Privacy Policy

This MCP is not affiliated with Canvas or Instructure. It is an independent project that strives to handle your data and use the Canvas API in line with Instructure's and Canvas's policies. We do not represent Instructure or your institution.

What we collect

When you connect your Canvas account, we store the following in an encrypted serverless database:

• Your Canvas domain (e.g. canvas.sydney.edu.au)
• Your Canvas Personal Access Token — encrypted at rest using AES-256-GCM
• Your Canvas display name (e.g. "John Smith") — used only to confirm the connection succeeded
• An opaque OAuth session token — used to identify your session with the AI assistant

We do not collect your email address, IP address, usage history, or any Canvas content (assignments, grades, files).

How we use it

Your credentials are used solely to make Canvas API calls on your behalf when you invoke tools through the AI assistant. Your PAT is decrypted server-side only at the moment of an API call and is never sent to the AI assistant or any third party.

Data retention

• Canvas credentials: deleted after 90 days of inactivity
• OAuth access tokens: expire after 24 hours
• OAuth refresh tokens: expire after 30 days
• Setup sessions: expire after 10 minutes

You can remove your credentials at any time by revoking your Canvas PAT in Canvas → Account → Settings → Access Tokens. This immediately invalidates any stored credentials.

Security

Credentials are encrypted using AES-256-GCM with a key stored exclusively in server environment variables. Data is stored in Upstash Redis, which encrypts data in transit (TLS) and at rest. We do not log authorization headers or Canvas tokens.

Third parties

This service runs on Vercel (hosting) and Upstash (Redis database). No data is shared with any other third party, including Anthropic or your educational institution.

Contact

If you have questions about how your data is handled, you can review the full source code of this service or raise an issue on the project repository.