What CalSherpa can and can't see

The short version, in plain English. The Privacy Policy has the full details.

In Canvas

• Only your school's Canvas site. The CalSherpa Chrome extension has permission to read one website: your school's Canvas (today, uncch.instructure.com). Chrome blocks it from reading any other site, so it can't see your email, your other tabs, or your browsing.
• Never your university password. The extension reads Canvas using the sign-in your browser already has, the same way the Canvas website does. It never shows a login form and never sees or stores your password.
• Never a Canvas access token. CalSherpa will never ask you to create or paste a Canvas token, and the extension doesn't use one.
• Fields that identify you are removed first. Before your coursework leaves your browser, the extension strips out the Canvas fields that hold names, email addresses, login and student (SIS) IDs, pronouns, and profile pictures. Our server rejects any upload that still contains one of those fields. Text written into your courses, like a page or an announcement, is sent as it is, so a name that appears inside it goes along.
• Work you've turned in is left alone. CalSherpa uses Canvas's own submission status to skip assignments you've already submitted.
• No code from the internet. Everything the extension runs ships inside it. It doesn't download and run new code.

On your Google Calendar

• It reads your calendar to find free time. CalSherpa looks at your primary Google Calendar to see when you're busy, then places work blocks around those events.
• It only changes blocks it created. Every block CalSherpa adds carries a hidden CalSherpa marker. Before CalSherpa updates or removes any event, its code checks for that marker and refuses to touch an event without it. Your own events, classes, and plans are never edited or deleted.
• The extension never holds your Google sign-in. You connect Google on the CalSherpa website. The extension only gets its own CalSherpa sign-in, never a Google token.

How to delete your data

1. Sign the extension out first. In the extension's popup, choose Unlink. The extension deletes its sign-in from your browser and asks our server to cancel it.
2. Stop Canvas syncing. Uninstall the extension at chrome://extensions. That stops all Canvas reading and Chrome deletes everything the extension stored. To keep the extension but reset its sync record, open its settings and choose Clear local sync data instead.
3. Cut off Google Calendar access. Go to your Google Account's third-party connections, choose CalSherpa, and remove its access. Blocks already on your calendar stay until you delete them; they're yours.
4. Delete your account. Email [email protected] from the address on your account. We delete your account and everything linked to it within 30 days.

Questions about any of this? Email [email protected].