================================================================================
BETTERCANVAS - PRIVACY POLICY
================================================================================
Last Updated: August 25, 2026
BetterCanvas ("we", "our", or "the extension") is committed to protecting the privacy of students and users. This Privacy Policy explains our data practices, the permissions we request, and why your data remains 100% private and local to your device.
--------------------------------------------------------------------------------
1. SUMMARY OF KEY PRINCIPLES
--------------------------------------------------------------------------------
• ZERO Data Collection: BetterCanvas does not collect, log, track, sell, or transmit any personal information, academic data, assignment content, or grades.
• ZERO External Servers: All operations and calculations take place entirely on your device. The extension does not connect to any remote analytics, advertising, or telemetry servers.
• Local & Browser Storage Only: Your settings, custom notes, theme preferences, and GPA configurations are stored exclusively in your browser via Chrome's secure storage API (chrome.storage.sync / chrome.storage.local).
--------------------------------------------------------------------------------
2. INFORMATION WE HANDLE & HOW IT IS USED
--------------------------------------------------------------------------------
• User Preferences & Custom Themes: Stored locally in chrome.storage.sync to remember your preferred dark mode setting, theme choice, accent color, and custom CSS.
• Dashboard Notes & Custom Tasks: Your notes and personal task checklists are saved directly inside your browser so you can access them across browser sessions. They are never sent to external servers.
• Academic Grades & Course Calculations: GPA calculations and grade badges are calculated dynamically inside your browser DOM on your device. We never store, transmit, or analyze your school transcripts or student identity.
--------------------------------------------------------------------------------
3. EXPLANATION OF REQUESTED PERMISSIONS
--------------------------------------------------------------------------------
To provide its functionality, BetterCanvas requests the following permissions in manifest.json:
1. "storage"
Why it is needed:
Allows the extension to save your preferences (e.g., active theme, dark mode status, custom grade cutoffs, sticky notes content, and task lists).
Is it necessary? YES. Without this permission, your settings and notes would be lost every time you close the browser.
2. "scripting"
Why it is needed:
Used to dynamically apply CSS variables, Google Fonts, and custom user CSS overrides into Canvas LMS web pages.
Is it necessary? YES. Essential for injecting dark mode themes and custom stylesheets.
3. "alarms"
Why it is needed:
Runs a periodic local timer (once every few minutes) to check whether it is time to turn on or off Dark Mode based on your configured schedule (e.g., sunset to sunrise).
Is it necessary? YES (if using the auto-schedule dark mode feature). It operates purely locally without waking unnecessary background threads.
4. "contextMenus"
Why it is needed:
Adds convenient right-click options ("Toggle Dark Mode", "BetterCanvas Settings") to your browser context menu.
Is it necessary? YES for the quick-access context menu shortcuts.
5. Host Permissions ("*://*.instructure.com/*")
Why it is needed:
Restricts the extension content script to execute ONLY on official Canvas LMS domains.
Is it necessary? YES. The extension cannot modify or restyle Canvas pages without permission to run on Canvas domains.
--------------------------------------------------------------------------------
4. ARE ALL THESE PERMISSIONS NECESSARY?
--------------------------------------------------------------------------------
YES. Every requested permission adheres strictly to the Principle of Least Privilege (PoLP):
• We do NOT request broad permissions like "<all_urls>" in host_permissions.
• We do NOT request access to cookies, webRequest, history, identity, geolocation, or tabs management.
• Permissions are scoped exclusively to the official Canvas LMS domain (*.instructure.com) and local browser configuration storage.
--------------------------------------------------------------------------------
5. THIRD-PARTY DISCLOSURE
--------------------------------------------------------------------------------
BetterCanvas does not share, disclose, or sell any data to third parties, advertisers, or data brokers.
--------------------------------------------------------------------------------
6. CONTACT & QUESTIONS
--------------------------------------------------------------------------------
If you have any questions or feedback regarding this Privacy Policy, you can review the open-source repository or reach out via our project page:
Website: https://github.com/UseBetterCanvas/bettercanvas
================================================================================