← CourseCast
Privacy Policy

Last updated: April 22, 2026

CourseCast is a grade-tracking service for students using Brightspace (D2L) and Canvas learning management systems. This page describes exactly what we collect, where it lives, and what you can do with it. If anything here is unclear, email support@coursecast.org.
What we collect

From your LMS account (Brightspace or Canvas), the CourseCast browser extension reads:

Courses you are enrolled in, including course name, term, and instructor when available
Assignments and their due dates, point values, and grading category
Grades you have received, including per-assignment scores and category weights
Grade schemes (e.g. letter cutoffs) published by each course
Announcements posted in your courses


When you create a CourseCast account we also store the name and email address returned by Google Sign-In, and, for paying customers, the Stripe customer ID associated with your subscription.
Product telemetry

So we can investigate bugs and decide what to work on next, the CourseCast backend also records:

Which dashboard pages you open and when (tied to your account)
When the extension runs a sync, which LMS it was, and whether the sync succeeded or errored
Server-side request logs for our own API (endpoint, response code, latency), tied to your account
Error reports generated when something in the extension or dashboard fails


This is first-party product analytics only — we do not send it to Google Analytics, Mixpanel, Amplitude, or any other third-party analytics vendor. It is retained under the same rules as the rest of your account data and deleted when you delete your account.
What we do not collect

Your LMS username or password — we never see them
Any page or tab you visit outside your LMS
Discussion posts, private messages, assignment submissions, or file uploads
Payment card numbers — Stripe handles all card data directly


How the extension reads your LMS

The extension runs in your browser while you are signed in to your school’s LMS. It uses your existing browser session cookie to call the LMS’s official REST APIs (D2L Valence for Brightspace, the Canvas REST API for Canvas) from the same origin as your LMS. That cookie is issued by your school and is never read from another site, copied out of the browser, or sent to CourseCast servers. If you sign out of your LMS, the extension loses access immediately.
Where data is stored

Grades and course data are sent from the extension to the CourseCast backend over HTTPS and stored in a PostgreSQL database on infrastructure we operate in Georgia, USA. Access is limited to the account that owns the data and, when strictly necessary to investigate a support request you have opened, CourseCast staff.
Third parties

Google Sign-In — used only to authenticate you. We receive your email address, full name, and avatar URL. We do not post to your Google account, read your Gmail, or access your Drive.
Stripe — used to process subscription payments. We send Stripe your email address, your internal CourseCast user ID, and subscription metadata (plan, status, renewal date). We do not send Stripe any grade or course data. Your card details go directly from your browser to Stripe; CourseCast never sees them.
Cloudflare — fronts our domains for TLS termination and DDoS protection. Standard request logs (IP, path, timestamp, user agent) are retained by Cloudflare per their policy.


We do not sell your data, run advertising trackers, or share data with third-party analytics vendors. See “Product telemetry” below for the first-party usage data we record for our own operations.
Retention and deletion

Academic data (courses, assignments, grades) is retained while your account is active so that you can see trends over time. When you delete your account from Settings → Delete account, all personal and academic records tied to that account are removed from live systems immediately and purged from encrypted database backups within 30 days.
Your rights

You can, at any time:

Export all your CourseCast data as JSON from your account settings
Delete your account and all associated data from your account settings
Email support@coursecast.org to request a copy of your data, correct inaccurate information, or ask any question about how your data is handled


Children

CourseCast is intended for students 13 and older. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, email support@coursecast.org and we will remove it.
Changes to this policy

If we change what we collect or how it is used, we will update the “Last updated” date at the top of this page and, for material changes, notify account holders by email before the change takes effect.
Governing law

CourseCast is operated from the State of Georgia, USA. This policy and any dispute arising from it are governed by the laws of the State of Georgia, without regard to conflict of law principles.
Contact

Questions, data requests, or anything else: support@coursecast.org.
Privacy
Terms
Support