Privacy Policy

1. Summary

We built GradeSend as a practicing teacher. Student privacy isn't a legal checkbox to us — it's a professional obligation we share with you.

2. What Information We Collect

Information you provide directly:

• Google account email address — when you sign in with Google, the extension verifies your email and we store it in our access list to manage your account (active, pending, or expired). Sign-in uses Google's standard OAuth flow with basic profile scopes only; the extension never sees your password. We do not sell or share your email.
• Support messages — if you submit a support request through the teacher dashboard, we store the message and your email so we can respond.

Information the extension stores locally on your device (not sent to us):

• Your Canvas API token — stored in Chrome's local extension storage on your computer only.
• Your Frontline domain — stored locally so the extension knows where to send grades.
• Assignment-to-column mappings — stored locally to speed up repeat syncs. These never leave your device.
• DAEP Grade Manager data (if you use that feature) — stored locally on your device only.

Information we store on our server:

• Your email address, account status (active/pending/expired), and plan.
• Anonymous usage counts — how many sign-in checks and grade sends your account ran, with timestamps. These are counts only: they never include grades, assignment contents, student names, or student IDs.

We do not use cookies, advertising trackers, or third-party analytics.

3. Student Data

We do not collect, receive, store, or process any student data.

This includes but is not limited to: student names, student ID numbers, SIS IDs, grade scores, submission content, demographic information, or any other information that could identify a student.

Student grades are read from Canvas and written to Frontline entirely within your own browser session. At no point does this data pass through or reach any GradeSend server.

4. Chrome Extension Permissions

GradeSend requires specific permissions to function. Here's why we request each one:

• Host permissions for Canvas and Frontline domains — needed to read grades from Canvas and write them to Frontline. These permissions allow the extension to access only the gradebook pages where you are already logged in.
• chrome.storage.local — stores your Canvas API token, Frontline domain, and assignment mappings locally on your computer, inaccessible to other extensions or websites.
• Background service worker — used to route messages between content scripts and coordinate data transfer between Canvas and Frontline tabs.

What we can and cannot access: The extension can only read and write data on web pages you have open and are already authenticated to. It cannot access your browser history, other extensions, websites you don't visit, or any data outside of Canvas and Frontline.

5. How the Extension Works

GradeSend is a Chrome browser extension. When you initiate a grade send, the following happens entirely on your local machine:

• The extension reads grade data from the Canvas Grades page you have open in your browser, using your existing logged-in Canvas session.
• The extension writes those grades into the Frontline gradebook tab you have open in your browser, using your existing logged-in Frontline session.
• The data passes between the two browser tabs through the extension's background service worker — all on your computer. No external network request is made as part of this transfer.

The extension makes two kinds of external requests: verifying your Google sign-in against our access list, and recording an anonymous usage count when a send completes. Neither request ever contains grades or student data. Assignment-to-column mappings are stored locally on your device, not on our servers.

6. Limited Use Certification

GradeSend certifies that it complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Specifically:

• GradeSend accesses web content (Canvas and Frontline data) only to provide the core functionality of syncing grades between the two platforms.
• GradeSend does not use, transfer, sell, or share any user data collected through the extension for any purpose other than providing the grade-syncing service.
• GradeSend does not use web content or user data for advertising, marketing, analytics, or any other purpose unrelated to the extension's stated function.
• GradeSend does not combine or link user data from the extension with data from other sources for purposes other than providing the service.
• All data collection is transparent and disclosed in this Privacy Policy.

7. FERPA Compliance

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. GradeSend is designed to operate in a manner consistent with FERPA requirements for teachers using school-sanctioned tools.

Key FERPA-relevant facts about GradeSend:

• Student education records (grades) are never transmitted to GradeSend or any third-party server.
• The extension accesses student grade data only within the authenticated browser sessions of the classroom teacher who holds the appropriate access rights to that data.
• No student data is retained, logged, or stored by GradeSend beyond the teacher's active browser session.

If you are a school administrator with FERPA-related questions about GradeSend, please contact us at the address below.

8. Data Storage & Security

Server-side data: Account records (email, status, plan) and anonymous usage counts are stored in a Supabase (PostgreSQL) database with encryption at rest and in transit, protected by row-level security with no public access policies. All API communications use HTTPS encryption.

Local data: Canvas API tokens, Frontline domains, and assignment mappings stored on your device use Chrome's built-in chrome.storage.local API. This storage is sandboxed to the GradeSend extension and inaccessible to other extensions, websites, or users of your computer.

Data retention: Your email address and account record are retained for as long as your account is active, plus 90 days thereafter for support and account recovery purposes. You may request earlier deletion at any time.

No logs of student data: GradeSend does not create logs, backups, or records of any student grade data that passes through the extension, even temporarily.

9. Third Parties

GradeSend uses the following third-party services:

• Google Sign-In (OAuth) — authenticates your Google account. Google's privacy policy governs the sign-in itself; the extension requests only basic profile scopes (your email address).
• Vercel — hosts our website and account API. Vercel may log IP addresses and request metadata per their standard infrastructure logging. No student data is involved in any request to our API.
• Supabase — hosts our account database (email, status, plan, usage counts). No student data is ever stored there.

We do not share your information with any other third parties. We do not sell your data.

10. Data Deletion & Uninstall

When you uninstall the GradeSend extension:

• All local data stored on your device (Canvas API token, Frontline domain, mappings) is automatically deleted by Chrome.
• Your account record (email, status, plan) remains on our server for account and support purposes, but can be deleted on request.
• Student grade data is never stored, so no student data is affected by uninstallation.

Requesting data deletion: To request deletion of your email address and account record at any time, email us with the subject line "Delete My Account."

11. Your Rights

You have the right to:

• Request a copy of any personal information we hold about you (your email and account record).
• Request deletion of your personal information and account record.
• Opt out of promotional email at any time (see Communications & Email below). Account and billing notices are always sent.

To exercise any of these rights, email us at the address below with the subject line "Privacy Request."

12. Communications & Email

Service and billing email (always sent). We use your account email for messages about your own account: sign-in and approval notices, billing receipts and payment problems, support replies, security notices, and notices about changes to the Service, this policy, or the Terms. These are not marketing and cannot be opted out of while you hold an account.

Product news and promotional email (only with your consent). With your recorded consent, we may send occasional GradeSend product news, feature announcements, and promotional updates. You can give or withdraw this consent at any time from the teacher dashboard, and every such email includes a one-click unsubscribe link that takes effect immediately. We record when and where you gave or withdrew consent, together with which version of the Terms and this policy you agreed to.

13. Policy Changes

GradeSend may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Updating the "Last updated" date at the top of this policy.
• Sending an email notification to the address associated with your account (if applicable).
• Posting a notice on the GradeSend website home page.

Your continued use of the GradeSend extension after any changes constitutes your acceptance of the updated Privacy Policy. We recommend reviewing this policy periodically to stay informed about how we protect your data.

14. Pricing

GradeSend is currently free during its beta period. There are no purchases, subscriptions, or payments, and no payment information is collected. If paid plans are introduced in the future, this policy will be updated first and a refund policy will be published alongside them.

15. Contact Us

If you have questions about this Privacy Policy or how GradeSend handles data, please contact:

GradeSend
Tyler, Texas
support@gradesend.com

We will respond to privacy inquiries within 5 business days.