What this collects, what it does with it, and what it never does. Two different pieces with two different answers, so they're separate below.
When you connect at /setup, this server stores your Canvas web address and your Canvas access token. The token is encrypted (AES-GCM) before it is written, and is decrypted only to make a request to your own school's Canvas.
It is used for exactly one thing: reading your coursework from Canvas when you ask Claude a question that needs it. Everything this can reach is something you can already see when you log into Canvas yourself, and it is read-only: it cannot submit work, post, unenroll, or change anything.
Your coursework is not stored. Responses from Canvas are cached briefly (minutes) so that a single conversation doesn't make the same request repeatedly, which is what keeps Canvas from rate-limiting your account. Nothing is sold, shared, or used for advertising, and nobody reads your data.
Operational logs are kept for 3 days. They record that a request happened and whether it worked. They never contain your access token, your connector URL, your name, or your Canvas user id.
A connection that goes completely unused for 180 days deletes itself. You can delete everything at any time at /data, which needs nothing but a working Canvas token. No connector URL, no account, no email.
By default the extension sends nothing to this server. Your Canvas address (and your access token, if you chose token mode over your existing Canvas login) is held in your browser's local extension storage, on your computer, and the extension talks to your school's Canvas directly. We do not receive them and could not read them.
Stored locally: your Canvas address and connection settings, your reminder preferences, a cached copy of your recent coursework so the popup can open instantly, and which reminders have already been shown. Local storage is used deliberately rather than browser sync, so credentials are never copied to your Google account or to your other machines.
The extension makes requests to your school's Canvas, read-only, and to nothing else, unless you press one particular button.
The one exception, and it needs an explicit press. The extension's settings offer to set up a connector for you, so that you can ask Claude about your coursework without making a second Canvas token and pasting it into this site by hand. Pressing that button sends your Canvas address and your access token here, where the token is encrypted exactly as described further up this page, and hands back a connector URL. Nothing does this on your behalf, no other feature depends on it, and the button explains the transfer before you press it. Once you have, the connection is an ordinary one: it appears at /data and can be deleted there, or from the page the button gives you.
There is no analytics, no tracking, no telemetry, and no third-party service of any kind. "Delete everything" in the extension's settings removes everything held on your computer at once. That is separate from deleting a connection you made with the button, which lives here rather than on your computer.
If you use the feedback form, your message is emailed to the maintainer. The form asks for your email address as well, which is optional and exists only so a question can be answered. Leave it blank and the message arrives anonymously. Nothing from that form is stored on this site, and an address left there is used to reply to you and nothing else: no list, no newsletter, never passed on.
This is a personal project run by a student, not a company. If something here is unclear or looks wrong, say so.