores
Upcoming and overdue items from your planner
Assignments in a course, with your own submission scores
The description of a single assignment or announcement, when you click "Peek"
All of this stays inside your browser.

1. Who else receives information
   In full:

Recipient What they receive When
Your school's Canvas server Ordinary API reads, using your existing session Whenever you use Canvas with the extension on
Lemon Squeezy (license server) Your license key and a random device identifier, plus your IP address and browser version — inherent to any web request At activation, roughly every 12 hours afterwards, and at deactivation
Google Fonts The font name you typed, plus your IP address and browser version Only if you choose a Google Font. Off by default
Your browser's maker (sync) Your settings, including sticky notes Only if you are signed in with extension sync on
The publisher Nothing. The publisher can see, in the Lemon Squeezy dashboard, that a given key has been activated on some number of devices — and nothing about what those devices are or do Never, beyond that
The license request tells Lemon Squeezy that a device with this key wants to confirm it is paid for. It carries no cookies and no Canvas information. The result stored on your device is a valid/invalid answer and a status word.

If you would rather Google receive nothing at all, leave the font setting on any of the built-in options — or import a font file from your own device, which uses no network at all.

1. What the extension does not do
   We do not sell personal information. There is no buyer, no transaction, and no mechanism.
   We do not use your information for advertising. The extension contains no advertising of any kind.
   We do not build a profile of you for any purpose other than showing you your own coursework on your own screen.
   We do not use your data to train machine-learning models.
   There is no analytics, telemetry, or usage tracking. No install ping, no crash reporting, no feature-usage counting. The license check is not used to measure anything beyond whether a key is valid.
   The extension executes no remote code. Everything it runs ships inside the installed package.
2. Diagnostics
   The extension has a Diagnostics panel that checks whether it is still working against the current version of Canvas.

It runs only when you press the button.
The report contains counts, color values, CSS selector names, and API field names — not your coursework. Course and assignment ID numbers are stripped from it.
The report goes nowhere. It appears in a text box for you to read.
7. Your choices and your control
See everything stored: Settings → Export settings writes a readable JSON file of everything in your settings.
Delete everything: Settings → Delete all my data. This deactivates your license on this device (freeing the slot for another computer), then erases your settings, notes, tasks, and every cache, on this device and from browser sync. It cannot be undone.
Delete one thing: turn off the feature. Switching Reminders off deletes the cached list of upcoming work immediately.
Deactivate this device: Settings → License → Deactivate. The key is forgotten here and released on the license server.
Uninstalling the extension removes all local data. Deactivate first so the device slot is released.
8. Children under 13
The extension collects nothing from anyone and transmits nothing about the person using it. Everything a student stores is on the student's own device, under the student's own control, and can be erased with one button. A parent or guardian who buys a license for a child under 13 is the person who completes the purchase; the extension itself asks the child for nothing.

If a school deploys the extension, the school remains responsible for its own COPPA and FERPA determinations.

1. How to verify all of this
   This is a browser extension: the entire source is readable text on your own machine.

Read the code. There are no minified files, no bundler, and no third-party libraries.
Search it. Every network request is a fetch() call. The license calls all go through one function in src/core/license.js; the others go to your own Canvas server and to Google Fonts. There is no XMLHttpRequest, sendBeacon, or WebSocket anywhere.
Watch it. Open DevTools → Network while using Canvas. Every request goes to your Canvas host, unless you have chosen a Google Font. The license check goes to api.lemonsqueezy.com and you can read its body.
Check the permissions. The extension asks for storage, alarms, and notifications, and access to Canvas hosts, the license server, and the two Google Fonts hosts. Nothing else.
An automated test suite runs against the extension on every change. Several of those checks exist specifically to keep the statements in this policy true — that no unused permission is requested, that the license request carries only the key and a device id, that custom CSS cannot reach a third-party server, and that every stored key can be deleted from the settings page.

1. Changes to this policy
   Material changes will be announced in the extension's release notes and dated here before taking effect. The current version always lives at https://sites.google.com/view/best-student-canvas/privacy-policy.
2. Security incidents
   If information handled by the extension is ever misused or exposed, the publisher will notify affected users as soon as possible. Given the architecture, the realistic incident is a defect that causes the extension to expose something locally — not a server breach, because there is no server. Report anything suspicious to gamerdevguild@gmail.com.
3. Governing law
   This policy is governed by the laws of the State of Colorado. It is written with the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) and the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) in view.