Privacy Policy

Welcome to TaskGator. We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy outlines how TaskGator LLC ("we," "us," or "our") collects, uses, secures, and shares information from users of our TaskGator Chrome browser extension (the "App" or "Extension").

This policy is designed to help you understand your rights and our obligations regarding your personal information. By creating an account and using the Extension, you agree to the collection and use of information in accordance with this policy.

1. Business Information

2. Information We Collect

We collect information to provide and improve our service to you. This information is collected in two ways: data imported from your Canvas account and data you provide to us directly.

A. Data Collected from Your Canvas Account:

When you connect your Canvas account to TaskGator, the Extension accesses the following information through your browser's existing Canvas session:

• Course Information: Course names and course IDs.
• Assignment Details: Assignment descriptions, due dates, points, and grades.
• Discussion Boards: Discussion board requirements and your post counts.
• Instructor Feedback: Comments left by instructors on your assignments.
• User Profile: Your Canvas profile information, including your name, email address, and avatar URL.
• Enrollment Data: Your course enrollment status and overall course grades.
• Course Materials: Instructional content such as syllabi, rubrics, course pages, announcements, and file attachments (PDFs, documents, images) created by professors and institutions. This content is used to power AI features described in Section 4.

B. Data Collected Directly from You:

We also collect information you provide directly when you create and use your TaskGator account:

• Account Information: Your email address, which is used for account creation and authentication via Supabase.
• User Preferences: Settings such as theme choices and the specific courses you choose to sync.
• Application Data: Manual flags you set on assignments (e.g., for follow-up or to hide them).

C. Third-Party Services:

TaskGator does not use third-party advertising, ad tracking, or behavioral analytics services. Usage analytics (session duration, feature adoption) are collected through our own Supabase backend — no third-party analytics SDKs are used. See Section 4.2 for details on data shared with OpenAI for AI processing.

D. Additional Data Types Collected:

For transparency about all data collection, we also collect the following information:

• User Identifiers: We collect and store unique user identifiers including your Supabase account ID and Canvas user ID for authentication and data synchronization.
• Usage Data: We collect information about extension sessions (start, end, duration), feature usage events, and sync activity. This data includes your browser platform and extension version. No student names, grades, or assignment content is included in usage data.
• Customer Support Communications: When you contact our support team at Support@Task-Gator.com, we retain email communications to provide assistance, resolve issues, and improve our support services.
• User-Generated Preferences: We store your manual assignment flags (such as hiding assignments or marking them for follow-up), course selections, theme choices, and extension settings to personalize your experience and maintain consistency across browser sessions.
• Diagnostic Data: We do not automatically collect crash reports, performance metrics, or loading times. If you contact our support team at Support@Task-Gator.com, we may request device information and extension version to assist with troubleshooting.

E. Chrome Extension Data Access:

The TaskGator Chrome browser extension accesses your Canvas data as follows:

• Session-Based Authentication: The extension uses your browser's existing Canvas LMS session cookies to access your Canvas data. It does not collect, store, or transmit your Canvas password or other Canvas credentials.
• Content Script Relay: The extension injects a content script into Canvas pages (*.instructure.com) that relays API requests using your browser's authenticated session. This is necessary because Canvas LMS is deployed on institution-specific subdomains (e.g., university.instructure.com).
• Canvas Credential Storage: The extension does not store Canvas passwords, API tokens, or other Canvas authentication credentials. It accesses Canvas data through your browser's active session cookies.
• TaskGator Account Session: Your TaskGator account session (Supabase authentication token) is stored in Chrome's OS-encrypted extension storage (chrome.storage.local) to maintain your login between browser sessions. This token is cleared when you sign out of TaskGator.
• Encrypted Local Storage: Canvas data accessed through the extension is stored locally within your browser in an AES-256 encrypted database (IndexedDB). This data never leaves your device or is sent to external servers, except for the specific AI processing flows described in Section 4. The encryption key is derived per-user and stored in Chrome's OS-encrypted extension storage. When you sign out of TaskGator or uninstall the extension, all locally stored data is deleted.
• Background Data Refresh: The extension periodically checks Canvas for updated grades and assignment changes (approximately every 2 minutes) while your browser is open. This polling uses your existing Canvas session and occurs only when you have an active Canvas tab. No data from these background checks is sent to external servers.

2.1. Data Linked to Your Identity

3. How We Use Your Data

We use the data we collect for specific purposes aimed at enhancing your educational experience:

• To Provide Core Functionality: To display a consolidated, cross-course list of your assignments, grades, and instructor comments.
• To Power AI Features: To parse assignment and discussion board requirements to identify key tasks, and to answer your questions about course content using the AI Assistant.
• To Personalize Your Experience: To track your assignment completion status, manage assignment priorities with intelligent badges, and maintain your settings across browser sessions.
• For Performance: To cache course data securely in your browser's encrypted local database for faster performance.

4. AI Features and Data Processing

TaskGator uses artificial intelligence to enhance its features. AI processing occurs through distinct modes, each with different privacy characteristics:

4.A. On-Device AI Processing

4.B. Cloud AI Processing — AI Assistant Chat

The AI Assistant feature allows you to ask questions about your course content (e.g., "When is my next exam?" or "What are the requirements for the final project?"). This feature uses cloud processing:

• Data Sent: Your question and relevant course content chunks (assignment descriptions, syllabus text, discussion board content, and other instructional material from your synced courses). Personal data such as your name or email is not included in AI processing requests.
• Where It's Sent: Your question is sent to a Supabase edge function hosted on AWS infrastructure, which forwards it to OpenAI's API (api.openai.com) for AI processing. OpenAI does not use API inputs for model training. See OpenAI's API Data Usage Policy.
• Processing: Course content is processed ephemerally by OpenAI to generate a response to your question. OpenAI does not retain your data for model training.
• Purpose: To answer student questions about their own course materials using AI-powered natural language understanding.

Conversation History: Your AI Assistant conversations (questions and responses) are stored in our Supabase database to support multi-turn conversations and conversation history. You can delete individual conversations or all conversation history at any time through the extension. Deleted conversations are removed from your view immediately and permanently deleted within 30 days. Conversations with no activity for 6 months are automatically removed.

4.C. Cloud AI Processing — Image and Document Analysis

When Canvas course materials contain images (e.g., scanned handouts, image-based assignment instructions) or scanned PDF pages that cannot be parsed locally, the extension sends image data to our cloud infrastructure for text extraction (OCR) and analysis. Specifically:

• Data Sent: Image content from Canvas course materials (assignment descriptions, syllabus images, scanned documents).
• Where It's Sent: Supabase edge functions hosted on AWS infrastructure, which forward data to OpenAI's API (api.openai.com) for processing. OpenAI does not use API inputs for model training. See OpenAI's API Data Usage Policy.
• Processing: Image data is processed ephemerally by OpenAI for text extraction and is not stored, retained, or used for model training.
• Purpose: To extract readable text from images and scanned documents that cannot be parsed using on-device methods.

4.D. Course Content Storage for AI Features

4.1. Chrome Extension Permissions

The extension requires the following browser permissions, each serving a specific purpose:

• sidePanel: Displays TaskGator as a Chrome side panel alongside Canvas pages.
• tabs: Detects which browser tab contains your active Canvas session to sync data correctly.
• storage: Persists extension state (such as Canvas connection status and your TaskGator account session) within Chrome's OS-encrypted extension storage.
• alarms: Enables periodic background refresh of assignment data (approximately every 2 minutes) to keep information current.
• scripting: Re-injects the content script when the extension updates, ensuring uninterrupted service.
• Host Permission — *.instructure.com: Required because Canvas LMS uses institution-specific subdomains. There is no single Canvas domain; each school has its own (e.g., university.instructure.com).
• Host Permission — *.inscloudgate.net and *.canvas-user-content.com: These are Canvas's file delivery CDN domains, used when downloading course materials such as PDFs and assignment attachments.
• Host Permission — oiffmuqaxcbrmqilvfrs.supabase.co: Our backend server for user account services, AI Assistant chat processing, AI image text extraction, and course content storage.

4.2. Data Sharing

TaskGator does not sell user data and does not use data for advertising purposes. We share data only with the following service providers, solely to deliver the Extension's functionality:

• Supabase (AWS infrastructure): Cloud database and edge functions for user accounts, data synchronization, course content storage, AI Assistant chat processing, and AI image text extraction.
• OpenAI (via Supabase edge functions): All cloud AI features — including the AI Assistant, assignment parsing, image text extraction, and content embedding — are processed by OpenAI's API. Our Supabase edge functions forward requests to api.openai.com. OpenAI does not use API inputs for model training. See OpenAI's API Data Usage Policy.
• Chrome's On-Device AI (Gemini Nano): Text-based due date extraction and instruction parsing. No data leaves your device for this processing.

Canvas data accessed via the extension is stored locally in an AES-256 encrypted database within your browser. It is not sent to external servers except for the specific AI processing flows described in Sections 4.B, 4.C, and 4.D above.

5. Data Storage and Security

We take the security of your data seriously and have implemented robust measures to protect it.

Storage Locations:

• In Your Browser: Course data is cached in an AES-256 encrypted local database (IndexedDB) within your browser for performance. The encryption key is derived per-user and stored in Chrome's OS-encrypted extension storage.
• On Our Servers: Your user profile, account settings, AI Assistant conversation history, course content chunks (for AI features), and usage analytics are stored on secure cloud servers provided by Supabase (using AWS infrastructure), located in the United States.

Security Measures:

• Encryption in Transit: All communication between the Extension and our servers is encrypted using HTTPS/TLS.
• Encryption at Rest: Local data is encrypted using AES-256 with per-user encryption keys. Your TaskGator session token is stored in Chrome's OS-encrypted extension storage.
• Access Controls: We use Row Level Security (RLS) in our database to ensure that users can only access their own data.
• Secure Authentication: The extension accesses your Canvas data through your browser's existing authenticated session (session cookies). No additional Canvas credentials are required or stored. Your TaskGator account is authenticated via Supabase, with session tokens stored in Chrome's OS-encrypted extension storage.
• Input Validation: We perform validation on inputs to protect against injection attacks and other security threats.

Usage Analytics:

Session and feature usage events are stored in our Supabase database. Analytics records include only aggregate behavioral data (session duration, feature usage counts, browser platform) and do not contain educational content or student records.

6. Data Retention and Deletion

We retain your data only for as long as necessary to provide our service.

Retention Periods:

• User Account Data: Retained until you request account deletion.
• Course Content Chunks and Embeddings (Server): Updated during each course sync. Content for deselected courses is automatically removed after 6 months of inactivity. All content is immediately deleted when you delete your account.
• AI Assistant Conversations (Server): Retained until you delete them or until 6 months of inactivity, whichever comes first. Inactive conversations are automatically removed. Manually deleted conversations are removed from your view immediately and permanently deleted within 30 days.
• Cached Data (Local): Canvas data cached in the extension's encrypted local database is re-fetched from Canvas when older than 1 hour. All cached data is cleared when you sign out or uninstall the extension.
• Parsed Content Cache (Local): Locally cached assignment parsing data is automatically pruned after 180 days.

Your Right to Deletion:

• Requesting Deletion: You may request the permanent deletion of your entire account and all associated data from our servers by visiting our Account Deletion Request page or by emailing us at Support@Task-Gator.com.
• Uninstalling the Extension: Removing the TaskGator extension from Chrome will delete all locally stored data (encrypted IndexedDB and extension storage) but will not delete your data from our servers.
• Signing Out: Signing out of TaskGator will immediately clear all locally cached data and authentication tokens from your browser.

7. Children's Privacy and Student Data

TaskGator is designed for use by students through their institution's Canvas LMS accounts. We rely on the educational institution's compliance with applicable privacy laws, including the U.S. Children's Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), and any applicable state student privacy laws.

8. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically for any changes.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us: