CourseLark Privacy Policy

Effective October 22, 2026 (no sign-in apps update)
Operator: Noah Fishman
Contact: ntfishman@gmail.com

CourseLark is an independent browser extension for organizing schoolwork. It has no CourseLark account, subscription, advertising, analytics, or developer-operated data collection endpoint. This policy explains what it accesses and how you control the data.

Information handled

When you accept the Terms, CourseLark asks once for access to HTTPS sites ("school-site access"). With it, CourseLark checks each page you open only for markers of Canvas, Brightspace, Moodle, Blackboard or Google Classroom; on any other page it reads nothing else and stops. When it recognizes a school site, it connects that site automatically (you can turn it off per site in Settings). Each time you open a connected site while signed in to Canvas (at most every 30 minutes), CourseLark automatically uses your current Canvas session to read your Canvas profile identifier, course and enrollment details, assignment group weights and drop rules, assignment titles, descriptions, deadlines, points, submission status, scores, available grades, and course announcements posted in the last 21 days (title, text, date and link). On enabled Brightspace, Moodle and Blackboard Learn sites, it uses your signed-in session the same way to read your user identifier, enrolled courses, assignment or activity titles, due dates and links, and (Brightspace and Blackboard) released points and course grades. On Moodle it reads the session key shown on the page to make read-only lookups. On other connected LMS pages, it may read visible course names and links. It uses this information for the dashboard, assignments, course cards, and grade estimates. It does not request your LMS password, submit coursework, or change official grades.

You may enter tasks, notes, study cards, grade adjustments, course details, themes, settings, links, files, and audio. The extension records local study activity, focus sessions, and task completion for its progress features. These records may contain personal information, website content, and user activity. They are stored in browser extension storage and IndexedDB on your device. The standalone dashboard may also use your browser profile's local storage. The extension does not send them to Noah Fishman or a CourseLark server.

Optional transfers you control

• Fonts: Selecting or installing a Google Fonts family loads its stylesheet from fonts.googleapis.com and font files from fonts.gstatic.com. Google receives normal network request information. Installed/system fonts do not require these requests.
• Community themes: Opening Community themes requests optional access to api.bettercampus.com. Browsing, searching, paging and previewing contact that public service with the search text, page number or theme code. Requests omit account credentials and referrers. The service receives ordinary network information such as your IP address. CourseLark does not send notes, tasks, grades or LMS credentials to it. Installing an imported theme can load HTTPS images from their original hosts. Theme files and settings are saved locally.

• Calendars: Choosing Google or Outlook next to a task opens that provider with the task title and time in the URL. Export for Google Calendar or Export for Outlook saves a calendar file of open tasks (titles, times and links; notes excluded) and opens that provider's import page; you choose whether to import it. If you connect iCloud calendar sync, CourseLark uses your Apple ID email and an app-specific password you create to create a calendar named CourseLark in your iCloud account and, every few minutes while the browser is open, sends each open task's title, start and end time, and assignment link directly from your browser to iCloud. Completed or deleted tasks are removed from that calendar. Task notes are excluded. Apple stores these events under its own terms and policy. The app-specific password and event identifiers are stored only in this browser's extension storage, are excluded from backups, and are deleted when you disconnect or erase local data. Disconnecting does not delete events already in your calendar. CourseLark has no server and no registered sign-in app. Calendar and JSON backup exports save copies where you choose. Backups contain local records but exclude attached file blobs.
• Speech and audio: Audio recording is saved locally. Browser speech recognition is off by default. If you check its option before recording, audio may be processed by your browser provider under its own policy. The separate Transcribe locally action sends a recording to a service you run at 127.0.0.1:4317, which can use a local whisper.cpp model. The companion writes temporary audio and transcription files on your computer and normally removes them after the request. An abrupt shutdown may leave temporary files.
• Scanned-page OCR: Read scanned pages (OCR) sends images of the open PDF's pages to the companion service on your device at 127.0.0.1:4317, which runs a Tesseract install on your computer and removes its temporary files after each page. Nothing is sent to an outside service.
• AI through Ollama: If you choose Smart notes, AI study set, or Ask about notes, the selected notes and prompt go to the companion service on your device and then to your configured Ollama service. Ollama can use cloud models; if configured that way, content may be processed remotely under Ollama's terms and policy. CourseLark does not verify local-only mode. The app asks before sending note content. For on-device processing, use a downloaded model and disable Ollama cloud features.
• Sync across devices: Off by default. If you turn it on in Settings, your CourseLark settings, appearance choices, custom CSS and saved themes are stored in your browser's own sync storage (chrome.storage.sync), which your browser provider (for Chrome, Google) syncs to other browsers signed in to the same browser account under its own terms and policy. Tasks, grades, notes, files, announcements, connected sites, calendar credentials and LMS account identifiers are not included. Turning sync off stops future updates; Erase local data also removes the synced copy.
• Custom CSS: CSS you enter in Appearance is applied to connected LMS pages. A custom tab icon given as an HTTPS image is loaded from its host. If CSS references images or fonts with url(), your browser requests them from those hosts.
• External links and images: Opening an assignment, playlist, or custom link contacts its destination. Choosing Play here for a saved playlist loads that provider's embedded player (Spotify, YouTube through youtube-nocookie.com, or Apple Music), which receives ordinary request information and may use its own cookies. A custom course image URL may cause your browser to request that image from its host, which can receive ordinary request information such as your IP address.
• Notifications: Assignment reminders are off by default for new installations; if enabled, browser or operating-system notifications may show assignment titles. Existing installations keep their current reminder choice until changed in Settings. Completing a focus session may show a separate notification.

The extension does not sell, rent, or share data with advertisers or data brokers. It uses data only for the features described here. Its use of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including Limited Use.

Retention, choice, and security

Records remain in your browser profile until you delete them, clear browser storage, or uninstall the extension. Restoring a backup replaces dashboard records and removes attachment blobs no longer referenced by the restored notebooks. Backups exclude attachment blobs; references to unavailable attachments are removed during import. You can use Erase local data in Settings to delete this app's records and attachments from the current browser origin. Disconnecting an LMS origin revokes future access but does not delete previously imported data. Export attached files separately from each notebook. If you used the standalone dashboard in a separate browser origin, clear its storage separately. Exported copies and information sent to outside services are not deleted by these actions.

Local data security depends on your device and browser profile. Someone with access to an unlocked profile or exported backup may be able to read it. LMS access is limited to origins you approve through browser permission prompts; Canvas import uses the site's HTTPS connection and your signed-in session. The optional companion listens on the loopback address; do not expose it to a public network. AI and local transcription requests require a pairing code shown in the companion terminal. The code is stored in this browser profile separately from dashboard records, excluded from JSON backups, and removed by Erase local data. Anyone who obtains the code while the companion runs can use its local processing endpoints. No storage or transmission system is perfectly secure.

Children, changes, and contact

CourseLark is intended for schoolwork, including K–12 use. It has no built-in age verification or parent/school authorization workflow. Accepting the Terms does not provide parental consent. Families and schools should review optional browser speech, AI, external images, calendar links, and public support channels before a child uses them. The operator is reviewing additional requirements for younger users; this policy does not assert that a school has authorized the extension. Material policy changes will be published here with an updated date before or with the relevant extension update.

If you email support, the operator receives your address, message, and any files you choose to send. Public GitHub issues expose their content to others. Do not send passwords, full backups, student records, or recordings through public issues. Support email and issue content are stored in those services until manually deleted; there is no automatic deletion schedule. Contact ntfishman@gmail.com to request deletion of information you voluntarily sent. The operator does not otherwise receive your locally stored extension records. Access and deletion of those records normally happen through the extension and browser profile.

The public copy of this policy is hosted on GitHub Pages, which may process routine web requests and logs under GitHub's Privacy Statement. The copy bundled in the extension opens locally. Neither copy includes analytics or advertising code.