What this collects, what it does with it, and what it never does. Two different pieces with two different answers, so they're separate below.
When you connect at /setup, this server stores your Canvas web address and your Canvas access token. The token is encrypted (AES-GCM) before it is written, and is decrypted only to make a request to your own school's Canvas.
It is used for exactly one thing: reading your coursework from Canvas when you ask Claude a question that needs it. Everything this can reach is something you can already see when you log into Canvas yourself, and it is read-only — it cannot submit work, post, unenroll, or change anything.
Your coursework is not stored. Responses from Canvas are cached briefly (minutes) so that a single conversation doesn't make the same request repeatedly, which is what keeps Canvas from rate-limiting your account. Nothing is sold, shared, or used for advertising, and nobody reads your data.
Operational logs are kept for 3 days. They record that a request happened and whether it worked. They never contain your access token, your connector URL, your name, or your Canvas user id.
A connection that goes completely unused for 180 days deletes itself. You can delete everything at any time at /data, which needs nothing but a working Canvas token — no connector URL, no account, no email.
The extension sends nothing to this server. Your Canvas address and access token are held in your browser's local extension storage, on your computer, and the extension talks to your school's Canvas directly. We never receive them and could not read them if we wanted to.
Stored locally: your Canvas address and token, your reminder preferences, a cached copy of your recent coursework so the popup can open instantly, and which reminders have already been shown. Local storage is used deliberately rather than browser sync, so credentials are never copied to your Google account or to your other machines.
The extension makes requests to two places, both only because you asked it to:
There is no analytics, no tracking, no telemetry, and no third-party service of any kind beyond those two. "Delete everything" in the extension's settings removes all of it from your computer at once.
If you use the feedback form, your message is emailed to the maintainer. The form asks for nothing else — no name, no email address — so the message is all that's sent, and it isn't used for anything beyond replying to what it says.
This is a personal project run by a student, not a company. If something here is unclear or looks wrong, say so.