Privacy Policy

1. The short version

Course++ is a browser extension that helps an instructor build course content inside Canvas.

• We do not read student records. Grades, rosters, submissions and discussion replies are refused before a request is ever built. Section 4 explains how.
• Course content you are working on is sent to an AI model in order to do what you asked. It is not used to train anything. We do not store it, except when you press "Get help with this" after Course++ couldn't finish something: then the one message you asked it in is sent to us (section 6). That copy is kept 90 days, with email addresses, phone numbers and ID numbers stripped first (names in ordinary sentences can't always be recognised — see section 6).
• It can send a Canvas message for you, but it never reads your inbox. When you ask, it can message a whole class or one group in it, after showing you the exact message. Section 4 explains.
• We keep very little. Your email address, your plan and balance, and a record of what each request cost. Section 3 is the complete list.
• We never sell your data, and we show no ads. We email you our own help on how to use Course++ and promotions only if you say yes to "Email me help on how to use and promotions". For a new account the box can start ticked; untick it and we won't send them. You can stop them any time with one click. Section 9a explains.

2. Who we are, and who this covers

CoursePlusPlus LLC is a single-member limited liability company in Washington County, Utah.

Course++ is sold to individual instructors for their own use. We do not sell to schools, districts or institutions, and we do not enter into agreements with them. If you are using Course++, our relationship is with you personally, not with your employer.

Course++ is for instructors and instructional staff. It is not for students.

3. What we collect

This is the complete list. If something is not here, we do not have it.

Backups. Our database is backed up every night, and each backup is normally deleted after 35 days (if backups stop working, the last few good ones are kept until new ones replace them). So when this page says something is deleted, a copy of it can normally remain in a backup for up to 35 more days, and then it is gone too. Error reports are never put in a backup.

Visits to our website

Our website, courseplusplus.com, uses Cloudflare Web Analytics to count visits to its pages. It sets no cookies, stores nothing in your browser, and does not follow you from one website to another. For each page you open there, it records the page's address (not anything after a ? in it), the website that linked you to it, your country, your browser, operating system and kind of device (computer, phone or tablet), and performance timings such as how quickly the page loaded. We see these as counts — for example, how many visits a page had and from which countries — not as a record of any one person, and they are not tied to a Course++ account. This runs on our website only, not in the Course++ extension or in Canvas. Cloudflare runs it for us (section 7).

What we deliberately do not collect

• Your Canvas password or API token. Course++ works through the Canvas session already open in your browser. We never see a credential.
• Your course content. It passes through our server to reach the AI model and is not written to any database, log or file of ours — except what you typed into a request you choose to send us with "Get help with this", or, from an older version of the extension, where Course++'s replies quote it in a conversation you sent to support (section 6). Either way, email addresses, phone numbers and ID numbers are stripped first (names in ordinary sentences can't always be recognised — see section 6).
• Your conversations with Course++, except the one message you choose to send us with "Get help with this", or a conversation you sent from an older version (section 6).
• Anything for ads, ad targeting, profiling, or sale. We do none of those things. Apart from an invite you ask us to send a colleague, our own emails to people who said yes (section 9a) are the only promotional email we send.

4. Student data

Course++ cannot read student records.

This is not a policy we promise to follow. It is how the software is built: a list of blocked Canvas addresses is checked before a request is constructed, so the request is never made. It covers grades, rosters, enrolments, submissions, quiz responses, discussion replies, analytics, and your Canvas inbox — 63 address patterns. Reading any of them is refused every time, and no setting in the product switches this off.

We intend to publish the list of blocked addresses, and the tests that check each refusal, at a public address. They are not public yet; we will update this section when they are.

Sending a Canvas message

Course++ can send a new Canvas message when you ask it to — to a whole class, or to one group in it (its students, teachers, TAs or observers). Before anything is sent, it shows you who the message goes to and the exact text, and nothing is sent until you confirm. It names the group by the course, so Canvas works out who is in it and Course++ never sees the list. It cannot message one named person, and it never reads your inbox or the replies people send back.

What Course++ does read

Content you as the instructor create and manage: pages, assignments, quizzes, modules, discussion topics (not the replies), files, the syllabus, and course settings.

One honest limit — files you attach yourself

Course++ lets you attach a file to a message, so it can build from your own material. Whatever you attach is sent to the AI model, the same as anything you type. The address blocking described above protects what Course++ fetches from Canvas; it cannot inspect a file you hand it.

We say so at the moment you attach something, and we repeat it here: do not attach student work, grades or rosters.

On FERPA

Course++ is designed to help you stay FERPA compliant. FERPA's obligations sit with schools, and Course++ is built to help schools and their teachers meet them. There is no official FERPA certification for software, so we do not claim one. What we can tell you is what the software does and does not touch, which is what this section is for.

The software's part: Course++ is built to refuse requests for student work, grades and rosters, before they are sent, as described above.

Your part: the text of every request you type goes to the AI provider to be processed, and it is sent as you wrote it. The personal-data filter (§5) runs on what Course++ reads from Canvas, not on what you type. So please do not type student names or other details about a student into a request, any more than you would attach them. And follow your school's own policies on AI tools; we cannot know what your school allows.

5. What is sent to the AI model, and what happens to it

To do what you ask, Course++ sends the AI model your instruction, the relevant course content, and the conversation so far.

Before anything is sent, we strip out personal data that can appear in ordinary course content — email addresses, phone numbers, login and student ID numbers, names attached to user records, profile photos and pronouns. This runs on everything Course++ reads, every time, and nothing in the product can switch it off.

It is a pattern-based filter, not a perfect one. It cannot recognise a person's name written in an ordinary sentence.

The model we use

Course++ offers three models, by tier — you pick one in Settings, or Course++ picks a sensible default. All three are reached through OpenRouter, which never runs a model itself; it forwards your request to whichever company's servers actually have that model running.

Pictures. When Course++ makes an image (because you asked, or because it judged one would help), it uses Gemini 3.1 Flash Lite Image or Gemini 3 Pro Image (by Google), on Google Cloud Vertex AI, through OpenRouter in the same way.

The Quick tier names three possible companies, not one, because OpenRouter genuinely can route to any of them turn to turn — we verified this directly rather than guess at just the one we happened to see most recently. The full list of who does what with your data, in their own published words, is in section 7.

⚠ As of October 18, 2026, the Standard tier's own retention guarantee is narrower than it used to be. OpenRouter told us on 2026-09-19 that it is dropping Zero Data Retention eligibility for Google-authored models — which includes Gemini 3.5 Flash Lite, the Standard tier's model — because Google's own automated safety systems may retain a request their classifiers flag as a possible policy violation, for review. The two picture models above are Google's own models too, so the same applies to them. This does not affect the Quick or Thorough tiers, and it never affects whether a model is used for training (still no, every tier, always). This is a narrow, automated, flagged-content review process — not routine logging of ordinary requests. If an absolute no-retention guarantee matters to you, pick Thorough in Settings, and tell Course++ not to make pictures or search the web — it can do either on its own when it judges it would help, and neither is covered by that guarantee.

⚠ What we cannot promise: we cannot guarantee that processing happens inside the United States. Region-pinned routing is not available on our plan. If that matters to you, do not use Course++ with anything you would not want processed abroad.

Web search

When Course++ searches the web (because you asked, or because it judged a search would help), its search query goes through OpenRouter to Exa (Exa Labs, Inc.), the search company OpenRouter uses for the model that runs our searches. The no-retention arrangement above does not cover this path — it applies to the AI model, not to search. The query is written by the AI model and is meant to be a short, topical search. Nothing checks it separately for course content, so do not ask Course++ to search for anything sensitive — and you can tell it not to search at all.

You are talking to an AI

Course++ is an AI tool. Everything it writes is generated by an AI model, not by a person.

We say this here, and on the label "AI Assistant for Canvas", which is shown at the top of the panel whenever it is open.

AI output can be confidently wrong. It will invent a plausible fact, miscount, or misunderstand what you asked for. Course++ re-reads what it wrote and shows you what changed, which catches a good deal — but it does not catch everything, and it cannot tell you whether the content is good.

Check it before students see it. You are the author of record for your course. Course++ is a drafting tool, not a colleague you can delegate to.

It does not judge student work. Course++ builds course content. It cannot read student submissions at all — see What Course++ can and can't see.

If your institution requires AI disclosure. A growing number of institutions ask instructors to say when course material was produced with AI assistance. Course++ does not add such a note on its own. If you need one, ask Course++ to add it to what it builds, or add it yourself. Whether you need it is between you and your institution.

If anything about how Course++ uses AI is unclear, email us at [email protected] and a person will answer.

6. Error reports, and asking us for help

There are two different things here. One happens automatically and carries nothing you typed. The other happens only when you press "Get help with this".

The automatic error report — nothing you typed

When something genuinely fails — Canvas rejects a change, a reply is cut off, you run out of credits mid-build — or when Course++ refuses or cannot do what you asked, Course++ sends us a short record of what went wrong. It never contains anything you typed or anything Course++ replied.

The refusals it records are these four:

Asking us for help — "Get help with this"

When Course++ couldn't finish what you asked — a build failed, or Course++ refused or cannot do it — the panel shows a card, "Course++ couldn't finish this.", with a "Get help with this" button. The line under the button says what pressing it does: "Send this to the Course++ team and we'll work on fixing it, so it doesn't trip you up next time. Only what you asked is sent." It is never pressed for you, and there is no second confirmation step. "No thanks" closes the card: nothing is sent and nothing is remembered. (The card is not shown when you run out of credits, when your plan does not include something, or when you need to sign in again: those show their own way forward.)

Email addresses, phone numbers and ID numbers are stripped from your message before it leaves your browser, the same way they are stripped from everything else you type — and our server strips them again before it is stored. A name written in an ordinary sentence cannot be recognised, so do not ask for help with a message that has student work pasted into it.

Older versions of the extension. Before this card, the panel offered a "Send this conversation to support" button after a failed build. One press sent the last few messages of that conversation — your typed messages and Course++'s replies, up to five exchanges; Course++'s replies can quote the course content they were answering about. If you press it in a version that still has it, that is what we receive, and it is stripped, kept, read and emailed about exactly as described above. Older versions also sent the last few messages automatically with every error report. Our server now drops them from any report you did not choose to send, whichever version sent it. Any stored before that change are no longer shown for support, and are deleted on the same 90-day schedule.

6a. Detailed session diagnostics — never switched on

From 30 September 2026 this policy described a detailed session-diagnostics record: a copy of each request — what you typed, Course++'s replies, and every Canvas address it requested and what Canvas sent back — kept for 90 days to find and fix problems with Canvas.

It was never switched on in our live service, so no such record has ever been made of any customer's use of Course++. If we ever turn it on, it will be something you choose to opt in to, and we will update this policy first.

The short, content-free "How each step went" record in section 3 is separate and stays on: it holds no text at all.

7. Who else handles your data

We do not sell data to anyone, and we have never shared it for any purpose other than running the service. If a company is not in this section, it does not receive your data.

Is your personal data used to train large language models? No. Not by us, not by OpenRouter, and not by Google. (Connecticut law requires us to answer this question directly, so we have.)

The AI path, in detail

Three chat models, offered by tier, and two picture models, all reached through OpenRouter. You pick one of the three chat models in Settings (or Course++ picks a default). When Course++ makes an image (because you asked, or because it judged one would help), it uses one of the two picture models.

OpenRouter is the switchboard for all of them: it never runs a model itself, it forwards your request to whichever company's servers actually have that model running, and it enforces the same two rules on every one of those companies before it will route to them at all — see "How this is enforced" below.

Why "one of three" for the Quick tier, not one name: OpenRouter selects whichever of those three companies is available at the moment of your request, and it can genuinely differ turn to turn — confirmed directly by making the same request repeatedly and watching which one answered. All three are named here for exactly that reason: naming only the one we saw most recently would be a guess, not a disclosure.

What each company that can actually run your request says about it, in their own words:

• Google Cloud (Vertex AI) — hosts the Standard tier's own model and the two picture models (Gemini, made by Google) and the Thorough tier's model (Claude, made by Anthropic, offered through Vertex Model Garden). ⚠ As of an OpenRouter notice received 2026-09-19, this claim is no longer absolute for Google's own models — the Standard tier and the picture models; see section 5, "The model we use". It remains our understanding for the Thorough tier, where the model itself is not Google's and is not implicated by the change OpenRouter described.
• Together AI — "Under ZDR, the content you submit... and any outputs provided to you... are not stored, retained, or used for model training, product improvements, or any secondary purposes except as needed to provide the Services to you." (together.ai/privacy)
• Fireworks AI — "We do not use your prompts, training data, or API inputs to train or improve our AI models without your explicit opt-in." (fireworks.ai/privacy-policy)
• Z.AI — the maker of the GLM model; reachable as one of its own three possible hosts above.

How this is enforced, in two independent places:

1. On our account — Zero Data Retention is on, Google AI Studio endpoints are disabled so only Vertex is reachable for Google-hosted traffic, and every "allow training" option is off, including the discount that would trade your prompts for cheaper inference. ⚠ This setting no longer makes retention absolute for Google's own models (the Standard tier and the picture models) — see section 5. It still fully applies to the Thorough and Quick tiers, and it still keeps training use off for every model.
2. On every single request, for every one of the companies above — the same restrictions (data_collection: deny, and a fixed list of which companies may even be considered) are sent with the request itself, so they hold even if an account setting were ever changed. If a company cannot meet them, the request fails rather than quietly routing somewhere weaker. The fixed list is exactly four companies: Google Cloud Vertex AI, Together AI, Fireworks AI and Z.AI. data_collection: deny is a training restriction; it does not by itself require zero retention, which is the distinction section 5's note on Google's own models turns on.

What none of them get

• Your Canvas password or API token. We never see a credential.
• Your course content stored by them, except as described in section 5 for Google's own models. On our side, it passes through to reach the model and is not written to any database, log or file of ours — except what you send us with "Get help with this" (or, from an older version, a conversation you sent to support), kept 90 days with email addresses, phone numbers and ID numbers stripped first (names in ordinary sentences can't always be recognised — see section 6).
• Student records. Course++ cannot read them — see What Course++ can and can't see.

New companies

If we add a company that receives your content, we will update this section and tell you before it takes effect.

8. What stays in your browser

A good deal of what Course++ keeps is kept on your machine, not by us:

• Your conversation history, kept so you can resume a build after navigating away. (Each time you send a message, the conversation so far goes through our server to the AI model so it can answer — section 5 — but we do not store it.)
• Your revision history, which is written into a hidden folder in your own Canvas course files — not to us
• A copy of the exact text sent to the AI for your last 3 requests in each course, kept for up to 6 hours so you can open "What was sent to the AI" under a reply. It stays on your computer only. Sign out and New chat clear it.
• Your sign-in token

A note about shared computers. Some of this is stored on disk in your browser profile. If you use a shared or podium computer, tick "this is a shared computer" when you sign in, and use Sign out when you are finished.

9. Your choices and rights

You can, at any time:

• See and export your data — email us and we will send it within 30 days
• Correct it
• Delete your account — we remove your personal data (including the IP addresses kept with your consent records, your error reports, and the email addresses of colleagues you invited) and keep only: an irreversible hash of your email address, and the part after the @ on any free-credit or promo-code record, so the same person cannot claim a second free trial; if you sign up again later, a link between the new account and the earlier one; the record that you agreed to our terms; the reason you picked when you cancelled a plan (never a comment you typed); the records of the subscription notices we emailed you, which renewal laws require us to keep; the record of your choices about our emails, and, only if you are still signed up for them, your email address, until you unsubscribe (section 9a); and the transaction records tax law requires us to keep. Our nightly backups never contain error reports; other account details can normally remain in a backup for up to 35 days, until that backup is deleted
• Cancel — one click, from inside the extension or from your account page at courseplusplus.com/account, no phone call and no retention maze

Depending on where you live you may also have the right to know what we collect, to object to certain processing, to appeal a refusal, and not to be discriminated against for exercising any of this. We extend all of these rights to everyone, rather than sorting our customers by state.

To exercise any of them: email [email protected]. We respond within 30 days. If we refuse, we will tell you why and how to appeal.

We do not sell personal information, and we do not use it for targeted advertising or profiling.

9a. Emails from us

• About your account — always. Sign-in codes, receipts, renewal notices and notices of changes to our terms. You cannot turn these off while you have an account.
• Help on how to use Course++, and promotions — only if you say yes. We ask with a box, "Email me help on how to use and promotions": at sign-up, beside "I agree" when we ask you to agree to updated terms, and once, after your first build. The box can start ticked: always on the sign-in screen (we don't know who you are yet), and elsewhere only for an account created in the last 24 hours that has never chosen and is not on our do-not-email list. Everywhere else it starts unticked. A box left ticked counts as a yes only for a new account (created in the last 24 hours) that has never chosen and is not on our do-not-email list. It never overrides a no you gave before, an unsubscribe, or a do-not-email entry, and it never brings back emails for someone who left the box unticked under an earlier version of Course++. If you untick it, we record a no when you sign in, press "I agree" or "Save", or press "Not now" or close the ask in Course++ — and then we will not send them. If you leave a page without any of those, nothing is recorded, and we send nothing. You can change your mind at any time in Course++ Settings or on your account page at courseplusplus.com/account, where the setting always shows what you last chose. What they are: exactly what the box says — help on how to use Course++ (how-tos, tips and new features), and promotions for Course++ (offers, discounts and coupon codes). If you said yes to our earlier wording, "Email me teaching tips, new features and discounts", you get only emails that fit those words.
• Stopping them. Untick the setting in Course++ Settings or on your account page, or use the unsubscribe link in any of these emails, and they stop. Turning the setting on yourself, signed in, also takes your own address off our do-not-email list if you had unsubscribed (from these emails or from an invite) — unless the address bounced or reported us as spam; then we tell you, and [email protected] can help. A box left ticked never does that. (In an older version of Course++ whose box started unticked, ticking it yourself did the same as turning the setting on.)
• Every one of those emails has an unsubscribe link. One click, no sign-in. We stop straight away. Replying "unsubscribe" or writing to [email protected] works too, and we act on that within 10 business days.
• If you delete your account while still signed up for them, we keep your email address, for these emails only, until you unsubscribe. Unsubscribing then takes it off our mailing list; the address stays only on our do-not-email list (section 3), so it is never emailed again. If you are not signed up when you delete your account, we keep nothing new.
• We never sell, rent or share this list. It is sent through Resend (section 7), and no one else gets it.

10. Security

• Everything travels over HTTPS.
• Credentials live in encrypted secret storage, never in our source code.
• Our administrative console is behind Cloudflare Access and requires a second factor.
• Databases are backed up nightly, each backup is normally deleted after 35 days, and access is limited to the owner.

We are a one-person company. We do not hold a SOC 2 report and we are not going to claim security practices we do not have. What we do have is a product that holds very little worth stealing — no course content, no student records, and no card numbers.

If you find a security problem, please tell us: [email protected].

11. Children

Course++ is for instructors aged 18 or over. It is not directed to children, and students do not use it. We do not knowingly collect personal information from anyone under 18. If you believe we have, email us and we will delete it.

12. Where we operate

Course++ is offered in the United States. We do not market it elsewhere, and our terms restrict use to the United States.

13. Changes

If we change this policy in a way that materially affects you, we will tell you by email and in the product before it takes effect, and record the version you agreed to.

Every version is kept, with its date, so you can see what changed.

14. Contact

CoursePlusPlus LLC

[email protected]

Course++ is not affiliated with, endorsed by, or sponsored by Instructure, Inc. Canvas is a trademark of Instructure, Inc.

15. Google sign-in and Limited Use

Until 27 October 2026 this section was a separate page, Limited Use of Google user data.

Course++'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Course++'s use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

What Google data Course++ actually receives

Sign-in only. If you choose "Sign in with Google," Course++ requests these scopes and no others:

That is the complete list.

What Course++ does not request

Stated explicitly, because it is the part worth knowing:

• No Google Drive access. Course++ cannot read, write or list your Drive files.
• No Google Classroom access. Course++ does not connect to Classroom at all.
• No Gmail access. Course++ cannot read or send mail from your account.
• No Google Calendar access.
• No Google Docs, Sheets or Slides access.
• No Google Workspace admin scopes of any kind.

Course++ works with Canvas, not with Google Workspace. Google's role here is to sign you in — the same role a one-time emailed code plays if you would rather not use Google at all.

What we do with it

Google user data is never sent to an AI model. Your name and email address are account data. They are not part of the request Course++ sends to the writing engine.

Deleting it

Delete your account and the Google account identifier, email address and name go with it — except that, if you are still signed up for our help and promotion emails, your email address is kept for those emails alone until you unsubscribe. See section 9 — including the one thing that survives deletion, a one-way hash used to keep the free credit grant to one per person, and why.

You can also revoke Course++'s access to your Google account from your Google account settings at any time. If you do, you will not be able to sign in with Google, but your Course++ account and your credits are unaffected — email us at [email protected] and we will move you to another sign-in method.