Privacy Policy

Welcome to TaskGator. We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy outlines how TaskGator LLC ("we," "us," or "our") collects, uses, secures, and shares information from users of our TaskGator Chrome browser extension (the "App" or "Extension").

This policy is designed to help you understand your rights and our obligations regarding your personal information. By creating an account and using the Extension, you agree to the collection and use of information in accordance with this policy.

1. Business Information

2. Information We Collect

We collect information to provide and improve our service to you. This information is collected in two ways: data imported from your Canvas account and data you provide to us directly.

A. Data Collected from Your Canvas Account:

When you connect your Canvas account to TaskGator, the Extension accesses the following information through your browser's existing Canvas session:

• Course Information: Course names and course IDs.
• Assignment Details: Assignment descriptions, due dates, points, and grades.
• Discussion Boards: Discussion board requirements and your post counts.
• Instructor Feedback: Comments left by instructors on your assignments.
• User Profile: Your Canvas profile information, including your name, email address, and avatar URL.
• Enrollment Data: Your course enrollment status and overall course grades.
• Course Materials: Instructional content such as syllabi, rubrics, course pages, announcements, and file attachments (PDFs, documents, images) created by professors and institutions. This content is used to power AI features described in Section 4.

B. Data Collected Directly from You:

We also collect information you provide directly when you create and use your TaskGator account:

• Account Information: Your email address, which is used for account creation and authentication via Supabase.
• User Preferences: Settings such as theme choices and the specific courses you choose to sync.
• Application Data: Manual flags you set on assignments (e.g., for follow-up or to hide them).

C. Third-Party Services:

The TaskGator Chrome extension does not use third-party advertising, ad tracking, or behavioral analytics services. Usage analytics within the extension (session duration, feature adoption) are collected through our own Supabase backend — no third-party analytics SDKs are used in the extension. The TaskGator website uses Google Analytics as described in Section 5. See Section 4.2 for details on data shared with OpenAI for AI processing.

D. Additional Data Types Collected:

For transparency about all data collection, we also collect the following information:

• User Identifiers: We collect and store unique user identifiers including your Supabase account ID and Canvas user ID for authentication and data synchronization.
• Usage Data: We collect information about extension sessions (start, end, duration), feature usage events, and sync activity. This data includes your browser platform and extension version. No student names, grades, or assignment content is included in usage data.
• Customer Support Communications: When you contact our support team at Support@Task-Gator.com, we retain email communications to provide assistance, resolve issues, and improve our support services.
• User-Generated Preferences: We store your manual assignment flags (such as hiding assignments or marking them for follow-up), course selections, theme choices, and extension settings to personalize your experience and maintain consistency across browser sessions.
• Diagnostic Data: We do not automatically collect crash reports, performance metrics, or loading times. If you contact our support team at Support@Task-Gator.com, we may request device information and extension version to assist with troubleshooting.

E. Chrome Extension Data Access:

The TaskGator Chrome browser extension accesses your Canvas data as follows:

• Session-Based Authentication: The extension uses your browser's existing Canvas LMS session cookies to access your Canvas data. It does not collect, store, or transmit your Canvas password or other Canvas credentials.
• Content Script Relay: The extension injects a content script into Canvas pages (*.instructure.com) that relays API requests using your browser's authenticated session. This is necessary because Canvas LMS is deployed on institution-specific subdomains (e.g., university.instructure.com).
• Canvas Credential Storage: The extension does not store Canvas passwords, API tokens, or other Canvas authentication credentials. It accesses Canvas data through your browser's active session cookies.
• TaskGator Account Session: Your TaskGator account session (Supabase authentication token) is stored in Chrome's OS-encrypted extension storage (chrome.storage.local) to maintain your login between browser sessions. This token is cleared when you sign out of TaskGator.
• Encrypted Local Storage: Canvas data accessed through the extension is stored locally within your browser in an AES-256 encrypted database (IndexedDB). This data never leaves your device or is sent to external servers, except for the specific AI processing flows described in Section 4. The encryption key is derived per-user and stored in Chrome's OS-encrypted extension storage. When you sign out of TaskGator or uninstall the extension, all locally stored data is deleted.
• Background Data Refresh: The extension periodically checks Canvas for updated grades and assignment changes (approximately every 10 minutes) while your browser is open. This polling uses your existing Canvas session and occurs only when you have an active Canvas tab. No data from these background checks is sent to external servers.

2.1. Data Linked to Your Identity

3. How We Use Your Data

We use the data we collect for specific purposes aimed at enhancing your educational experience:

• To Provide Core Functionality: To display a consolidated, cross-course list of your assignments, grades, and instructor comments.
• To Power AI Features: To parse assignment and discussion board requirements to identify key tasks, and to answer your questions about course content using the AI Assistant.
• To Personalize Your Experience: To track your assignment completion status, manage assignment priorities with intelligent badges, and maintain your settings across browser sessions.
• For Performance: To cache course data securely in your browser's encrypted local database for faster performance.

4. AI Features and Data Processing

TaskGator uses artificial intelligence to enhance its features. AI processing occurs through distinct modes, each with different privacy characteristics:

4.A. Cloud AI Processing — AI Assistant Chat

The AI Assistant feature allows you to ask questions about your course content (e.g., "When is my next exam?" or "What are the requirements for the final project?"). This feature uses cloud processing:

• Data Sent: Your question and relevant course content chunks (assignment descriptions, syllabus text, discussion board content, and other instructional material from your synced courses). Personal data such as your name or email is not included in AI processing requests.
• Where It's Sent: Your question is sent to a Supabase edge function hosted on AWS infrastructure, which forwards it to OpenAI's API (api.openai.com) for AI processing. OpenAI does not use API inputs for model training. See OpenAI's API Data Usage Policy.
• Processing: Course content is processed ephemerally by OpenAI to generate a response to your question. All API calls are made with store: false, which prevents OpenAI from retaining your data beyond the immediate processing of each request. OpenAI does not use API inputs for model training.
• Purpose: To answer student questions about their own course materials using AI-powered natural language understanding.

Conversation History: Your AI Assistant conversations (questions and responses) are stored in our Supabase database to support multi-turn conversations and conversation history. You can delete individual conversations or all conversation history at any time through the extension. Deleted conversations are removed from your view immediately and permanently deleted within 30 days. Conversations with no activity for 6 months are automatically removed.

4.B. Cloud AI Processing — Image and Document Analysis

When Canvas course materials contain images (e.g., scanned handouts, image-based assignment instructions) or scanned PDF pages that cannot be parsed locally, the extension sends image data to our cloud infrastructure for text extraction (OCR) and analysis. Specifically:

• Data Sent: Image content from Canvas course materials (assignment descriptions, syllabus images, scanned documents).
• Where It's Sent: Supabase edge functions hosted on AWS infrastructure, which forward data to OpenAI's API (api.openai.com) for processing. OpenAI does not use API inputs for model training. See OpenAI's API Data Usage Policy.
• Processing: Image data is processed ephemerally by OpenAI for text extraction. All API calls are made with store: false, preventing retention beyond immediate processing. OpenAI does not use this data for model training.
• Purpose: To extract readable text from images and scanned documents that cannot be parsed using on-device methods.

4.C. Course Content Storage for AI Features

4.1. Chrome Extension Permissions

The extension requires the following browser permissions, each serving a specific purpose:

• sidePanel: Displays TaskGator as a Chrome side panel alongside Canvas pages.
• tabs: Detects which browser tab contains your active Canvas session to sync data correctly.
• storage: Persists extension state (such as Canvas connection status and your TaskGator account session) within Chrome's OS-encrypted extension storage.
• alarms: Enables periodic background refresh of assignment data (approximately every 10 minutes) to keep information current.
• scripting: Re-injects the content script when the extension updates, ensuring uninterrupted service.
• Host Permission — *.instructure.com: Required because Canvas LMS uses institution-specific subdomains. There is no single Canvas domain; each school has its own (e.g., university.instructure.com).
• Host Permission — *.inscloudgate.net and *.canvas-user-content.com: These are Canvas's file delivery CDN domains, used when downloading course materials such as PDFs and assignment attachments.
• Host Permission — oiffmuqaxcbrmqilvfrs.supabase.co: Our backend server for user account services, AI Assistant chat processing, AI image text extraction, and course content storage.

4.2. Data Sharing

TaskGator does not sell user data and does not use data for advertising purposes. We share data only with the following service providers, solely to deliver the Extension's functionality:

• Supabase (AWS infrastructure): Cloud database and edge functions for user accounts, data synchronization, course content storage, AI Assistant chat processing, and AI image text extraction.
• OpenAI (via Supabase edge functions): All AI features — including the AI Assistant, assignment parsing, image text extraction, and content embedding — are processed by OpenAI's API. Our Supabase edge functions forward requests to api.openai.com. We configure all API calls with store: false, which prevents OpenAI from retaining your data beyond the immediate processing of each request. OpenAI does not use API inputs for model training. See OpenAI's API Data Usage Policy.

We may change or add AI processing providers in the future. If we do, the updated provider(s) will be disclosed in this Privacy Policy before the change takes effect, and all providers will be held to equivalent or stronger data protection standards (no training on user data, no retention beyond immediate processing).

Canvas data accessed via the extension is stored locally in an AES-256 encrypted database within your browser. It is not sent to external servers except for the specific AI processing flows described in Sections 4.A, 4.B, and 4.C above.

5. Data Storage and Security

We take the security of your data seriously and have implemented robust measures to protect it.

Storage Locations:

• In Your Browser: Course data is cached in an AES-256 encrypted local database (IndexedDB) within your browser for performance. The encryption key is derived per-user and stored in Chrome's OS-encrypted extension storage.
• On Our Servers: Your user profile, account settings, AI Assistant conversation history, course content chunks (for AI features), and usage analytics are stored on secure cloud servers provided by Supabase (using AWS infrastructure), located in the United States.

Security Measures:

• Encryption in Transit: All communication between the Extension and our servers is encrypted using HTTPS/TLS.
• Encryption at Rest: Local data is encrypted using AES-256 with per-user encryption keys. Your TaskGator session token is stored in Chrome's OS-encrypted extension storage.
• Access Controls: We use Row Level Security (RLS) in our database to ensure that users can only access their own data.
• Secure Authentication: The extension accesses your Canvas data through your browser's existing authenticated session (session cookies). No additional Canvas credentials are required or stored. Your TaskGator account is authenticated via Supabase, with session tokens stored in Chrome's OS-encrypted extension storage.
• Input Validation: We perform validation on inputs to protect against injection attacks and other security threats.

Usage Analytics:

Session and feature usage events are stored in our Supabase database. Analytics records include only aggregate behavioral data (session duration, feature usage counts, browser platform) and do not contain educational content or student records.

Website Analytics and Cookies:

The TaskGator website (task-gator.com) uses Google Analytics to understand how visitors interact with the website. Google Analytics uses cookies to collect anonymous usage data such as pages visited, time on site, and referring sources. This data is used solely to improve the website experience and is not linked to your TaskGator account or educational data. You can learn more about Google's data practices at Google's Privacy Policy and opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

The TaskGator Chrome extension itself does not use Google Analytics or any third-party analytics services.

6. Data Retention and Deletion

We retain your data only for as long as necessary to provide our service.

Retention Periods:

• User Account Data: Retained until you request account deletion.
• Course Content Chunks and Embeddings (Server): Updated during each course sync. Content for deselected courses is automatically removed after 6 months of inactivity. All content is immediately deleted when you delete your account.
• AI Assistant Conversations (Server): Retained until you delete them or until 6 months of inactivity, whichever comes first. Inactive conversations are automatically removed. Manually deleted conversations are removed from your view immediately and permanently deleted within 30 days.
• AI Query Analytics (Server): Performance metadata for AI queries (response time, token usage, cost, success/failure status) is automatically removed after 6 months. Question text is stored as part of conversation history and follows the conversation retention rules above.
• Cached Data (Local): Canvas data cached in the extension's encrypted local database is re-fetched from Canvas when older than 1 hour. All cached data is cleared when you sign out or uninstall the extension.
• Parsed Content Cache (Local): Locally cached assignment parsing data is automatically pruned after 180 days.

Your Right to Deletion:

• Requesting Deletion: You may request the permanent deletion of your entire account and all associated data from our servers by visiting our Account Deletion Request page or by emailing us at Support@Task-Gator.com.
• Uninstalling the Extension: Removing the TaskGator extension from Chrome will delete all locally stored data (encrypted IndexedDB and extension storage) but will not delete your data from our servers.
• Signing Out: Signing out of TaskGator will immediately clear all locally cached data and authentication tokens from your browser.

7. Children's Privacy and Age Requirement

TaskGator is intended for users who are 13 years of age or older. We do not knowingly collect personal information from children under the age of 13 in compliance with the U.S. Children's Online Privacy Protection Act (COPPA).

8. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically for any changes.

9. Pilot Program Addendum

Effective for Cohort 1 pilot participants (February–March 2026). This addendum supplements the Privacy Policy above and applies to users participating in the TaskGator pilot program.

Enhanced Usage Analytics During Pilot

During the pilot period, we collect additional usage data beyond standard product analytics to evaluate product performance and inform development decisions. This enhanced data collection includes:

• Onboarding funnel events: Timestamps for each step of account setup (account creation, Canvas connection, course selection, first content sync, first AI query) to measure activation rates and identify friction points.
• AI query metadata: Per-query metrics including response latency, token usage, cost, success/failure status, error types, and whether the AI could answer the question from available course materials. Query content (your actual questions) is stored as part of conversation history; the metadata described here tracks performance, not content.
• Message-level feedback: Thumbs up/down ratings and optional freeform comments you provide on AI responses, used to measure response quality and identify areas for improvement.
• Cache efficiency metrics: Ratios of cached vs. uncached AI processing to optimize cost and performance.
• Error and recovery tracking: Categorized error events and whether errors were resolved by retry, to improve reliability.

All pilot analytics data is linked to your user account for analysis purposes. No educational content (assignment text, syllabus content, grades) is included in analytics data — only operational metadata as described above.

End-of-Pilot Survey

At the conclusion of the pilot, you may be invited to complete a short satisfaction survey (via Google Forms or a similar tool). Survey participation is voluntary. Survey responses are used solely for product improvement and are not shared with third parties.

Pilot Duration and Data Retention

The pilot program is time-limited. Upon conclusion of the pilot, your account and data will continue to be governed by this Privacy Policy, including the standard 6-month data retention and automated cleanup described in Section 6. If the product is discontinued after the pilot, all user data will be deleted within 30 days of discontinuation and affected users will be notified.

Right to Withdraw

You may withdraw from the pilot at any time by uninstalling the TaskGator extension and requesting account deletion via our Account Deletion Request page or by emailing Support@Task-Gator.com. Upon account deletion, all your data — including pilot analytics data — will be permanently removed in accordance with Section 6.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us: