Privacy Policy

Overview

GradeGlance ("GradeGlance", "we", "us", or "our") is an unofficial, third-party application that helps parents and students view academic information from Canvas LMS. This privacy policy explains how we collect, use, and protect your information.

Information We Collect

When you use GradeGlance, we collect and store:

• Account Information: Email address, display name, and hashed password
• Canvas API Token: Your Canvas access token (encrypted using AES-256-GCM)
• Canvas Data: Course information, assignments, grades, submissions, and teacher comments retrieved from your Canvas account
• Preferences: Your app settings including semester dates and sync preferences
• Content You Provide: Messages you send to the AI chat assistant and its replies, reminders you schedule, notes you add to assignments, and feedback you submit
• Usage and Diagnostic Data: IP address, browser user agent, the pages and requests you make, referrers, time spent on pages, in-app actions, and error reports
• How You Found Us: On your first visit to our website we set a cookie that remembers the site that referred you, the first page you saw, and any campaign tags in the link, for 30 days, so we can tell which pages lead people to sign up. It holds nothing else

How We Use Your Information

Your information is used to:

• Authenticate you and maintain your session
• Connect to Canvas LMS on your behalf to retrieve academic data
• Display your courses, assignments, grades, and other academic information
• Cache data locally to reduce API calls and improve performance
• Provide AI-powered insights (if you choose to use this feature)
• Understand how the app is used, and diagnose and fix errors

AI Features and Third-Party Services

GradeGlance uses Azure OpenAI (a Microsoft service) for its AI features: AI Insights summaries, the AI chat assistant, and automatic shortening of long course names during sync.

AI-generated content is clearly labeled. We do not use your data to train AI models. AI Insights and AI chat are optional - you can use GradeGlance without them. Course-name shortening runs automatically during sync when a course name can't be abbreviated without AI, and sends only the course name and code.

Data Storage and Security

• Local Storage: Your account, Canvas data, and the content you provide are stored in a PostgreSQL database hosted on secure infrastructure. Usage and diagnostic data is also sent to the analytics providers listed under Data Sharing
• Encryption: Canvas API tokens are encrypted using AES-256-GCM before storage
• Passwords: User passwords are hashed using bcrypt and are never stored in plain text
• Session Tokens: Session tokens are stored in httpOnly cookies and expire after 24 hours
• Breach Response: In the event of a data breach, we will notify affected users within 72 hours

Data Retention

We retain your data for as long as your account is active. Cached Canvas data is refreshed periodically through syncs. You can request deletion of your account at any time by contacting us.

When your account is deleted, we permanently delete it and everything linked to it: the Canvas data we cached, AI chats, notes, reminders, feedback, usage and diagnostic records, and our copies of emails we sent you. We keep only a record that an administrator deleted an account (the account number and date, with no other details) and the ids of payment notifications Stripe sent us, with no other details. Stripe keeps its own payment records under its own policies, and operational logs kept by our hosting provider, Microsoft Azure, are deleted automatically within 12 months.

Data Sharing

We do not sell, rent, or share your personal information with third parties except:

• With service providers that process it on our behalf to operate GradeGlance:
  • Stripe, to process payments (your email address, display name, and an internal account ID when you subscribe)
  • Azure Communication Services (Microsoft), to deliver account and notification emails (your email address and the message)
  • Azure Application Insights (Microsoft), to monitor performance and errors and measure usage of the app and our website
  • Google Analytics, to measure visits to our website
  • Google, if you choose to sign in with Google
  • Your browser's push notification service, if you turn on notifications
• When you use AI features, and for automatic course-name shortening (data is sent to Azure OpenAI as described above)
• If required by law or legal process

Your Rights

You have the right to:

• Access your personal data stored in GradeGlance
• Request correction of inaccurate data
• Request deletion of your account and data
• Revoke your Canvas API token at any time through Canvas settings

Canvas API Usage

GradeGlance accesses Canvas LMS through the official Canvas API using your personal access token. We only request data necessary for the dashboard functionality. Your use of this application should comply with your institution's acceptable use policies.

Children's Privacy

GradeGlance is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at privacy@gradeglance.com and we will delete such information.

Contact

For questions about this privacy policy or to request data deletion, please contact us at privacy@gradeglance.com.