Extension Privacy Policy — Canvas → SimplifyMyUni Sync

This policy explains exactly what the Canvas → SimplifyMyUni Sync browser extension reads, what it sends, where that data goes, and how you stop it. It covers the extension only; the SimplifyMyUni website has its own terms and privacy practices.

The short version. The extension copies your own Canvas coursework — courses, grades, assignments, modules, announcements, and what is due — into your own SimplifyMyUni workspace, using the Canvas session already open in your browser. It only ever reads; it never posts, edits, or deletes anything in Canvas, and it never opens your Canvas inbox. It cannot see your Canvas password. You start every sync, and you can revoke its access at any time.

1. Single purpose

The extension has one purpose: to copy the academic data your Canvas account already shows you into the SimplifyMyUni account you own, so your courses, grades, and deadlines can be viewed there. It is not used for advertising, analytics products, tracking across sites, or any purpose unrelated to that transfer.

2. How it reaches Canvas

The extension runs only on Canvas hosts (canvas.ubc.ca and *.instructure.com) and on simplifymyuni.com. On a Canvas page it calls Canvas's own REST API (/api/v1/…) with the session cookies already present in your browser, using GET requests only.

It does not ask for, receive, or store your Canvas password.
It does not request or hold a Canvas OAuth access token.
It does not write to Canvas: no submissions, no posts, no edits, no deletions.
It does not read Canvas Conversations (the Canvas inbox) or any private message.
It sees only what your own Canvas account is already permitted to show you.

3. What is collected during a sync

When you press Sync — or when an automatic sync runs after you have enabled it by completing a manual sync — the extension may read and transmit the following, for the active courses of the signed-in student:

Category	Fields
Your Canvas profile	Display name, short name, time zone, Canvas user id
Courses	Course name, course code, Canvas course id, term and its end date, course start/end dates, instructor names, a short plain-text excerpt of the syllabus
Your grade summary	Current score and letter, final score and letter, grading-period scores, unposted current score where Canvas exposes it
Assignment groups	Group names and their weight toward the final grade
Assignments	Title, due / unlock / lock dates, points possible, grading type, submission types, Canvas link, and — for your own submission only — status (graded, submitted, late, missing, excused), score, grade, submission and grading timestamps, and the number of comments on it
Class statistics	The aggregate score statistics Canvas publishes for an assignment (mean, high, low, quartiles). These are class-level aggregates; no other student's individual score, name, or identifier is collected.
Modules	Module names, state, and your own completion progress
Announcements	Title, author display name, posted date, link, and a short plain-text excerpt of announcements from the last 30 days in your courses
Upcoming and missing work	Planner items, to-do items, upcoming events, and assignments Canvas flags as missing
Technical metadata	Canvas host, page URL and title, sync timestamp, item counts, elapsed time, and short labels for any Canvas endpoint that could not be read (used only for troubleshooting)

Collection is bounded (a limited number of courses, assignments, and pages per sync), and long text such as syllabus and announcement bodies is truncated to a short excerpt before it is sent.

4. Where it is sent and how it is stored

The collected data is sent over HTTPS in a single request to https://simplifymyuni.com/api/sync-canvas.php and is associated with the SimplifyMyUni account identified by your connection token.

The request body contains no SimplifyMyUni user id, email address, display name, or password. The server resolves the account solely from the token.
SimplifyMyUni keeps only the latest sync for your account; each sync replaces the previous one. It is used to render your own Courses and grades view and your upcoming work — nothing else.
The data is not sold, rented, or licensed. It is not shared with advertisers, data brokers, or analytics providers. It is not used to build profiles for anyone other than you.
Access is limited to the operation of the service and to what applicable law requires.

5. Your connection token

Access is granted by a personal, expiring connection token that you create while signed in to SimplifyMyUni (Courses → Generate connection token).

The usable token is stored on your device in chrome.storage.local and is sent only to the SimplifyMyUni sync endpoint, in the HTTPS Authorization: Bearer header.
SimplifyMyUni displays the usable token once, at creation. The server stores only its SHA-256 digest together with its owner, creation and expiry dates, last-use date, and revocation status.
Tokens expire automatically (90 days by default). Creating a replacement immediately revokes the previous one.
You can revoke access at any time from SimplifyMyUni → Courses → Revoke token. The extension then stops syncing.

6. What is stored on your device

The extension stores two things locally, and nothing else: your connection token, and a boolean preference recording whether automatic sync is enabled. Removing the extension or clearing its storage deletes both.

7. Permissions and why each is needed

Permission	Why it is required
`storage`	Keeps your connection token and the automatic-sync preference on your device.
`activeTab`	Lets the popup ask the Canvas tab you are looking at to run the sync you just requested.
Host access to `*.instructure.com` and `canvas.ubc.ca`	Lets the content script call the Canvas REST API with your existing session so it can read your courses, grades, assignments, modules, and announcements.
Host access to `simplifymyuni.com`	Lets the background service worker send the authenticated sync request to the SimplifyMyUni API.

8. No remote code

The extension executes only the JavaScript included in its published package. It does not download, evaluate, or inject remotely hosted code, and it loads no third-party scripts, trackers, or analytics SDKs.

Data-use certifications. We certify that the data handled by this extension is not sold to third parties; is not used or transferred for purposes unrelated to the single purpose described in section 1; and is not used or transferred to determine creditworthiness or for lending purposes.

9. Retention and deletion

Stop future syncs: revoke the connection token in SimplifyMyUni → Courses, or uninstall the extension.
Remove the local copy: uninstalling the extension, or clearing its storage, deletes the token and the sync preference from your device.
Remove the synced data: ask SimplifyMyUni to clear your Canvas sync, or delete your SimplifyMyUni account; the stored sync is removed with the account.
Because only the most recent sync is retained, older synced data does not accumulate over time.

10. Institutional data and minors

The extension is intended for post-secondary students using their own Canvas account. Canvas and the coursework inside it are operated by your institution and governed by its policies; using this extension does not change your institution's rights or obligations. The extension is not directed at children under 13 and does not knowingly collect data from them. If your institution restricts exporting course data to third-party tools, follow that policy — you are responsible for the account you connect.

11. Changes to this policy

If the extension changes what it collects or where it sends it, this page is updated and the effective date at the top changes. Material changes will also be reflected in the extension's store listing.

12. Contact

Privacy questions about the extension: privacy@simplifymyuni.com. For questions about your Canvas account itself, or your institution's data policies, contact your institution.