CourseLens

Privacy policy

Last updated 10 November 2026

CourseLens collects only what it needs to show your assessments and timetable. This page explains what that is, where it is kept and how to remove it.

What we store on our server

  • Account: your email address, username, and the date you created the account and agreed to these policies.
  • Password: stored only as a salted PBKDF2-SHA512 hash. We never store or see your actual password.
  • Canvas API token and timetable link: encrypted with AES-256-GCM before they are saved.
  • Reminder settings: whether you chose browser or Discord reminders and how many days ahead. If you chose Discord, the webhook link you pasted, encrypted with AES-256-GCM.
  • Canvas address: the Canvas site you chose, such as your university's, saved as plain text.
  • Problem records: when loading from Canvas, your timetable feed or a Discord reminder fails, we note the time, what failed and the error message, linked to your account. They are deleted after 30 days.
  • Sessions: a random session ID and its expiry date for each device you sign in on.

Your assessments are fetched from Canvas when you use the app. A copy is kept in server memory, refreshed every 30 minutes, so pages load quickly. It is never written to the database, and it is dropped when you sign out, change your token, clear your data or delete your account.

What stays in your browser

Your theme, text size and layout choices, hidden assessments, assessments you tick as done, which reminders you've already been shown, grade predictor entries, and timetable colours and time format are saved in your browser's local storage. They are never sent to our server. Browser reminders are shown by your browser on your device.

Cookies

We use one cookie, ct_session, to keep you signed in for up to 7 days. It can't be read by scripts on the page. There are no analytics, advertising or tracking cookies. Pages, fonts and scripts all come from CourseLens itself, so opening a page doesn't contact any other company.

CourseLens runs no analytics today. If it adds any, they will load only after you allow them in the banner at the bottom of the page. Your choice and the time you made it are saved in your browser as ledger-consent. They are never sent to our server.

Who we connect to

  • Your Canvas site: using your token, only to read your courses, assessments and grades.
  • Your timetable feed: the iCal link you saved, only to read your classes.
  • Discord, only if you choose Discord reminders: once a day we post the names, courses and due times of your upcoming assessments to the webhook you gave us. Anyone in that Discord channel can read them, and Discord's own privacy policy covers what's posted there.
  • Our database and hosting providers: they store and run the service. Your data is not sold or shared with anyone else.

Who can see it

The people who run CourseLens can see your email address, username, when you joined and last signed in, whether you've added a Canvas token or timetable link, and your problem records. This lets us help if you lose access to your account. We can't see your password, your Canvas token, your timetable link or your Discord link.

How long we keep it

We keep your data until you remove it. In Settings you can:

  • Clear data: deletes your saved Canvas token and timetable link straight away.
  • Reminders: choosing Off or Browser deletes your saved Discord link.
  • Delete account: permanently deletes your account, encrypted keys and every session.

Signing out deletes that device's session.

Security

All traffic uses HTTPS. Sensitive actions require your password or a typed confirmation, and sign-in and account changes are rate limited. No system is perfectly secure, so revoke your Canvas token in Canvas if you think it has been exposed.

Changes and contact

If this policy changes, we will update the date at the top of this page. For questions or requests, open an issue on GitHub.