Privacy Policy

1. Introduction

This Privacy Policy describes how Canvas Ninja ("we," "us," or "our") collects, uses, and shares information when you use our browser extension ("Extension"). Installing the Extension or reading this policy does not constitute agreement to automatic compatibility reporting; that requires a separate affirmative choice in the Extension.

2. Information We Collect

2.1 Account Information

• Email address: Collected when you create an account or log in
• Password: Used for authentication (stored securely via Supabase)
• Payment status: Whether you have an active subscription (monthly or lifetime)

2.2 Automatically Collected Information

• Authentication tokens: Session data to keep you logged in
• User preferences: Your settings and feature toggle states (e.g., Privacy Guard enabled/disabled, Answer Saver enabled/disabled, Show Canvas Toolbar preference)
• Product analytics: A pseudonymous installation identifier, Extension version, broad country, and milestone events such as installation, account creation, email verification, first session, first feature activation, first successful AI answer, and checkout start
• Attribution identifiers: DataFast visitor and session identifiers may be stored locally and attached to checkout metadata so we can understand which website visits lead to installs and purchases

2.3 Automatic compatibility reports

In diagnostics-enabled versions, reporting starts only after you explicitly agree in the Extension and server collection is enabled for your version. The temporary mandatory diagnostics campaign runs September 26 through October 10, 2026 at 00:00 UTC. During this period, feature activation is paused without agreement; your account and purchases remain intact. After the fixed deadline diagnostics is optional. A delayed Store release shortens the period rather than extending it. Declining or expiry never authorizes collection.

Reports contain a bounded, allowlisted structural description of eligible Canvas pages: element categories, fixed markers, control types, synthetic parent relationships, extension version, toolbar status and coarse rendering time. We do not include raw HTML, question text, answer choices, entered responses, selected answers, names, grades, page URLs, course identifiers, cookies or credentials in these reports. Unknown structures remain limited rather than triggering broader collection.

We record the agreement and server receipt times, disclosure version and a hashed random installation support code. Sharing your support code allows support to locate your installation's reports. These records are pseudonymous, not anonymous. Authentication protects ingestion; a separate keyed account digest enforces quotas. Our hosting providers may process connection metadata such as IP addresses.

At most three report uploads are attempted per installation per day, with structural deduplication and additional server limits. Reports, consent events and report links expire after 14 days; deduplication digests expire after 90 days. Reviewed synthetic fixtures may remain until deleted. Compatibility reports are separate from marketing analytics and are not used for advertising or sold.

Withdraw agreement in Extension Settings to stop new capture and cancel pending uploads. Cancellation cannot recall data already received. Refresh open Canvas pages when safe to finish deactivating scripts already loaded. Contact hello@canvasninja.app about privacy or deletion. See the versioned compatibility disclosure for further details.

2.4 Information from Canvas LMS and AI Answers

AI Answers separately sends question content and answer choices through our backend to OpenAI when you use that feature. The exclusions for compatibility reports do not apply to AI question processing. Do not submit confidential material or content you are not authorized to share.

When using the Answer Saver feature, the Extension accesses:

• Quiz submission history from your Canvas LMS account
• Previously submitted answers on quizzes with multiple attempts
• Course and quiz identifiers from page URLs

3. Browser Permissions

The Extension requires the following permissions:

4. How We Use Your Information

We use collected information to:

• Authenticate your account and verify subscription status
• Provide and maintain Extension functionality
• Store your feature preferences locally on your device
• Process payments through our third-party payment processor
• Measure installation, activation, and purchase funnels and diagnose where users have difficulty completing setup

5. Data Storage

5.1 Local Storage

The following data is stored locally in your browser using Chrome's storage.local API:

• Email address
• Payment status (paid/lifetimePaid)
• Feature preferences (privacyGuardEnabled, saveCorrectAnswers, showInjectedUI)
• Authentication session tokens
• Pseudonymous installation and DataFast attribution identifiers

5.2 Remote Storage

Account and subscription data is stored on Supabase servers, including:

• User account information
• Subscription/entitlement status
• Limited Extension lifecycle events used for product analytics; quiz answers and raw quiz question content are not included in these DataFast funnel events

6. Third-Party Services

We use the following third-party services:

We do not sell your personal information to third parties.

7. Data Sharing

We do not share your personal information except:

• With service providers necessary to operate the Extension and measure its performance: Supabase for accounts and storage, Stripe for payments, OpenAI for AI Answers, DataFast for analytics, and hosting providers for serving and securing the service
• If required by law or legal process
• To protect our rights or the safety of users

8. Data Security

We implement security measures including:

• Encrypted authentication via Supabase
• Session token expiration and automatic logout
• Secure payment processing via Stripe (we never store full payment card details)

9. Your Rights and Choices

9.1 Access and Deletion

You can:

• Log out at any time to clear your session data
• Contact us to request deletion of your account and associated data

9.2 Manage Preferences

You can enable or disable features at any time through the Extension settings:

• Privacy Guard
• Answer Saver
• Canvas Toolbar visibility

9.3 Uninstall

Removing the Extension will delete all locally stored data. Contact us to delete server-side account data.

10. Children's Privacy

The Extension is not intended for use by individuals under 13 years of age. We do not knowingly collect personal information from children under 13.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this policy.

12. Data Retention

• Local data: Retained until you log out or uninstall the Extension
• Account data: Retained until you request account deletion
• Payment records: Retained as required for tax and legal compliance

13. International Users

Our services are hosted in the United States. By using the Extension, you consent to the transfer of your information to the United States, which may have different data protection laws than your country.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:

• Email: hello@canvasninja.app