Effective date: June 24, 2026

CardCue ("CardCue," "we," "us") is a browser extension that enhances the Canvas
LMS dashboard by displaying your grades, assignments, and upcoming due
dates on your course cards. This policy explains what data CardCue does and does
not handle. We've tried to keep it plain and accurate.

The short version
CardCue runs in your browser. It reads your Canvas course data using your own
existing Canvas session and displays it on your dashboard. We do not operate a
server that collects your grades or coursework, we do not create accounts, and
we do not use any analytics or tracking. The only data CardCue sends off your
device is what's needed to verify your paid license with our payments provider
(your license key and a device identifier — never your course data).

What CardCue accesses, and where it goes
Your Canvas course data (grades, assignments, due dates). When you're signed
in to your school's Canvas, CardCue requests this data through Canvas's own API
using your existing Canvas session, and renders it directly on the page. This
data is processed in your browser and is not transmitted to us or to any third
party. It travels only between you and your own institution's Canvas servers,
the same as when you use Canvas normally.

License information:
To unlock the paid version, CardCue communicates with
our payments and licensing provider, Lemon Squeezy, to activate and verify
your license. In these requests CardCue sends:

• your license key,

• a device "instance" identifier generated for license-seat counting, and

• a short device label that includes your operating-system platform (for

  example, "MacIntel" or "Win32").

It does not send your name, email, grades, or any Canvas data in these
requests. Lemon Squeezy acts as the merchant of record for purchases and
processes your payment and customer details under its own privacy policy
(https://www.lemonsqueezy.com/privacy).

What CardCue stores on your device
CardCue uses your browser's local extension storage to keep:

• your license/activation state (license key, status, device instance ID,

  validation timestamps), and

• the list of custom Canvas site addresses you've chosen to enable.

This information stays on your device and is removed if you uninstall the
extension. CardCue does not store your grades or coursework.

Permissions

• Access to Canvas sites (instructure.com and any custom Canvas site you

  enable): to read your course data and display it on your dashboard.

•   Access to api.lemonsqueezy.com to activate and validate your license.

• Storage: to keep your license state and enabled-site list locally.

• Alarms: to schedule occasional background license checks.

• Scripting / activeTab: to add CardCue's display to Canvas pages and to let

  you enable it on the current site.

CardCue does not load or run any remote code; all of its code ships in the
extension package.

Schools, districts, and students
Schools and districts may deploy CardCue to managed devices. In that case a
signed license token is delivered to the device through the organization's
Google Admin policy. This token authorizes the paid features and contains no
personal information about any student. Because CardCue does not collect or
transmit student data (course data is read via the student's own session and
rendered locally), it is designed to avoid gathering personal information from
students. Individual CardCue subscriptions are intended to be purchased by
adults; minors should obtain access through a parent, guardian, or their school.

Data sharing and sale
We do not sell your data. We do not share your data with third parties except as
described above (Lemon Squeezy for license verification, and your own
institution's Canvas, which you already use). We do not use your data for
advertising or to build user profiles.

Security
License communications with Lemon Squeezy use HTTPS. Because CardCue keeps your
license state locally and does not maintain a database of user grades or
coursework, there is no central store of your academic data to be exposed.

Children's privacy
CardCue is not directed at collecting personal information from children. When
used by minors, it is intended to be deployed by a school or provided by a
parent or guardian, and it does not collect personal information from the
student.

Changes to this policy
We may update this policy from time to time. Material changes will be reflected
by updating the effective date above and posting the revised policy at this URL.

Contact
Questions about this policy or your data: support@cardcue.app