Privacy Policy

Effective date: 4 September 2026 Last updated: 3 November 2026

CourseLite is an online software service. In this policy, "we", "us" and "CourseLite" mean the operator of that service; "you" means the person using the website at courselite.org or the CourseLite Chrome extension.

CourseLite is operated from the United States and is offered in the United States. Where a governing law applies, it is the law of the State of California, United States.

CourseLite has no public office and does not take enquiries by post. Every question, request or complaint — including a privacy request, an account question and a legal notice — reaches us at one address, and a person reads it: support@courselite.org.

Every factual claim in this policy was checked against CourseLite's own source code on 4 September 2026.

1. The short version

CourseLite reads a college course you already have access to and turns it into a study assistant that answers from that course's own material.

Six things are worth knowing before anything else.

1. Your course files are read in your own browser, and since 12 October 2026 we also keep a copy of them. The text of a PDF, a slide deck or a spreadsheet is pulled out on your machine, and that text is what the assistant reads. So that you can open the real lecture inside CourseLite, the original of a PDF, a picture or a Word, PowerPoint or Excel file is now also stored — privately, in our hosting provider's storage, shown only to you, never shared and never used to train anything — until you delete it, the course or your account. Section 3.3b says exactly what is kept.
2. Your course material is sent to an AI provider. That is how the product works. Today that provider is OpenAI. Section 7 says exactly what goes and what OpenAI says it does with it.
3. We never see your Canvas password or session cookie. The extension uses the Canvas session you are already signed into, in your own browser, and reads only. If you choose to connect Canvas to our website instead — by signing in on your school's Canvas page, or by pasting a Canvas API token — we keep that permission (never a password), encrypted, use it only to read your courses when you ask, and delete it when you disconnect. Section 3.3c.
4. We ask Google for one narrow permission, drive.file. It lets us read only the files you personally picked. We cannot see the rest of your Drive, and Google enforces that, not us. CourseLite writes to no Google file.
5. We never see your card. Payment happens on Stripe's own pages.
6. Your saved chats are stored on our servers, and this changed on 2026-09-04. This policy previously said the opposite, and said it here. On a paid plan the course workspace keeps your last 10 conversations per course so they are there on your other devices, which means we hold the text of those questions and answers. On the Free plan new conversations are not saved at all. Section 3.6 says exactly what is kept, for how long, and how to remove it. Deleting your account deletes all of it.

There are also things this policy is honest about being incomplete. Some records survive account deletion, and some retention timers exist in code but are not yet on a schedule, because nothing runs the cleanup on a timer. Sections 12 and 13 say so plainly rather than burying it.

CourseLite is in a private beta. Some of what is described here — Google's review of our app, live payments — is not finished yet, and this policy says where that is the case rather than describing the finished version as if it had arrived.

2. Where your information comes from

3. What we collect, in detail

3.1 Account and identity

Sign-in is handled by Clerk. Clerk holds your email address, your password or social sign-in method, and your session. We never see your password.

From Clerk we store two things in our own database:

• your Clerk user id, which is what every row of your data is attached to;
• a copy of your email address, so we can reach you and so Stripe can bill the right person. This field can be empty.

Your session token stays in your browser and in Clerk's storage. It is never written to our database. If a token or an email address would otherwise end up in one of our log lines, it is replaced with [jwt] or [email] before the line is written.

We also store, if you provide it or your course names it, the name of the instructor for a course, per course. It may be sent to the AI provider, so that a question like "who teaches this course?" can be answered.

Until 5 October 2026 we also stored the name you wanted printed on a document CourseLite drafted. That feature was removed (section 3.6a); a name you gave then is no longer used, and is deleted with your account.

3.2 The waitlist

The waitlist is closed. There is no form on courselite.org and nothing can join it any more — you sign up for CourseLite directly instead.

Entries collected while it was open are still held. Each one is an email address in plain text, and optionally a university and a feature the person said they wanted. There is nothing else in that record but the date.

Two things about those entries, and neither flatters us.

• An entry is not attached to an account, and deleting your CourseLite account does not remove it. We have no way to connect the two, and connecting them would mean storing the link.
• There is no automatic expiry, and no route in the product that deletes one. Removing an entry is a database statement a person runs. Email support@courselite.org and we will run it — that is a real commitment, and it is the only mechanism there is.

3.3 Canvas course material

This is the largest category, and the reason CourseLite exists.

When you import a course, the extension reads it through the Canvas session you are already signed into, and sends us:

• the course name, code, its Canvas web address, and its Canvas course id;
• modules, module items, and their order;
• assignments: title, description, due, unlock and lock dates, points, the Canvas link, and the submission status Canvas reports;
• page bodies, the syllabus, announcements, discussions and quiz text;
• the text extracted from files — PDF, DOCX, PPTX, XLSX, CSV, Markdown, HTML;
• a hash and byte size of each file, so we can meter your storage;
• since 12 October 2026, the original file itself, when it is a PDF, a picture, or a Word, PowerPoint or Excel file (§3.3b);
• your Canvas user id, used only to make an anti-abuse hash (section 3.8).

Two things we want to be precise about.

Your course files are read in your browser. Unzipping, parsing and text extraction all happen locally, in the extension, and the text it pulls out is what crosses the network, in a JSON body, and what the assistant reads. No file is ever parsed on our servers.

Until 12 October 2026 this paragraph also said "there is no upload endpoint for course documents and no code that can accept one", and that was true until then. It is not any more: the original of a course file is now kept so that you can open it, and section 3.3b says exactly how. That is a copy for you to look at; it is not read on our servers, and it changes nothing above about where your file is read.

Until 2026-09-20 this paragraph ended "CourseLite has no upload endpoint, no object storage, and no code that can accept a file", and that was true of everything then built. Three things have changed since: lecture transcription accepts a recording you choose to upload, which is narrow and optional and is described in §3.3a; the pictures described just below are now kept in object storage; and the original files of your course are kept so you can open them (§3.3b).

Except for pictures that need reading. If a page in a PDF is a scan, a slide carries a diagram, or a Canvas page holds a picture, that picture is sent — at import time — to the AI provider so its contents can be transcribed, and we store the transcription as ordinary document text. The picture is not sent to the AI provider again, except in the cases described below.

Pictures an import did not get to. An import transcribes a limited number of pictures and records the rest as not read yet. Since 22 October 2026 those are read from the copy we already keep (described just below) rather than waiting for your next refresh: while your CourseLite dashboard or the course's page is open — or the course is open in Canvas with the extension — each is sent to the AI provider once, and its transcription is stored as above. It is the same single reading the next refresh would have made, nothing else from your files is sent with it, and it counts towards your plan's fair-use ceiling like any other reading; if that ceiling is reached, the pictures wait.

Since 10 October 2026 that includes figures drawn on a PDF's pages. A plot, a circuit or a diagram that a lecture PDF draws — rather than embeds as a picture — is found in your browser, cut out of its page as a picture of just that figure, and handled exactly as above: transcribed once and kept as described below. At most eight figures per file are taken this way. The rest of the page is not sent; its text was already extracted in your browser.

Since 30 September 2026 we also keep those pictures, so that a Guided Study reading can show you your own course's figure beside the explanation of it. Exactly the pictures the import already sent are kept — nothing is fetched to get them, and no other part of a file is. They are stored in Cloudflare's object storage (R2), under a key that carries no file name, title or account id; they are shown only to you, only after you sign in, and never cached; and they are deleted when you delete the course or your account (section 13). Until that date we kept none of them. Material imported before then is read again once, the next time your course is refreshed with an up-to-date extension, so that its pictures can be kept; nothing is added to it twice and pictures already transcribed are not sent to the AI provider again.

When a kept picture is sent to the AI provider again. A kept picture leaves storage for the AI provider in five situations, each while you are using the feature and never in the background:

• A Guided Study reading that is about to show one of your course's pictures has it looked at first, together with a short passage of the reading, to confirm it shows what the reading says.
• Since 17 October 2026, a practice test or a Guided Study question set can be built on your course's pictures. Up to four of them are sent with the course material the questions are written from, so the questions are written from the picture itself.
• Any question that shows one of them is checked by the AI provider looking at the picture together with the question and its answer choices, so a question your picture does not support is thrown away rather than shown to you.
• Since 23 October 2026, a question about one problem on a page shows only that part of the page. Your browser cuts the part out of the picture it already loaded — first a strip around it, then the part itself — and sends each cut to us; we send it to the AI provider, with the whole page beside the final cut, to confirm it is the right part and nothing the question needs is cut off. We keep only where the part is on the page, never the cut picture, and a part that is not confirmed is never shown.
• Since 29 October 2026, when you ask the course chat about a document you name — "the pre-lab for Lab 5", "the diagram on page 3" — up to four of the pictures kept from the pages it reads are sent with your question, so the answer is written from the figure itself rather than a description of it. Where a page it needs has no kept picture and the file's original is a PDF CourseLite keeps (section 3.3b), your browser draws that page from the original and sends the drawing with your question; it is used for that one answer and kept nowhere, by us or in your browser.

These are the same pictures the import already sent, parts of them, or pages of a file CourseLite already keeps, drawn by your own browser; nothing else from your files is added, and no account identifier is sent with them.

3.3a Lecture recordings you ask us to transcribe

This is the only part of CourseLite where a file is processed on a server rather than in your browser, and it exists because a browser cannot turn speech into text. (The original files of §3.3b are stored so that you can open them; nothing on our servers reads what is in them.)

It only happens when you ask. A lecture recording found in your course is recorded as a source and nothing is uploaded. Captions your institution or the video's host already published are imported as ordinary text, and so is a transcript you paste or a transcript file you upload — none of those sends us audio or video at all. Uploading a recording for transcription is an explicit choice, made one recording at a time, with the cost shown before it starts.

A recording that is a file in your Canvas course can be transcribed without you downloading it first. When you press Transcribe on it in the CourseLite extension and confirm the cost, your own browser downloads the file from Canvas, using your own Canvas session, and uploads it to us exactly as if you had chosen it yourself. For this, our servers do not contact Canvas and use no Canvas password or token (connecting Canvas by sign-in or token, section 3.3c, is a separate choice). Nothing is downloaded or uploaded until you confirm.

Where it is stored. In Cloudflare R2, our hosting provider's private object storage, in the same account that runs the rest of CourseLite.

What we do with the file.

• It is stored privately, under a random name that contains no filename, no course, no document and nothing about you.
• It is never served, never linked, and never given a public or shareable address. Nobody can fetch it, including you — it is not a copy, it is a queue.
• It is sent once to AssemblyAI, our transcription provider, to be turned into text. That is the only place it goes.
• We delete it as soon as the transcript is stored, and we delete AssemblyAI's copy too — their interface removes the transcript and the audio together. We record the fact of each deletion rather than inferring it, and anything that did not delete the first time is retried automatically.
• The transcript is stored as ordinary document text, like every other source.

On timing, honestly. The order is fixed and enforced in code: your transcript is stored, then our copy of the recording is deleted, then AssemblyAI's. We do not promise a number of minutes, because deleting their copy depends on their service answering us, and a deadline we cannot enforce is not a commitment — it is a hope. What we can say is that nothing waits for you to come back: the deletions run on a schedule of their own and retry until they succeed.

What AssemblyAI does with it. They transcribe it and return text. Under our agreement with them they are a processor acting on our instructions; we do not ask for, and they do not perform, speaker identification, summarisation, sentiment analysis, topic labelling or content classification, all of which their service offers and none of which CourseLite requests. See §11 for the full sub-processor list.

Only audio and video are accepted, and that is checked by reading the file's own first bytes rather than by trusting its name. Anything else is refused before it is stored.

We do not listen to anything you have not handed us. There is no background recording, the microphone is never used to record a lecture, and there is no code path that fetches a recording on your behalf from YouTube, Zoom, or anywhere else — with one exception, described above: a file in your own Canvas course, downloaded by your own browser after you press Transcribe and confirm the cost. (The one thing in CourseLite that uses your microphone is Ask out loud in a course chat or in Tiger Tutor beside Guided Study, which records only the question you are asking, only after you press it, and keeps nothing — section 4.)

What we ask YouTube. For a YouTube lecture we ask YouTube's official API for its title, its length, and whether it has captions — so we can tell you whether there is a transcript for you to copy. We send a video id and nothing else: not your name, not your account, not your course. We do not and cannot download a YouTube transcript, and we do not use unofficial ways of getting one.

Links that are also passwords. Some recording links — Zoom's especially — contain the access token or passcode that opens the recording. We store that link with your course so the button works, and we strip it to a bare website name before it can reach any log, error report, or usage record. We never ask you to type a recording passcode into CourseLite; you enter it on the site that asked for it.

Canvas access is read-only. There is no code in CourseLite that writes to Canvas, and no code that submits anything. CourseLite does not draft your assignments either (section 3.6a).

3.3b The original files of your course

New on 12 October 2026. So that you can open the real lecture inside CourseLite — the slides with their diagrams, the PDF with its tables — and so that a citation under an answer can open the page it came from, we keep the original of each course file that is one of these:

• a PDF;
• a picture — PNG, JPEG, GIF or WebP;
• a Word, PowerPoint or Excel file (.docx, .pptx, .xlsx).

A CSV, a text file, a Canvas page, an assignment's instructions and a note you typed are not copied: the text we already hold is what they say. A macro-enabled Office file (.pptm, .docm, .xlsm) is never kept.

How it reaches us. After the extension has read a file in your browser and its text has been stored, your browser sends us the file's bytes — the bytes it already downloaded from Canvas with your own Canvas session, so in the ordinary case nothing is downloaded twice, and our servers do not contact Canvas for it. A file you add to a course yourself is sent the same way, once the material exists. A course imported before 12 October 2026 has its files' originals sent once, the next time it is refreshed with an up-to-date extension; nothing about those files is read again, and nothing is sent to the AI provider.

What we check. Our server confirms a file is what it says it is from its own first bytes — and, for an Office file, from its own list of contents — and that it is exactly the file whose text we already hold, by comparing a hash of it. Anything else is refused and nothing is stored. We do not open, parse or read what is inside a kept original.

Where it is stored. In Cloudflare R2, our hosting provider's private object storage — the same private storage as the pictures above — under an address made of the course's id, the document's id and a hash of the file, with no file name, title or account id in it. It has no public or shareable address.

Who can see it. Only you, after you sign in. It reaches your browser through CourseLite, with every response marked private and never cached. It is never shared with anyone, never sent to the AI provider, and never used to train any model, ours or anybody else's.

How long we keep it. Until you delete the material, the course or your account, whichever comes first (section 13). When a file changes in Canvas, its new original replaces the old one and the old copy is deleted. An account holds at most 4 GB of originals in all; past that, a source is shown as its text and says so.

What we do not keep. A Google Doc, deck or sheet is shown through Google's own preview, in a frame on the page, and Google decides at that moment whether your Google account may see it. We store its id and name, as before (section 8), and no copy of it.

3.3c Connecting Canvas by sign-in or API token

Since 16 October 2026 there are three ways to let CourseLite read your Canvas courses. The Chrome extension (sections 3.3 and 9) holds nothing on our servers. The other two do, and only if you choose them:

• Sign in with Canvas. You type your school's Canvas address and sign in on your school's own Canvas page — including your school's single sign-on. CourseLite never sees that password. Canvas then gives CourseLite an access token and a refresh token: a permission to read, which you can withdraw in Canvas at any time. This works only at a school that has turned CourseLite on in its Canvas.
• A Canvas API token. You make a token in your Canvas account settings and paste it into CourseLite. We check it with your school's Canvas once, at that moment, and keep it only if Canvas accepts it.

What we store. Your school's Canvas address, which of the two you used, when you connected and last checked it, and the token itself — encrypted with AES-256 under a key kept in our hosting provider's secret storage and never in the database, and bound to your account so it cannot be used for anyone else. We never store a Canvas password; there is no field for one.

What we use it for, and nothing else. Read-only requests to your school's Canvas, from our servers, on your behalf: to check the connection works, to list your courses, and to import or refresh the courses you choose — the same pages, assignments, modules and files the extension reads, through the same fixed list of read-only Canvas addresses. We never write to Canvas, never submit anything, never message anyone, and never read your grades, your inbox or another course. The token is never sent to the AI provider, never shown back to you or anyone else, never put in a web address, and never written to a log.

Who receives it. Only your school's own Canvas, which issued it. It is not a subprocessor: it is your school's system, and the token goes nowhere else.

How long, and how to remove it. Until you disconnect, or delete your account. Disconnecting deletes it from CourseLite. For a sign-in we also ask your school's Canvas to cancel it; for a pasted API token we do not, because you made it and may use it elsewhere — you can delete it yourself in Canvas, under Account → Settings → Approved integrations. If Canvas stops accepting a connection — you withdrew it, it expired, your school removed it — CourseLite stops using it and asks you to reconnect. Your courses stay either way.

3.4 Anything else you add

If you paste a note, add material by hand, or supply a file you exported yourself, it is stored the same way: as text, in the same table as everything else, attached to the course you added it to. If what you added was a PDF or a Word, PowerPoint or Excel file, its original is kept too, as section 3.3b describes, and removing the material deletes it.

A course you create yourself — new on 2026-09-09 — is stored the same way as one you import: the same table, the same row. What we hold for it is what you typed: the course name, and the course code, instructor and term if you filled them in. It has no Canvas web address and no Canvas course id, because there is no Canvas behind it, and nothing about it is sent anywhere. Everything in section 12 about how long it is kept, and everything in section 13 about deleting it, applies to it unchanged.

Your highlights, underlines, strikeouts, notes and drawings on a Guided Study reading — new on 2026-10-10; strikeouts and drawings new on 2026-10-14. When you highlight, underline or strike out words in a reading, attach a note to them, draw on the reading with the pen, or write a note in a reading's Notes panel, we store it so that it is there when you come back and on any device you sign in on:

• What we store: the words you marked and up to 32 characters either side of them (so the passage can be found again), which section of the reading they were in, the colour you chose, whether you underlined or struck it out, the text of any note you wrote, and when each was last changed. For a line drawn with the pen: the points it passes through, measured against the part of the reading it was drawn beside, its colour and which section that part is in — not a picture of the page. It is kept in one table (guided_annotations), attached to your account and to the Guided plan the reading belongs to.
• It is your writing, and it goes nowhere else. Your notes, highlights and drawings are never sent to the AI provider, are not given to Tiger Tutor, are not used to generate anything, and are not written to our analytics or our logs — not even a count of them. The tutor is told which section of the reading you have open, as it always was, and nothing about what you marked or wrote.
• A copy may wait on your device. If a change cannot reach us — you are offline, or the tab closes before it is sent — your browser keeps it in its own storage (section 10) and sends it the next time you open that reading, then removes it.
• You can delete any of it yourself, at any time, from the reading or its Notes panel. Deleting the Guided plan deletes everything you marked and wrote on its readings, and deleting your account deletes all of it.

3.5 Google Workspace

Section 8 covers this in full, because Google requires it to be covered in full. In summary, CourseLite reads Google files a course links to, and the text of a Google Doc or Slides it reads, or that you export into a course, is stored like any other document. Until 5 October 2026 we also stored the scopes Google told us you granted and the id, name, kind and link of each file attached to an assignment; those records are no longer used (section 3.6a).

Our servers do not learn which Google account you used. The only permission we ask for is drive.file — there is no openid and no userinfo.email in the request — so Google never sends our servers your Google account id or your Google email address. Columns for them exist in our database and are empty in every row.

The CourseLite extension keeps it on your device, since 3 October 2026. When you allow a course's Google files (section 8), CourseLite asks Google, from your browser, which account you chose, and the extension stores that email address in its own storage on your computer. It is used for one thing: so the extension can sign in to the same account again later, and so you can reconnect it, without choosing an account each time. Your Settings page shows it as "Connected as …" by asking the extension in your browser. Through this feature the address is not sent to our servers and not stored by them. Disconnecting Google in Settings, or removing the extension, deletes it.

Your Google access tokens are not stored by our servers and are never logged. They are not sent to our servers at all. In your browser, CourseLite keeps a token in memory for the hour or so Google allows, uses it only to talk to Google, and never writes it to storage.

3.6 Questions, retrieved context, and AI output

When you ask a question, we send the AI provider your question, up to about eight passages of your own course material, and — when you ask from an assignment's page — that assignment's brief.

We store what comes back: generated answers where a feature saves them, flashcards, practice tests and Guided study material.

Your time zone — new on 19 October 2026

When you ask a question, your browser also sends the name of the time zone your device is set to — for example America/Los_Angeles — which is a setting on your device, not your location. We use it for that one question only: to work out what day and time it is for you, so that "the essay due Sunday" and "tomorrow" mean your Sunday and your tomorrow, and so that due dates are given to the AI in your local time rather than in UTC. We do not store it, it is not written to our logs or our analytics (only whether one was sent is logged), and the AI provider never receives it: the AI is told the local date and time it produces, and nothing else about it.

The page you have open — new on 2026-10-06

When you ask the CourseLite sidebar in the Chrome extension a question with "This page" switched on (it is on by default, and the sidebar says Using this page and names the page beside the box you type in), the extension reads the main text of the page in that one browser tab — its headings, paragraphs, lists, tables, code, the descriptions of its pictures and the words and addresses of its links — at the moment you send the question. A PDF open in that tab is read from the file. It does not read any other tab, it does not read the page before you ask, and a link's address is sent without the part after the ?, which on Canvas can carry a key to a file.

That text is sent to us with your question and on to the AI provider with it (section 7), so that the answer can be about the page in front of you — even a page from a course you have not added. We do not store it: it does not become course material, it is not saved with a conversation, and it is not written to our logs or our analytics; only how many sections it had is logged. Switch the sidebar to Course and the page is not read at all. Your questions and the sidebar's answers are kept by your browser for the conversation, as they always have been; a conversation about a page from a course you have not added is not kept at all, and ends when you leave it.

Free conversations are temporary — new on 2 November 2026

On the Free plan, a new conversation is not saved. It is held only in the memory of the open page, so moving between your courses' chats keeps it, and it is gone when you reload or close the page, or sign out. Nothing of it is stored on your device or on our servers. We do not add it to your history, and upgrading later — even on the same page — does not save it after the fact. What you ask is still sent to the AI provider to answer you, as every question is.

Nothing you saved before is removed. If you move to the Free plan, your saved conversations stay. You can read them and delete them. You cannot add to them or rename them unless you move back to a paid plan.

Temporary chat on paid plans — new on 3 November 2026

On a paid plan you can turn on Temporary chat in the Chat page's header. A conversation started while it is on is handled exactly as a Free conversation is: it is held only in the memory of the open page, it is gone when you reload or close the page or turn Temporary chat off, it is not stored on your device or on our servers, and it is not added to your history. Turning it on or off starts a new conversation — it never stops saving one you already have, and never saves a temporary one. What you ask is still sent to the AI provider to answer you, as every question is (section 7 quotes what that provider says it keeps).

Saved chats — what changed on 2026-09-04

Until 2026-09-04 this section said "we do not store the conversation. There is no chat, message or conversation table in our database." That was true and it is no longer true. We are stating the change plainly rather than quietly editing the old sentence away.

The course workspace now saves your conversations so that you can come back to one, and so that they are there when you sign in on another device. What that means concretely:

• We store the text of your questions and of the assistant's answers, plus the list of course materials each answer cited, in two tables (chat_threads and chat_messages).
• Ten per course, and no more. When you start an eleventh conversation in the same course, the one you have not used for longest is deleted. The app tells you this rule in the chat menu before it ever costs you anything.
• You can delete any conversation yourself, at any time, from that menu. Deleting one removes its messages too, immediately and for good.
• Deleting your account deletes every conversation, by database cascade rather than by a cleanup job that could be missed.
• Your conversations are never used for analytics. Our analytics tables record event names and counts, never content, and nothing in the product reads a message body except the request that shows it back to you.
• There is no admin screen that displays your conversations, no search across them, no sharing, and they are not used to train anything.

The chat on a course page and the chat beside an assignment are not saved this way; those still live only in your browser tab, as described in section 6.

Study progress — new on 2026-09-09

Until 2026-09-09 the study modes stored nothing on our servers. Closing the tab lost your place. That has changed, for the obvious reason: eighteen cards into a set of forty is work, and losing it is not a feature. As with saved chats, we are stating the change plainly rather than quietly editing the old sentence away.

What is stored is how far through a set you are in a given mode, and, for the modes that grade an answer, how many times each card has come back right and whether you have ever got it wrong. What is stored is counts. Not what you typed, not the card, not the question, not the answer — Learn compares your typed answer in your own browser and then forgets it. The same applies to a practice test you have started and not handed in: the answers you have typed are kept so you can come back to the paper, and they are the same answers the paper is graded from when you submit it.

It is yours alone. There is no ranking, no comparison with anybody else, and no view of it anywhere but your own screens — and nothing in the product reads it to decide what you are allowed to do. Deleting a set deletes its progress; deleting your account deletes all of it, by database cascade.

What we send to the AI provider is unchanged by this: your question, the passages, and the recent history. See section 4 for what the provider does with it.

Recently opened — new on 2026-11-02

Until 2026-11-02 we kept no record of what you opened. The dashboard now lists the last few things you opened, so that you can get back to them. We store which of your own files, flashcard sets, notebooks or practice tests it was, and when you last opened it. Not its contents, not how often, and not what you did in it.

It is yours alone, and nothing in the product reads it to decide what you may do. Deleting the item takes it off the list; deleting your account deletes all of it, by database cascade.

Guided study sessions — new on 2026-09-28

Until 2026-09-28 a Guided study conversation was not stored. The tutor beside a Guided plan held its conversation in your browser tab, and closing the tab lost it. That has changed so that a session can be left and picked up again — on another day or another device — with what was said in it. As with saved chats, we are stating the change plainly rather than quietly editing it in.

What that means concretely:

• We store the text of what you ask the Guided tutor and of its replies, and the course materials a reply cited, in one table (guided_turns), attached to the plan they belong to. Until 2026-09-29 that table also held short lines CourseLite wrote about where you were in a session ("I have taken you to…"). None is written now; any already stored are never shown to you or given to the tutor, and are deleted with the plan or your account like everything else in it.
• The most recent 200 lines per plan are kept. Older lines in the same plan are deleted as new ones are added, on every save rather than by a cleanup job.
• Deleting a plan deletes its conversation, and deleting your account deletes every one of them, by database cascade.
• When you ask about a flashcard or a practice question you have open, the page sends which card or question it is — an id, never its text — and we read the words from your own set or paper. A card's answer is only included once you have turned the card over, and a practice test's answer key only once you have handed the paper in.
• When you ask about a Guided question or reading you have open, the page sends which question it is, or which part of the article you have scrolled to — an id — and we read the words from your own plan. A question's answer and its explanation are included only once you have answered it, which is when they are on your screen too.
• Which option you picked on a multiple-choice Guided question — new on 2026-09-30. We record it as a number (the first option, the second…) beside whether you were right; never anything you typed. When you get a question wrong, the option you picked is told to the Guided tutor when you ask it something on that part of the session, and to the AI provider when it writes an extra round of questions for you (section 7), so that it can explain what was confused rather than only that you were wrong. The tutor is not given the right answers to the questions you got wrong. It is deleted with the plan or your account, like the rest of a session.
• Pictures and files you attach to a question to the Guided tutor are read in your browser first: a document becomes text there, and a picture is redrawn there, which removes the details a camera writes into a photo, location included. That text and that picture are sent to us with your question, and on to the AI provider with it (section 7), with each question for as long as they stay attached in that browser tab. We do not store them — not the picture, not the text, and not the file's name. The conversation keeps only what you typed. Removing an attachment, or closing the tab, is the end of it.
• Pictures and files you attach to a question in the course chat — a screenshot, a photo of a problem or of your working, and since 27 October 2026 a PDF, Word, PowerPoint, spreadsheet or text file — are handled the same way (pictures new on 16 October 2026). A picture is redrawn in your browser, which removes the details a camera writes into a photo; a file becomes text in your browser. That picture or text is sent to us with your question and on to the AI provider with it (section 7) — and with each question after it in that conversation, for as long as it stays in the conversation's Attached to this chat box in that browser tab. We do not store them: not the picture, not the text and not the file's name. A saved conversation keeps only what you typed, and your browser notes the names of what went with a question until the tab is closed. Removing an attachment from the box, starting a new chat, or closing the tab is the end of it.
• None of it is used for analytics, there is no admin screen that displays it, no search across it, no sharing, and it is not used to train anything.

Adaptive practice — new on 24 October 2026

Guided Study now asks its questions as one practice that follows your answers, and Adaptive Study is that practice on its own. It collects nothing new about you; what changed is what is kept with a plan and what is sent to write it:

• Your answers to "How do you want to study?" — whether you want readings, how much help, and multiple choice or free response — are stored with the plan as a few words, and deleted with the plan or your account.
• With free response, each question is a variation of a problem in what you picked — or, where what you picked holds no problem to vary, of one of your course's own homework or exam problems on that topic — written by the AI provider (section 7) from those passages as any question is. The answer you type is checked by CourseLite's own code — no AI reads it — and, as with any typed answer, only whether it was right is kept; the words you typed are not.
• What steers the practice is the answers you have already given, recorded exactly as before: whether each was right, and which option you picked. When you miss a topic twice in a row, the questions you got wrong on it — with their right answers and the option you picked — are sent to the AI provider (section 7) so that it can write a short explanation and more questions on that topic, as an extra round of questions already did.
• The mastery figure is worked out from those answers each time it is shown. It is not stored, and it is a measure of this session's answers, not a grade.

Questions modelled on your course's own work — new on 24 October 2026

Guided Study, Adaptive Study and practice tests now write their questions the way your course asks them. It collects nothing new about you; what changed is what is sent to write a question:

• A few passages of your course's own sample exams, study guides, quizzes, homework and discussions on the same ideas are sent to the AI provider (section 7) with the passages a question is written from, as a guide to the kind of problem, the method and the notation your course uses. They are read from the whole course — a topic's homework is often filed under another week — not only from the part you selected.
• An exam itself is never used: a Canvas exam that requires a lockdown or proctoring browser, as CourseLite reads it, is not sent and is never modelled on.
• Work you have not handed in is never restated. It may be shown to the AI provider as an example of what your course asks, marked as unfinished, and a question that repeats it — its words or its numbers — is removed before you see it.
• A question never points at a picture you are not shown. One that says "look at the figure", "the circuit shown" or "Figure 2" without its picture is removed, and a practice problem, which never has a picture, states everything it needs in words.

Setting up Guided Study with Tiger — new on 1 November 2026

Guided Study is now set up by answering Tiger's questions one at a time, and the answers are kept as you give them, so you can leave and pick up where you were:

• What we keep while you set up: what you chose to study, how you want to study and anything you typed under Something else?, your exam date (or that there isn't one yet), the minutes a day and the days of the week you said you can study, what you wrote under Anything from your teacher, and which files you added there. They are stored against your account in one row per setup (guided_setups), for the course you are setting up, until you press Start over, delete the course or delete your account. A setup that built a plan stays with that plan, so Adjust plan can show you what it was built from.
• What your teacher said is saved to your course as a note, and the files you add there are saved like any file you add to a course (section 3.4): they appear in the course's Sources, are read and indexed the same way, are sent to the AI provider (section 7) as course material when a question or a plan is written from them, and are deleted from the Sources panel or with the course. They are read as material — what the exam covers, what to stress — and never as instructions to CourseLite.
• The days of your plan are worked out by CourseLite's own code from the plan's steps, your exam date, your minutes and your days. No AI is asked, and nothing about the days is sent anywhere. They are stored with the plan and deleted with it.
• *What you type under Something else?*** is read the way the focus box before it was: by CourseLite's code for how you want to study, and sent to the AI provider with the request that makes your plan.

Exam-prep plans — new on 23 October 2026

Until 23 October 2026 the day-by-day plan before an exam was not stored. The course page worked one out each time it was opened and kept nothing. You can now ask CourseLite to plan the days before an exam and keep that plan, so it is there when you come back and you can change it. As with saved chats, we are stating the change plainly rather than quietly editing it in.

What is stored, in two tables attached to your account and to the exam you confirmed (exam_plans and exam_profiles):

• Your answers when you made the plan: how many days you have, how many minutes a day, whether you are learning the material for the first time or reviewing it, and the date you made it — your own calendar date, which is what "day 3" is counted from.
• The days CourseLite built from them: which of your course's topics each day covers, what kind of work it suggests, a time estimate and a one-line reason — written by CourseLite's own code, not by an AI.
• What you changed: topics you took out and topics you moved to another day.
• One reading of your course's practice material for that exam: which passages of your course's own practice exams, study guides, quizzes, homework and discussions concern which topic — stored as a reference to the passage, not a copy of it — and short descriptions of the kinds of problem and the variations they include. Whether a topic is confirmed for the exam is worked out each time you open the plan and is not stored.

What is not stored: anything you type into a practice problem is not part of this; how well you know each topic is still worked out from your graded answers each time, as everywhere else in CourseLite (section 3.6, Study progress).

Deleting the plan deletes the plan; the reading of your practice material is kept so that starting again costs nothing, and is deleted when the exam, the course or your account is. Removing an exam you added yourself deletes its plan and its reading. Deleting your account deletes all of it, by database cascade. It is yours alone: no ranking, no comparison with anybody, no admin screen that shows it, and the analytics events it records carry counts and kinds only — never a topic, an exam's name or a date.

Practice problems — new on 23 October 2026

CourseLite can now give you one practice problem at a time on a topic of your course, check the final answer you type, and adapt the next problem to how you did. This is a new kind of data we store about you, so we are stating it here rather than quietly adding it.

What that means concretely:

• We store each problem written for you — the question, its answer key, the wrong answers it was written to recognise, its hints and its worked solution — together with the course passages it was written from. That is generated study material, like a practice test.
• We store how you answered, never what you typed. For each part you check we record whether it was right, wrong or one we could not tell, which attempt it was, and — when your wrong answer matched a common slip the problem was written to recognise — a short tag naming the slip (for example "a sign error" or "a unit conversion slip"), from a fixed list. Your typed answer is compared on our server and then discarded: there is no column it could be stored in. We also record which hints you asked for and whether you asked to see the solution.
• Your first answer to each part, made before any solution was shown, counts toward your progress on that topic, like a practice-test question does. A retry, or an answer after the solution, does not.
• What goes to the AI provider (section 7): the topic's course passages, the course's own sample exams, study guides, quizzes, homework and discussions where they show how the course asks about the topic, and — when you have made the same slip twice — the problem's own sentence describing that slip, so the next problem can test it. Each problem is then sent once more, without its answer, to be solved independently so its answer key can be checked before you see it. Nothing you typed is ever sent.
• Checking your answer, showing a hint or a solution, and coming back to a problem use no AI at all.
• It is yours alone: no ranking, no comparison with anybody else, nothing used to decide what you may do. Product analytics record counts and fixed codes — how many parts, right or wrong, which slip tag — and never a problem, a topic name or an answer. Deleting the course or your account deletes all of it, by database cascade.

Study plans in chat — new on 23 October 2026

You can ask Tiger Tutor for a day-by-day study plan — "I have 4 days before my exam, plan it by day, topics only". To build one from every file in your course rather than from a few passages, CourseLite now keeps a list of the topics each of your course files covers. This is new stored data, so we are stating it here.

• What is stored, per file (document_digests): short topic names — "BIBO stability", "Convolution" — each with a reference to the passage of that file it was read from. Not a copy of the passage, not a summary, and nothing you typed.
• How it is made: the first time a file is needed for a plan, passages of that file which CourseLite has already imported are sent to the AI provider (section 7) to list the topics they cover. That happens once per version of the file: a file that has not changed is never sent again, and a file that changes is listed again the next time a plan needs it.
• The plan itself is not stored apart from the chat it appears in — a saved chat keeps it like any other answer (section 3.6, Saved chats). The topic names of your course are sent to the AI provider once per plan to arrange them into days.
• Deleting a file, the course or your account deletes its topic list, by database cascade. Switching a file off in your course's sources leaves the list in place but stops it being used. It is yours alone: no ranking, no comparison, no admin screen that shows it, and the log line a plan writes carries counts and file ids only — never a topic, a file name or your words.

3.6a The assignment writer, removed on 5 October 2026

Until 5 October 2026 CourseLite could fill in an assignment's Google Doc or Slides file, or draft a new Doc, deck or PDF, from your course material. That feature was removed. CourseLite no longer writes to any Google file and no longer drafts assignments.

The records it created — drafts and answers, assignment plans and revisions, the Google files attached to an assignment and their analyses, the record of each write into a Google file, reference entries, and the name you wanted on a document — are no longer read or used by anything. They are deleted when you delete your account (section 13). Text cached from an attached Google file still expires on the same schedule as before (section 12). Any Google file CourseLite created for you stays in your Drive, untouched; CourseLite never deletes a Google file.

3.7 Analytics, errors and logs

CourseLite's own record of what happens in the product is two Postgres tables, written from one file on our server. Changed on 18 October 2026: a filtered copy of some of it is now also sent, from our server, to two providers, so we can see where people get stuck and fix what breaks — PostHog for product analytics and Sentry for crash reports. Both are in section 11 and in subprocessors.md.

No PostHog or Sentry code runs in your browser or in the extension. There is no analytics SDK, no automatic capture of clicks or keystrokes, no session recording, no screen recording and no heatmap anywhere in CourseLite. Neither provider sets a cookie or stores anything on your device. Everything they receive is sent by our server after it has been filtered, and the requests come from our server's address, not yours.

In our own tables we record:

• an event name, from a fixed list (154 as of 18 October 2026, in src/analytics/catalog.ts). A client cannot invent one;
• the page you are on, as a route pattern — /course-work/:id, never a real course id, and never a query string. Paths are stripped in the browser and stripped again on the server;
• metadata from a fixed allowlist of keys (58 as of 18 October 2026): counts, enums, booleans, positions, status codes, model names, plan names. Never a sentence you wrote;
• your user id, plan, and source, all derived on our server. If a browser sends any of these, we ignore what it sent;
• a random session id for logged-out visitors, described in section 10;
• errors: a redacted message, the route, a status code, a request id, and — new on 18 October 2026 — the places in CourseLite's own JavaScript files where the error happened (a file name, a line and a column). Never the page, never what you typed.

What PostHog receives. Those events, except the ones that would repeat on every chat question — so a page being viewed, a course connection starting, finishing or failing, an import finishing or failing, a chat starting and getting its first answer or an error, a study session or quiz starting and finishing, a source being added, the plans being viewed, a checkout starting, a subscription starting, a screen with nothing on it, a step left unfinished, the same failure happening twice, and the rest of the fixed list. For each it receives the event's name, the route pattern, how long the step took, whether it worked, your plan, whether it came from the website, the extension or our server, and short codes and counts from a narrower allowlist. It never receives your name, your email address, your Clerk user id, your IP address, a course, file or assignment name, assignment text, a question you asked, an answer, a prompt, anything you typed, or a URL. Each question you ask is not sent; only that a conversation received its first answer.

The id PostHog and Sentry see is not your account id. Our server computes it from your account with a secret key (a keyed hash). The same account always gets the same id, so a step can be counted per person — "how many people got stuck here" — but neither provider can turn it back into your account, and nobody can without our key. A logged-out visitor's id is computed the same way from the random session id in section 10. PostHog is also told not to record or locate an IP address.

What Sentry receives. For an error: its code, a redacted message — email addresses, tokens and keys are replaced before it leaves our server — the route pattern, the HTTP status, the request id, whether it came from the website, the extension or our server, which version of CourseLite was running, the places in our own JavaScript files described above, and the same keyed id. It never receives the page's contents, what you typed, a cookie, a request header or a request body.

Turning it off. In Settings → Privacy, switch off Share usage analytics. Your browser then stops sending product events at all, and our server stops forwarding to PostHog anything it records about your account — from the website, the extension or the server itself. The choice is kept on your account, so it holds on every device you sign in on. If your browser sends Global Privacy Control, analytics are off without any setting, for signed-in and logged-out visits alike, and the switch says so. Crash reports are still sent to Sentry either way, because they carry nothing from your courses and are how a broken screen gets fixed; the switch says that too.

What we deliberately do not collect. No canvas-rendering, font, audio, WebGL, battery, screen-geometry, browsing-history, installed-extension, cross-site or behavioural-biometric fingerprint. (Audio there means fingerprinting your device by how it processes sound. It is unrelated to §3.3a, where a recording you choose to upload is transcribed and then deleted.) No advertising identifier. No device model. No user-agent string in our analytics tables.

IP addresses. We do not store your IP address. For rate limiting we derive a one-way hash of your address mixed with the current hour, so two hours of traffic cannot be linked to each other even by someone holding our database and our secret key. Cloudflare, who serve the site, see your IP address the way any network provider does, and Cloudflare's Turnstile bot check receives it for that one check. Neither is written to our database.

3.8 Anti-abuse

CourseLite's free tier attracts people who would like several of it. To stop that, we keep a small ledger of one-way hashes.

Up to five things get hashed, using a secret key that only our server code can read: your Clerk account, a verified email address, your Canvas login id, your Google account id, and a random id your browser or extension generated. Raw values are never written down.

Your Google account id comes from Clerk, since 2 November 2026. If you sign in with Google, Clerk tells us the account's id once it has verified it, and we keep only a hash of it. We use that for one thing, which is recognising an account you have already used. This is separate from connecting Google to work with a file (section 3.5), where we still never learn your Google account id.

Two accounts proven to be one person share one free allowance. "Proven" means the same verified email address, or the same verified Google account. For Gmail we treat addresses that reach the same inbox as the same address, which means ignoring dots and anything after a plus sign. For Microsoft, Apple, Fastmail and Proton addresses we ignore only what follows a plus sign, because those providers treat that the same way. Every other address, including every university address, is compared exactly as written.

The random browser id is only a supporting signal. It is a value our web app makes and keeps in your browser's storage. Nothing about your device goes into it, clearing your site data ends it, and we store only a hash. Students share laptops, so it can never link two accounts or restrict one for good. If many brand-new free accounts appear in one browser within a day, a new account there may be asked to pass a check or to wait before starting something costly. That lapses by itself and never touches anything you already have.

A throwaway email address is also only a signal. We check the address's domain against a public list of disposable mail services. If yours is on it, some costly actions are slowed a little. Some real students use such addresses, so it never blocks you by itself, and you can email us to have it lifted.

The hashes cannot be reversed into a person, are never sent to a browser, and identify nobody on their own. A refusal tells you a code, a reset date, and whether paying fixes it. It never tells you a risk score, a matched signal, or a network detail — those do not exist in the response.

A shared network address contributes to rate limiting and to nothing else. It can never, by itself, deny you anything.

How long these are kept. A hash of a verified identity is kept for 400 days from when we last saw it. A browser or installation sighting is kept for 90 days. Network values rotate every hour and are never stored as addresses.

If you think we have treated your account as somebody else's, email support@courselite.org. A person will look, and can separate the accounts.

3.9 Payments

If you subscribe, checkout happens on Stripe's own hosted page, and so does the billing portal. Card number, expiry, security code and billing address never touch CourseLite. There is no column for them in our database and no code that could receive them.

We store your Stripe customer id, your Stripe subscription id, your plan, Stripe's status for it, and when the period ends. We send Stripe your email address and your CourseLite user id so it can bill and identify the right account. If you cancel and tell us why, we store the reason.

Plan changes are written only by Stripe's webhook, whose signature we verify.

4. Where your information actually goes

This is the table to read if you read only one.

Other recipients: Clerk receives your sign-in details directly, because sign-in happens on Clerk's own components, and our server additionally asks Clerk to verify your session token and — for the two lookups in functions/lib/admin.ts and functions/api/courses/ingest.ts — to tell it your email address and role. Stripe receives your email and user id. Cloudflare serves every request and therefore sees your IP address and the URL, and its Turnstile bot check receives a challenge token. (Until 5 October 2026 Crossref could receive a DOI, if you asked CourseLite to resolve one for a bibliography; nothing contacts Crossref now.)

PostHog receives product events, and Sentry crash reports, both from our server, filtered, and under a keyed id rather than your account id (section 3.7).

Those are all of them. Our server's outbound requests go only to the providers in subprocessors.md — api.openai.com, api.stripe.com, challenges.cloudflare.com, Clerk's own API, PostHog's and Sentry's ingestion addresses, and, for the features that use them, AssemblyAI, the YouTube Data API and Wikimedia Commons — and, only if you connected Canvas by sign-in or API token (section 3.3c), your own school's Canvas, at the address you gave, for read-only requests. That address is checked first: it must be a public https website, never an internal or private network address, and never CourseLite itself. No other address you supply is fetched by our server.

Full list with links: docs/legal/subprocessors.md.

Cheat sheets

At the end of a Guided Study session you can make a cheat sheet: one page, two, or as many as it needs, of the formulas, rules, steps and terms from that session. When you press Generate cheat sheet, our server sends our AI provider the readings that session already holds — text CourseLite wrote from your course material, with the name of the file each part came from — and nothing else about you or your course. What comes back is checked by our own code and saved as text, with your session, so opening it again costs nothing. The PDF is made in your browser from that text and is never stored or uploaded; choosing a different length or downloading it again sends nothing anywhere. Regenerate replaces the saved sheet. Deleting the session, the course or your account deletes the sheet.

Pictures in Guided Study readings

A Guided Study reading may show a picture, a diagram, a chart or a table where one explains an idea better than words. You choose whether it does — Include visuals, asked when you create a plan — and the order it looks in is fixed:

1. a picture from your own course, kept as described in section 3.3;
2. a diagram or chart CourseLite draws itself from the reading's own words and numbers — nothing is fetched to draw one;
3. an openly licensed picture from Wikimedia Commons, and only one whose license is public domain, CC0, CC BY or CC BY-SA, with its author credited under it. A picture whose license cannot be confirmed is never shown.

For the third, our server sends Wikimedia a short phrase naming the subject — "mitochondrion diagram" — which the AI provider wrote from the reading. It carries no account identifier, no course name and no text of your material. Before a picture is chosen, our AI provider is shown up to three of the pictures the search found, by their public Wikimedia addresses, with a short passage of the reading they would sit in, and picks the one that shows the idea or none — so its servers, not yours, fetch those pictures from Wikimedia. If a picture is shown, your browser loads it from Wikimedia's own servers (upload.wikimedia.org and thumb.wikimedia.org), which, like any website, see your IP address and browser details when it does; we tell your browser not to send Wikimedia the address of the page it is on. Turning Include visuals off stops both.

Listening to a Guided Study reading — new on 18 October 2026

A Guided Study reading has a Listen button. It reads the article to you in one of four natural AI voices, or — where those are switched off, or you choose it — in your own device's built-in voice.

With an AI voice, nothing leaves your browser but which reading, which part of it and which voice: an id, a number and a name. Our server reads the words of that part from your own plan — text CourseLite already wrote from your course material — and sends them to our AI provider (OpenAI, section 7) to be spoken, one part at a time, as you listen, and at most two parts ahead of where you are. It never sends your name, your account id or anything you typed, and it never sends a reading you have not pressed Listen on. Nobody's reading is made into audio in advance.

The audio that comes back is kept, in our private object storage, under the course the reading belongs to, so that hearing a part again sends nothing to anyone. It is never public, never linked to from anywhere and only ever served back to you. It is deleted when you delete the Guided plan, the course or your account. Making new audio uses your AI credits the first time a part is played; playing it again, and changing the speed, use none.

A voice's sample — Hear beside each voice — says the same short sentence for every student and contains nothing of anybody's course.

Your chosen voice, your speed and where you stopped in each reading are kept in this browser (section 10), not on our servers.

With your device's own voice, the words are spoken by your browser using a voice installed on your device. CourseLite only offers voices your browser reports as on-device, so nothing is sent anywhere — not to us and not to a speech service.

Asking a question out loud — new on 18 October 2026

A course chat has a microphone beside the box you type in, and — new on 24 October 2026 — so does Tiger Tutor beside Guided Study. Press it and say your question: your words appear in the box as you speak, and when you press stop CourseLite asks the question for you, as if you had typed it.

Your browser asks you first. The first time, your browser asks whether CourseLite may use your microphone, and nothing is heard unless you allow it. The microphone is on only while the recording bar says Listening — from your press until you stop, cancel, or two minutes pass — and is switched off the moment you finish. Nothing records in the background, and nothing is heard anywhere but those two boxes.

Where your voice goes. While you speak, it streams from your browser to our server, and from our server to our AI provider (OpenAI, section 7), which sends back the words as it hears them. Your browser never connects to OpenAI itself, so OpenAI does not see your internet address, and nothing that names you is sent with it. Your browser also keeps a copy of the recording until you stop, and sends it to our server to be written down only if the live connection failed part way. We do not keep any of it: your voice is not saved to our database, to our storage or to a log, and it is gone when you stop. What you end up with is the text of your question, which is sent to Tiger Tutor like any typed question — and is kept exactly as a typed question there is: in a course chat only if that chat is saved, and in Guided Study as part of that plan's conversation with Tiger Tutor (section 3.6).

What it costs. Writing a question down uses a small amount of your AI credits — about two cents of provider cost for a minute of speech, so well under a cent for most questions — recorded the same way as any other AI use, with no words and no audio in the record. If you cancel after speaking, the part already written down is still counted, because it was.

5. Why we use it

We do not use your information for advertising, we do not profile you for advertising, and we do not sell it. There is no advertising code anywhere in this product.

6. Legal bases

Where a law such as the GDPR requires us to name a legal basis, we rely on:

• Performance of a contract — everything needed to give you the product you signed up for: importing your course, answering from it, building study material, billing.
• Legitimate interests — keeping the service secure, preventing abuse of the free tier, and understanding whether features work. We have kept these narrow on purpose: hashes rather than identifiers, route patterns rather than URLs, keyed ids rather than accounts for anything sent to PostHog or Sentry, and no fingerprinting. You can switch product analytics off (section 3.7).
• Consent — connecting your Google account, and, for anyone who joined one before sign-up opened, a waitlist entry. You can withdraw both.

This section is a description of our reasoning, not a legal conclusion. It has not been reviewed by a lawyer.

7. The AI provider, precisely

CourseLite sends your course material and your questions to OpenAI, at api.openai.com, unless we have configured a different provider endpoint. If that ever changes we will update this policy and this section.

What is sent: your question, up to roughly eight passages of your own course material (about 3,000 tokens), the assignment brief when you ask from an assignment's page, your instructor's name when the question is about the course, the words of a Guided reading you have asked to hear read aloud (section 4, Listening to a Guided Study reading) — sent so that it can be spoken, with the spoken audio sent back, your voice while you ask a question out loud in a course chat (section 4, Asking a question out loud) — streamed through our server so that it can be written down as you speak, and never kept by us, — once per exam, when you build an exam-prep plan (section 3.6, Exam-prep plans) — the exam's name as you confirmed it, your course's topic names, and passages of your course's own practice exams, study guides, quizzes, homework and discussions, — once per version of each course file, the first time a study plan in chat needs it (section 3.6, Study plans in chat) — passages of that file, to list the topics it covers — and, once per plan, your course's topic names and how many days you asked for, to arrange them into days, — once, at import time or, for one the import did not get to, soon after from the copy we keep (section 3) — an image that nothing else could read, a picture or the text of a file you have attached to a Guided tutor question, and a picture you have attached to a course chat question, each with every question while it stays attached, and — for a practice problem (section 3.6) — the topic's passages, a few passages of the course's own sample exams, study guides, quizzes, homework or discussions as a guide to how the course asks, the problem's own description of a slip you have made twice, and the finished problem without its answer, to be solved independently so its answer can be checked before you see it, and — for a Guided, Adaptive Study or practice-test question (section 3.6, Questions modelled on your course's own work) — a few passages of the course's own sample exams, study guides, quizzes, homework or discussions on the same ideas, from anywhere in the course. What you type as an answer is never sent.

What is not sent: your email address, your Clerk user id, your Google token, your Canvas credentials, your payment details, or any identifier of you. Our requests carry an API key and the content, and nothing that names you.

What OpenAI says it does with it. We are quoting OpenAI's own published documentation, because this is their commitment and not ours to make:

"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)."

"By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm."

Source: OpenAI, Your data — https://developers.openai.com/api/docs/guides/your-data.

Be precise about what that means. Those are OpenAI's terms, which OpenAI can change. CourseLite uses OpenAI's standard API — requests go to api.openai.com under an ordinary API key — so it is OpenAI's published API terms that apply to them. There is no separate agreement, no zero-retention arrangement and no enterprise plan behind this. CourseLite does not send a zero-retention or no-training header on these requests, so we are not enforcing anything beyond what OpenAI's default API terms provide. We are telling you what the provider says, not promising it on their behalf. If you would rather your course material were not processed by a third-party model, CourseLite is not a product you can use, because that processing is the product.

The model has no tools, with one exception. It returns text. It cannot call a function, change a database row, or write to your Google Drive — and since 5 October 2026 nothing in CourseLite writes to Google Drive at all. That is a deliberate property of how CourseLite is built: a document in your course that contains instructions aimed at an AI reaches a model that has no way to act on them.

The one exception is web search for a thin course. When a Guided Study session is planned for a course that holds too little readable material to teach from, CourseLite may ask OpenAI's own web search tool to find public educational pages on the subject. What is sent for that search is the course's name, the part of the course you chose and the goal you typed — never your course material, your name or any identifier of you — and the model is told to search for the academic subject only. The search runs on OpenAI's infrastructure under the same API terms quoted above; CourseLite's servers do not fetch those pages. Summaries of the pages it found, with their addresses, are stored with that study plan and deleted with it. Every screen of such a session says, in words, that it comes from the web and not from your course, and lists the pages.

8. Google user data

CourseLite can read Google Docs, Slides and Sheets that you choose. It does not write to them: the assignment writer that could was removed on 5 October 2026 (section 3.6a).

The scope

CourseLite requests exactly one Google scope:

https://www.googleapis.com/auth/drive.file

Not drive. Not drive.readonly. Not documents. Not presentations. Each of those would mean "everything you own". drive.file is per-file, and Google enforces it: CourseLite can see the files you explicitly picked (and any it created before 5 October 2026), and nothing else in your Drive. That is Google's enforcement, not a promise of ours.

An earlier version of CourseLite requested drive.readonly. It was removed on 1 September 2026 because broad access to somebody's whole Drive is too much to hold for a handful of course files.

The token

Your Google access token lives in the extension's service worker, or in a variable in one page of the website, for as long as that tab is open. It is never written to disk, never stored in our database, never sent to our API, and never sent to OpenAI. There is no Google refresh token and no Google client secret anywhere in CourseLite, and no server-side Google OAuth exchange: every Google operation is something you started, in front of you. (Canvas sign-in, section 3.3c, is the one place CourseLite does keep a refresh token — for Canvas, encrypted, and only if you chose it.)

What we store about Google

The text of a Google file CourseLite reads for a course, or that you export into one, is stored as a document, like any other course material. Records the assignment writer kept until 5 October 2026 — the scopes Google reported you granted and the id, name, type and link of each attached file — are no longer used, and are deleted with your account.

Our servers do not learn which Google account you used. We ask for no openid or userinfo.email scope, and our server refuses to take a Google account id or email. The extension keeps the address of the account you allowed course files with, on your device only — see section 3.5 — and that is the only place "Connected as …" comes from.

Allowing a course's files

When a course links Google files CourseLite cannot read, the extension offers to connect Google Drive. That opens a small CourseLite window with Google's own file picker in it, showing only the files that course links to. The files you select there are the files CourseLite may read, and nothing else in your Drive; the ids of the files that were shown to you are kept in the extension on your device, so that a file you could not select is reported as not shared with you rather than offered again. Their text, once read, is stored like any other course material.

What we do with it

Only what you can see us doing: reading a file you picked so it can be part of your course, and showing you a link to a file an assignment points at.

What we never do with it

We do not transfer Google user data to third parties, except as needed to provide the features you can see, to investigate abuse, or to comply with law. We do not sell it. We do not use it for advertising, retargeting, or any profiling. We do not use it to determine anyone's credit-worthiness. No human at CourseLite reads your Google file contents, except with your explicit consent, for a security investigation, or where the law requires it.

The required disclosures

For the CourseLite Chrome extension, in the wording the Chrome Web Store requires:

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

For CourseLite on the web, and for the same data. drive.file is a Google Workspace scope, and the wording Google's current Workspace policy gives is:

The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

The older, more general formulation is also true of us and is kept because several Google surfaces still ask for it by name:

CourseLite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Checked against Google's published policies on 2026-09-03. Both policies say this affirmative statement must appear in the application or on a page the application links to; neither mandates one exact sentence, so the wording above is Google's own example text rather than a phrase we invented.

Google's review of this app

Google reviews apps that request access to user data before they are made generally available. CourseLite has not completed that review yet. While it is outstanding, Google access is available only to accounts we have added as test users, and Google may show you an "unverified app" warning when you connect. Nothing in this section changes when the review completes — the scope is drive.file either way — but you should know which side of it we are on.

CourseLite never deletes a Google file

CourseLite no longer creates Google files, and any it created before 5 October 2026 stays in your Drive. Nothing in this product deletes a Google file, and nothing in it ever will. If you want a file gone, delete it in Google Drive.

Disconnecting

You can revoke CourseLite's access at any time from your Google Account, under Third-party apps & services. Revoking stops all future access immediately. It does not remove the file text we already stored in your course — deleting the course does that.

9. The Chrome extension

The extension is where course material is read, so it is worth being exact about what it does.

Where it runs. The extension's content script is allowed to load on any site's root page and on paths shaped like Canvas's — /courses, /dashboard, /calendar, /grades and a few others. This is broad, and the reason is structural: Canvas is self-hosted, so every university runs it on a different domain. There is no list of hostnames to match against, and there is no narrower pattern that would still work at your school.

What it does on a page that is not Canvas. Nothing visible and nothing sent. The script checks for Canvas's own structural markers, and if they are absent it stops without showing a panel. It does not read the page's content, scrape it, or report that you visited it.

What it reads on a page that is Canvas. The course, when you ask it to. Importing is something you start. Since 12 October 2026 it also sends us the original of each PDF, picture or Office file it read, so you can open it inside CourseLite (§3.3b).

What it never touches. Your Canvas password, your Canvas session cookie, your Canvas API token, or a file access token. None of these leave your browser, and none has a place to go: there is no code in the extension that receives one. (A Canvas API token you choose to paste into CourseLite's website is a separate path, described in section 3.3c; the extension never sees it.)

Permissions, and what each is for.

The cookies permission is the one that sounds worse than it is, so it gets the longest row. It cannot read a cookie belonging to your university, your Canvas, your bank, or any other site: a cookie read needs a host permission for that URL, and the only one this extension holds is for our own domain.

The extension has no host permission for any Canvas domain, because it does not need one: it runs inside the page you are already looking at.

10. Browser storage and cookies

Two different statements, and only one of them is "no cookies".

1. Code we wrote sets no cookie, and our API reads no cookie. Not one, on either side. It is structural rather than accidental: CourseLite's API authenticates with a bearer token our own JavaScript attaches to each request, so there is nothing for a browser to send automatically.
2. A sign-in cookie is nevertheless set on courselite.org, by Clerk's sign-in library running in the page. Keeping you signed in is what it is for, it is set on our domain, and it is strictly necessary: without it you would sign in again on every visit. We do not read it, our server does not receive it, and nothing about it is analytics or advertising.

Both are true, and the first one on its own would be a misleading way to say it. There is a full determination — what is set, by whom, what it is for, and why no consent banner is proposed — in cookies-and-storage.md.

We do use browser storage, which stays on your device and is never readable by another website.

The analytics session id is random. It is not derived from your machine. It is not a hash of your device, your fonts, your screen or your browser. If you clear your site data you become a new visitor to us, and that is the intended outcome rather than a hole to plug. Once you are signed in, events are attributed to your account and this id is not sent.

Cookies our providers set. Clerk keeps you signed in with a session cookie on courselite.org and a client cookie on its own sign-in domain. Cloudflare may set its own for security and bot protection, including for the Turnstile challenge that can appear during sign-up. Stripe sets its own on Stripe's checkout pages. Google sets its own when you sign in to Google or use the file picker. Those are governed by each company's policy, linked in subprocessors.md, and by ours only where they are set on our domain.

The Chrome extension reads one cookie, on courselite.org and nowhere else, so that being signed in on the website means being signed in in the extension. Section 9 says exactly what that permission can and cannot reach.

We have not built a cookie consent banner. Every cookie and storage entry described above is either strictly necessary for a function you asked for, or a preference stored on your own device; none of it is advertising, none is cross-site tracking, and no third-party analytics or advertising code runs in your browser or in the extension. The product analytics in section 3.7 are sent by our server, not by your browser, and they set no cookie and store nothing on your device beyond the random session id in the table above. Whether that conclusion holds where you live is a question of local law rather than of how we built the product, and the full reasoning — including the one step in it a regulator would most likely push on — is set out in cookies-and-storage.md.

11. Who else sees your information

Nobody, other than the service providers we need to run the product. The full list, with what each one gets and why, is in docs/legal/subprocessors.md.

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We have no advertising partners, no data brokers, and no advertising code.

We would disclose information if we were legally required to — a valid court order, a subpoena, a law we must obey — or where it is necessary to protect someone from harm. If CourseLite were acquired or merged, your information would move with it, and we would tell you before that happened.

12. How long we keep things

Course material, notebooks and generated work have no time limit. They stay until you delete the course, or delete your account. That is deliberate: a course you imported in September should still be there in December.

The following periods are defined in our code:

Two things are worth reading twice. An error record carries a redacted message, the route and a request id — a token or an email address is replaced before the line is written — and its link to you is removed when you delete your account even though the record itself stays. And a page view is folded into the day's totals before its own row is deleted, so what survives 14 days is a count, with no id of any kind in it.

A third: study progress is counts — how many cards you have been through, how many times a card came back right, and whether you ever got it wrong. There is no record of what you answered, in either table, and no card text in them at all.

We have to be honest about a gap. These periods are implemented in functions/lib/lifecycle.ts, but they are not currently on an automatic schedule: there is no cron trigger in this deployment, and the cleanup runs only when an operator calls it. Until that is wired up, treat those numbers as our policy and our intent rather than as something already happening on a timer. When it is running, this section will say so without a caveat. If you want data deleted before then, ask us and we will do it.

13. Deleting your account, and what really happens

How to ask

Settings → Delete your account. The button is in the product, it calls the same endpoint an email would, and it is described on a page you can read without signing in: courselite.org/legal/delete-account.

If you would rather not do it yourself, email support@courselite.org and we will. It is not a slower route — the same operation runs either way.

What deletion removes

One statement removes your users row, and the database removes everything attached to it. 48 tables are covered, and each one is asserted empty afterwards by a test that runs against a real database (tests/release/privacy/deletion-test.mjs): your courses and everything under them, your documents, the text passages and their embeddings, notebooks, flashcard decks and cards, practice tests, assignment links, instructor names, the records the removed assignment writer left (homework drafts and answers, assignment plans, revisions, agent workspaces, your Google file references and your Google connection, your Google file analyses, the record of every write CourseLite made into a Google file, and citations), your profile, settings, onboarding state, quota counters and reservations, your usage ledger, your billing account row, your cancellation feedback, your import jobs, your analytics events, your file records, and — new on 2026-09-04 — your saved chats and every message in them, and — new on 2026-09-09 — your study progress for every set, the per-card record of how you have answered, and your notification preferences, and — new on 2026-09-28 — every Guided study conversation, and — new on 2026-10-10 — every highlight, underline and note you made on a Guided reading (and, from 2026-10-14, every strikeout and every line drawn with the pen), and — new on 2026-10-11 — every cheat sheet made from a Guided session, and — new on 2026-10-18 — the record of every part of a Guided reading read aloud to you, and — new on 2026-10-23 — every practice problem written for you and the record of how you answered it, and the list of topics read from each of your course files for a study plan. One of the tables, device_accounts, is deleted by name a moment before the cascade rather than by it.

The pictures and original files we kept from your courses (sections 3.3 and 3.3b), and the audio of readings read aloud to you (section 4), live in object storage rather than in the database, so no table can take them along. They are deleted course by course right after the database has deleted your account; if that second step is interrupted, a cleanup pass deletes anything kept for a course that no longer exists. The same happens when you delete one course, and removing a file you added deletes its original at once.

Your course material and generated work are removed, not hidden. If a table that holds something of yours is ever added without the link that makes it cascade, that test fails — which is the point of writing the list as a test rather than as a paragraph.

What deletion does not remove

We would rather you read this here than discover it later.

1. Your Clerk account survives. Deleting your CourseLite data does not delete your login at Clerk, so your email address and sign-in method remain there. Ask us and we will delete it at Clerk too, or delete it yourself from your account settings.
2. Your subscription is cancelled as part of the deletion, not after it. If you have an active subscription, we tell Stripe to cancel it first, and only then remove your data. The cancellation is scheduled for the end of the period you have already paid for, so your subscription does not renew. Any outstanding charges, including prorated charges from plan changes made before the deletion, may still be collected when that period ends. The account goes today, though, so the rest of that period is time you cannot use, and it is not refunded automatically. If a payment of yours has already failed and Stripe is still trying to collect, we cancel outright instead, so that a retry cannot charge you after you asked to be forgotten. If Stripe cannot be reached, the deletion stops and nothing is deleted, and we tell you why, rather than destroying the record of a subscription that is still billing you. Stripe keeps its own record of the payments you made, under Stripe's policy and the law that requires them to.
3. Three records outlive the account, and none of them names you. They are:

• ai_usage — how many tokens each request used, which model, and when. No content of any kind: not your question, not the answer, not the course.
• abuse_decisions — that a decision was taken about an account: a reason code, a risk band, and the category names of the signals involved ("canvas_identity", "device_key", "velocity"). Never a hash, never an email, never a network address.
• turnstile_tokens — the hash of a one-time bot-check token, so the same token cannot be replayed. It expires on its own.

Each row survives; your user id is removed from it. We keep the rows because they answer questions that outlive an account — what this service costs to run, and whether an anti-abuse rule is behaving — and neither question needs to know who you were.

This is a recent change and the honest version of it is worth stating. Until migration 0037, the first two kept your Clerk user id verbatim, because they have no database link to your account and the deletion never reached them. That was not a decision anybody made; it was a gap. It was found by asking the database which columns hold a user id and which of those the deletion actually reaches, and it is now checked automatically on every run of tools/deletion-completeness-test.mjs — so a table added later that would keep your id fails a test instead of going unnoticed.

1. Some anti-abuse hashes survive, on purpose: records that say "this Canvas login, this verified email, this installation has already had a free CourseLite". Without them, "delete the account and sign up again" would be a one-click way to reset a free allowance, which is the exact loop the system exists to close. What survives is a one-way hash and a date, with the user id removed — that removal happens before the cascade, so it cannot be left half-done — and it expires 400 days after it was last seen. It cannot be reversed, and it is never sent to a browser. Since 2 November 2026 one number survives with it: how much of each free allowance had been spent in the periods still running, such as "2 practice tests this month". No course, no question and no text goes with it, and it is removed about five weeks after those periods end. If you believe one is wrong, email us and say so.
2. Error records survive, but stop naming you. An error logged while you were signed in keeps its redacted message, route and status; its user id is set to empty. The bug stays visible to us; you do not.
3. Google files stay in your Drive. Everything CourseLite created for you is yours and stays yours. Delete it in Google Drive if you want it gone.
4. Waitlist entries are separate. They are not linked to an account and are not removed with one. Email us.
5. Analytics events from before you signed in carry a random session id and no user id, so we cannot find them to delete them. They expire on the schedule in section 12.
6. Copies already sent to PostHog and Sentry (section 3.7) are not deleted automatically when you delete your account. They carry the keyed id rather than your account id, nothing new is sent once the account is gone, and they expire under each provider's retention (section 12). Ask us, before or after deleting, and we will delete them from both.
7. Backups. Our database provider, Neon, keeps point-in-time backups on a schedule it sets and we do not control. Data deleted from the live database can persist in one of those backups until that window passes, and is gone from there when it does. We would rather tell you that plainly than quote you a window we are not the ones who set.

Your other rights

Depending on where you live, you may have the right to access a copy of your information, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable form, or complain to a data protection authority.

Email support@courselite.org. We will respond within 30 days and will not charge you or treat you differently for asking.

We do not currently have a self-service export button. Ask and we will produce your data.

14. Security, and what it does not cover

What is actually in place:

• HTTPS everywhere, with HSTS.
• Sign-in through Clerk; every request authenticated with a verified token. Nothing in CourseLite lets a request name a user — identity comes from the token or the request fails.
• Every query is scoped to the account that made it. Something you do not own returns "not found".
• Secrets — the database URL, the API keys, the anti-abuse key — exist only in server-side configuration, never in anything sent to your browser.
• No card data, ever. No raw IP addresses. No raw anti-abuse identifiers.
• nosniff, strict-origin-when-cross-origin referrer policy, frame denial, cross-origin opener isolation, and a permissions policy that switches off the camera, geolocation and the rest, and allows the microphone to CourseLite's own pages only — for Ask out loud (section 4) — never to an embedded frame or another site.
• A Content-Security-Policy. It is currently served in report-only mode, which means a browser reports a violation rather than blocking it. That is a deliberate staging step, not an oversight — enforcing a wrong policy removes sign-in for everybody at once — and it is a real reduction in protection until it is switched on. We would rather say so than let "we have a CSP" do work it is not doing yet.
• Regular automated security tests, including an adversarial suite.

What this does not mean. No service is perfectly secure, and we are not going to imply otherwise. CourseLite has not been penetration-tested by a third party, holds no security certification, and is not certified under SOC 2, ISO 27001, or any similar scheme. This policy makes no claim that CourseLite is compliant with FERPA, COPPA, HIPAA, the GDPR, the CCPA, or any other specific law. If your school requires a vendor to hold one of those, CourseLite does not meet that requirement today.

To report a vulnerability, see SECURITY.md.

15. Where your information is processed

CourseLite runs on Cloudflare's global network, which serves requests from wherever you are, and the pictures and original files we keep are stored in Cloudflare's object storage. Our database is hosted by Neon in the United States (AWS us-west-2, Oregon). Clerk, Stripe, OpenAI and Google each operate their own infrastructure across multiple countries. Our PostHog project and Sentry organisation are in each provider's United States region, and our server refuses to send to either provider's European region.

If you use CourseLite from outside the United States, your information will be transferred to and processed in the United States and possibly elsewhere. Privacy laws there may differ from the ones where you live.

CourseLite is offered in the United States. We do not offer it in the European Economic Area or the United Kingdom.

That is not a formality, and here is the honest reason for it: no international transfer mechanism has been confirmed with any of our providers, and no data processing agreement has been signed with any of them. Serving people in the EEA or the UK would require both, per provider. We would rather not offer the service there than name a safeguard that does not exist.

16. Age

CourseLite is built for college students. It is not directed to children and we do not market it to them.

You must be at least 13 years old to use CourseLite. By creating an account you are representing that you are. We do not ask for your date of birth, we do not want it, and we do not verify your age.

Being accurate about this: sign-up is Clerk's own form and it does not yet ask you to tick anything about your age. So today the 13+ minimum is a term of this policy and of the Terms rather than a question on a screen. Adding that question is on the release checklist, and this paragraph will change when it lands — in that direction, not the other one.

We do not knowingly collect personal information from anyone under 13. If we learn that an account belongs to someone under 13, we will close it and delete the information we hold. If you believe a child under 13 has an account with us, email support@courselite.org and we will act on it.

If you live in the European Economic Area or the United Kingdom, CourseLite is not offered where you are — see section 15. One of the reasons is this one: under GDPR Article 8 a person between 13 and 16 can need a parent or guardian's consent before using a service like this, with the threshold differing by country, and CourseLite has no mechanism for collecting that consent. We have not built one on a guess, and we do not offer the service where it would be needed.

17. Emails we send you

CourseLite sends transactional email only: things like sign-in and account messages from Clerk, and receipts and billing notices from Stripe. These are part of running your account and you cannot unsubscribe from them while you have one.

We do not send marketing email, and we do not sell or rent your address to anyone who would. If that changes, we will ask you before adding you to anything, we will put an unsubscribe link in every message, and we will update this section first.

If you joined the waitlist before sign-up opened, we may email you once to say so. Ask us to remove you and we will.

Settings → Notifications does not contradict this. Since 2026-09-09 you can say which reminders you would want — an assignment due soon, an overdue one, a course that finished importing. Nothing sends them. There is no email sender, no push, no scheduled job and no third-party notification service in CourseLite, the settings screen says so above the switches, and your answers are stored only so that whatever gets built later starts from what you actually chose. When something does send, this section changes before the first one goes out.

18. Changes to this policy

If we change how CourseLite handles your information, we will update this page and change the "last updated" date at the top.

For a change that materially affects you — a new category of data, a new provider receiving your material, a new purpose — we will tell you before it takes effect, by email or in the product, and not only by editing this page.

19. Contact

CourseLite is an online service with no public office, so there is no postal address to write to. Email reaches a person and is the route for everything above.

CourseLite is an independent product. It is not affiliated with, endorsed by, sponsored by, or connected to Instructure, Canvas, Blackboard, Moodle, Google, OpenAI, Clerk, Stripe, Cloudflare, or any university, college or school. The full statement is in non-affiliation.md.