Privacy Policy

Assignments, grades, announcements, modules, courses, files — everything Trackademic reads from Canvas is stored on your device, in your browser's own storage (localStorage and IndexedDB). It is not copied to a database we control.

Canvas requests pass through our server, because a browser cannot call your school's Canvas directly. That proxy checks that you are signed in and subscribed, forwards the request, and streams the response straight back to you. The content is not written to disk, not cached on the server, and not logged.

Because the data lives on your device, clearing your browser data or logging out removes it. Signing in on a new device syncs it again from Canvas.

The token you connect is held in your browser and sent with each proxied request so the server can forward it to Canvas. It is never written to our database and never written to a log. You can revoke it at any time in your Canvas account settings, which cuts off access immediately.

Some of Kulii never leaves your browser: what's due, search across your modules, flashcards, and quizzes built from the terms in your material. Those work on data already on your device.

Kulii's AI is off until you turn it on. Answering questions, summarizing, and writing quiz questions need an AI model, and that model is Amazon Nova, run by Amazon Web Services (Amazon Bedrock) in Sydney, Australia. Before anything is sent, Kulii asks for your permission and explains what it sends. We record that you agreed, when, and to which version of the wording.

What is sent, when it is on: your question, your last few messages with Kulii, excerpts of the course pages and files Kulii picks to answer it, and your course names and the titles and due dates of what is overdue or due in the next 7 days, so it can help you plan. Your grades are never sent. They pass through our server on the way to Amazon and the answer streams straight back. Neither we nor Amazon store them or write them to a log, and they are not used to train any AI model. Amazon processes them only to produce that answer.

What we keep: how much of your monthly AI allowance you have used. That is a count of requests, tokens (roughly, words) and their cost, per month. It contains nothing you typed and nothing from your courses.

Turning it off: press Turn off and stop sharing course content in Kulii at any time. From then on nothing is sent, and the rest of Kulii keeps working.

Your conversations with Kulii are saved only in your browser, so you can come back to them. Our server never stores them; with Kulii's AI on, only your last few messages travel with a new question, as described above. You can delete any conversation from Kulii's list, and all of them are deleted when you log out, together with the flashcard decks you make.

Kulii's answers, summaries and quiz questions are generated by AI. They can be wrong or incomplete, and they are labelled as AI-generated. You and your school keep full ownership of your Canvas material, and of anything Kulii produces from it.

One row per account, in a Supabase database, holding:

Your email address and the credentials for signing in (your password is hashed by Supabase Auth — we never see it).

Your subscription: its status, when the current term expires, when your free trial started, and the identifiers of PayMongo payments so one payment cannot be redeemed twice.

A Canvas identity hash: a one-way hash of your Canvas user id. It cannot be reversed back into your Canvas id, it is never displayed to anyone, and its only job is to enforce one Canvas account per subscription. Your name, your school, and your courses are not part of it.

Your acceptance of these policies: the date you accepted, and which version.

If you turn on Kulii's AI: that you agreed, when, and to which version of the wording; and, per month, how many AI requests you made, how many tokens they used, and what they cost.

If you use Vaults: the name and description you typed for each vault, a random link code for it, and the identifiers of the Google Doc and folder it points to. If you connect Google, we also store the Google address you connected and an encrypted authorization token.

Your task board: for a Canvas assignment you moved by hand, its Canvas id number and the column you put it in (not its title, course or due date). We delete that once the assignment is past due and Canvas shows it done. And the tasks you add yourself under My Tasks: the title and due date you typed, the column, and when you finished it. A finished task is deleted 7 days later.

If you send feedback: whether it is a bug report or a feature idea, the message you typed, which kind of page you sent it from (for example “a module page”, never which course or item), and, for a bug report and only if you tick the box, your browser, operating system and screen width. Only the developers can read it. It is deleted with your account.

That is the complete list. No coursework, no grades, no Canvas deadlines, no Canvas content of any kind, and nothing you said to Kulii.

A vault is a Google Doc and a Drive folder that Trackademic creates in your own Google account, so you can share them with a group. Connecting Google is entirely optional — the rest of the app works without it.

What we can access. We request a single Google permission, drive.file. It lets an app see only the files it created itself. We cannot see, list, or open anything else in your Drive.

What we store. Google gives us a long-lived authorization token so we can create files when you ask. We encrypt it and keep it in a table that only our server can read. You can disconnect Google at any time from the Vaults page, and remove our access entirely at myaccount.google.com/permissions.

What we never do. We do not read the contents of your vault files, and we never copy anything from Canvas into them. The Doc and folder are created empty; everything in them is put there by you or by the people you share them with.

Vault pages are public. Each vault has a link, and anyone who has that link — or scans its QR code — can open a page showing the vault's name, its description, and links to the Doc and folder. We ask search engines not to index these pages, but a link that has been shared or printed is public in practice. Do not put anything in a vault's name or description that you would not show a stranger.

Whether someone can actually open the files is decided by Google's own sharing settings, which you control. Deleting a vault removes its page and its link; the Doc and folder stay in your Drive until you delete them yourself.

Supabase hosts the database and handles sign-in. Vercel hosts the app and keeps standard server request logs (IP address, URL path, timestamp) for operational and security purposes. PayMongo processes payments and receives whatever is needed to complete one; we never see or store your card or e-wallet credentials. Google is involved only if you choose to use Vaults, and only for the files it creates for you; Google's own privacy policy applies to your Google account and to anything you put in those files.

Amazon Web Services is involved only if you turn on Kulii's AI. It runs the model, in Sydney, Australia, and receives your question and the course excerpts Kulii sends with it, as described in the Kulii section above. Under AWS's terms for Amazon Bedrock, it does not store them, use them to train models, or share them with anyone else.

Your school's Canvas instance receives requests from you, via our proxy, exactly as it would if you were browsing Canvas yourself. Its own privacy policy applies to it.

We do not sell your data, share it with advertisers, or run advertising or analytics trackers.

Trackademic sets a session cookie so you stay signed in. Everything else it keeps — your Canvas data, your themes, your points, a copy of your task board, your Kulii chats and flashcards — is browser storage on your device, for the app to work offline. None of it is used for tracking, and there are no third-party cookies.

One exception happens only when you choose it. A YouTube video in a course page is shown as a play button, and nothing is loaded from YouTube until you press it. Once you press play, the video is played by YouTube: it receives your IP address and which video you watch, and it may store its own data in your browser, under Google's privacy policy. Trackademic sends YouTube nothing else: not your name, your course or the page you are on.

The app's offline service worker never caches an API or Canvas response, because those carry your token and your personal data.

Your account row exists for as long as your account does. Payment records are kept as long as we need them for accounting and dispute handling. Ask us to delete your account and we remove your row; the Canvas data on your device is yours to clear, and clearing your browser data removes it.

Under the Philippine Data Privacy Act (RA 10173) you may ask what we hold about you, ask for it to be corrected, ask for it to be deleted, or object to how it is processed. Email us and we will act on it.

Traffic is encrypted in transit. Sign-in and the database are handled by Supabase, and privileged columns — your subscription state and your Canvas identity hash — are writable only by the server, not by your own session. No system is perfectly secure, but we do not hold your Canvas content, so a breach of our database could not expose your coursework.

Trackademic Canvas Connect, the optional Chrome extension that creates your Canvas token for you, has its own policy: Chrome extension privacy.

If this policy changes in substance, the “Last updated” date at the top changes with it, and the version you accepted is recorded against your account.

Questions, or a request about your data: olegnatruk@gmail.com