================================================================================
PRIVACY POLICY & PERMISSION AUDIT FOR BETTERCANVAS
Last Updated: October 2026
================================================================================
BetterCanvas was built by students, for students, with a steadfast commitment to privacy and data protection. We believe that educational software should never compromise student confidentiality, track academic activity, or collect personal information.
--------------------------------------------------------------------------------
1. CORE PRIVACY COMMITMENT & DATA PRACTICES
--------------------------------------------------------------------------------
• NO DATA COLLECTION:
BetterCanvas does NOT collect, store, transmit, sell, or analyze your personal data, login credentials, academic submissions, grades, or browsing history.
• 100% CLIENT-SIDE EXECUTION:
All features—including dark mode styling, card color rendering, GPA calculations, and dashboard sticky notes—run entirely locally inside your browser window.
• NO THIRD-PARTY SERVERS OR ANALYTICS:
BetterCanvas contains zero external tracker scripts, zero telemetry beacons, zero Google Analytics, and zero third-party advertising frameworks. There are no remote backend servers receiving your data.
• NO MODIFICATION OF ACADEMIC RECORDS:
The extension only customizes how Canvas LMS appears on your own screen. It does not tamper with test answers, assignment submissions, grading logs, or instructor dashboards.
--------------------------------------------------------------------------------
2. DETAILED EXPLANATION OF PERMISSIONS (WHAT & WHY)
--------------------------------------------------------------------------------
BetterCanvas requests only the absolute minimum permissions necessary to function properly:
1. Permission: "storage"
• What it does: Grants access to the standard Chrome Storage API (chrome.storage.sync and chrome.storage.local).
• Why it is needed:
- Saves your visual configuration (e.g., Dark Mode enabled/disabled, selected theme preset like 'Midnight' or 'Sunset', card gradient choice, and preferred typography font).
- Persists your GPA calculator settings (e.g., standard 4.0 vs honours 4.33 vs weighted 5.0 AP/IB scale) so you don't have to re-enter them every visit.
- Saves your personal Dashboard Sticky Notes / Scratchpad content locally so your study reminders remain available when you reopen Canvas.
- Saves any custom CSS rules you decide to write in the settings editor.
• Privacy guarantee: All stored preferences remain strictly within your Chrome profile and are never synced to any outside database or external server.
2. Host Permissions: "*://*.instructure.com/*" and "*://*.canvaslms.com/*"
• What they do: Allow the extension's content script and stylesheets to run on Canvas LMS domains.
• Why they are needed:
- Instructure Canvas is deployed across thousands of individual school subdomains (e.g., schoolname.instructure.com) as well as custom institutional domains (e.g., canvas.university.edu).
- Without host matching on Canvas domains, the extension would be technically unable to inject the dark mode stylesheet, render glowing card headers, display live grade badges, or embed the GPA simulator on your dashboard.
• Privacy guarantee: BetterCanvas executes scripts strictly on Canvas LMS pages. It never monitors your activity on other websites or tabs.
--------------------------------------------------------------------------------
3. ARE ALL THESE PERMISSIONS REALLY NECESSARY? (HONEST AUDIT & RATIONALE)
--------------------------------------------------------------------------------
YES, every permission requested by BetterCanvas is strictly necessary, and here is the exact rationale explaining why neither can be omitted:
• Could we remove the "storage" permission?
No. Without the "storage" permission, every time you refresh Canvas LMS, close your browser, or switch classes, all your preferences—your dark mode setting, your custom colors, your GPA scale configuration, and your personal study notes—would be permanently wiped out. "storage" is the standard, least-privileged Chrome API for remembering student preferences locally.
• Could we remove the host permissions?
No. For an extension whose entire function is to restyle and enhance Canvas LMS, it must be allowed to load its stylesheets and DOM helper scripts on the web pages of Canvas LMS.
• What permissions did we DELIBERATELY AVOID to protect your safety?
To maintain a clean security profile and ensure immediate Chrome Web Store compliance, we intentionally rejected common intrusive permissions:
❌ NO "<all_urls>" permission (we do not ask for broad access to all websites).
❌ NO "tabs" permission (we do not inspect the URLs or titles of your other open tabs).
❌ NO "cookies" permission (we never touch your session cookies or login tokens).
❌ NO "webRequest" permission (we do not intercept network traffic).
❌ NO "identity" permission (we never request your Google or Canvas account identity).
This makes BetterCanvas one of the safest and most transparent Canvas enhancements available.
--------------------------------------------------------------------------------
4. USER DATA RIGHTS & CONTROLS
--------------------------------------------------------------------------------
You retain full ownership and control over all extension data:
• Export: You can export your entire configuration as a JSON file at any time from the Settings tab.
• Clear / Reset: You can click "Reset Defaults" in the popup settings to instantly erase all saved local preferences.
• Removal: Uninstalling the extension from chrome://extensions immediately purges all stored preferences from your browser.
--------------------------------------------------------------------------------
5. CONTACT & OPEN-SOURCE INTEGRITY
--------------------------------------------------------------------------------
BetterCanvas is committed to open transparency. If you have questions regarding this Privacy Policy or wish to inspect the codebase, please review the local extension files or consult our documentation in the strona/ directory.