Trackademic Canvas Connect
Privacy Policy for the Chrome extension · Last updated August 2026
What this extension does
Trackademic Canvas Connect is a Chrome extension with exactly one job: when you click Connect this account with Trackademic while on your school's Canvas LMS site, it creates a Canvas API access token using your own, already-logged-in Canvas session, and hands that token to the Trackademic web app so you don't have to generate and paste one manually. It has no other features.
What data it accesses, and why
Canvas access token. When you click Connect, the extension runs a script in your Canvas tab that calls Canvas's own /api/v1/users/self/tokens endpoint using your existing session cookies, the same way Canvas's own "New Access Token" button in your account settings would. The token this creates is held only in the extension popup's memory for the few seconds it takes to hand it off, and is never written to Chrome's storage, a file, or any server the extension controls.
Where the token goes
The extension opens or focuses a Trackademic browser tab and navigates it to a URL carrying the token in a URL fragment (the part after #) — for example https://www.trackademic.me/canvas#trackademic_token=.... A URL fragment is a browser-only concept: it is never transmitted to any server as part of the page request, including Trackademic's own servers. The Trackademic web app reads it directly out of your browser with JavaScript the instant the page loads, immediately removes it from the visible URL, and uses it to verify and connect your Canvas account the same way a manually pasted token would be. The extension itself does not send your token to Trackademic, to Anthropic, to Google, or to any other third party.
Your Canvas profile
After creating a token, the extension makes one read-only request to Canvas's /api/v1/users/self endpoint to show your name and avatar in the popup, purely so you can confirm which account was just connected. This is displayed for a moment and then discarded when the popup closes — it is not stored or transmitted anywhere.
What this extension does not do
It does not collect analytics or usage statistics. It does not use cookies, trackers, or advertising of any kind. It does not read, modify, or transmit the content of any page other than the specific Canvas API calls described above, made only on pages under an instructure.com domain. It does not run on, or request access to, any other website. It contains no remote code — everything it runs ships inside the extension package itself.
Permissions this extension requests, and why
- activeTab / scripting — to run the token-creation script inside the Canvas tab you have open when you click Connect, and nowhere else.
- tabs — to find and focus an existing Trackademic tab (or open one) after a token is created.
- Host access to *.instructure.com — Canvas LMS domains, where the token is created.
- Host access to www.trackademic.me — the Trackademic web app the token is handed off to.
Data retention
The extension itself retains nothing between uses — no token, profile data, or history persists once the popup closes. Once your Canvas token reaches the Trackademic web app, its retention is governed by Trackademic's own account data, separate from this extension.
Changes to this policy
If this extension's behavior changes in a way that affects the data it accesses or where it goes, this page will be updated to reflect that before the change ships in a published version.
Contact
Questions about this extension or this policy: olegnatruk@gmail.com