What leaves your device, and when.
Scholarwire stores your Canvas data, notes and study history on this device: in this browser profile's storage and in the Scholarwire extension. Every account signs in once, with Google or an email link. On Pro and the trial, an encrypted copy then syncs to our server so the same semester opens on your other devices.
Signing in is required. Notes and study material are encrypted on your device before they leave it. Canvas data the extension sends in the background is encrypted on our server as it arrives. We hold the key.
Everything, by default.
It is stored unencrypted on this device, like any website's local data. Anyone who can use this computer account can read it, so use a personal browser profile and turn on disk encryption if you share a machine. Delete everything on this device in Settings, App and data, Start over removes both copies on this device, the browser one and the extension one; it never touches a synced copy on the server, which has its own delete in Settings, Account (below). Uninstalling the extension and clearing site data for this origin does the same local wipe by hand. An export contains everything, including grades, so treat the file the way you would treat a transcript.
How the extension reads your school.
Scholarwire for Canvas installs with access to no school website. You grant it your school's Canvas address from the extension popup, together with the three hosts Canvas stores course files on (*.inscloudgate.net, *.canvas-user-content.com and *.s3.amazonaws.com), in one Chrome prompt. Disconnect and clear data, in the popup, gives all four back. It then calls the Canvas API with the session cookie your browser already holds, exactly as the page you are looking at does. We never see your Canvas password, we hold no Canvas token, and there is no integration for us or your school to revoke, because there is no integration. The extension's content script, which is how the app and the extension exchange messages, runs only on scholarwire.app, on your own machine.
On Pro and during the trial, the extension also sends each Canvas sync it runs (every 30 minutes while your browser is open, and whenever you press Sync now) to Scholarwire over HTTPS, using the Scholarwire sign-in your browser already has, so your phone and the connector see it with no Scholarwire tab open. It sends the same Canvas data the app would sync: your Canvas name, courses, assignments, grades, announcements, modules, the file list and calendar items, never a file's contents. Our server encrypts it with your account's key as it arrives and stores it as your synced Canvas data. Nothing is sent on Free or while you are signed out, and Keep my account up to date in the background, in the extension popup and in Settings, Canvas, turns it off.
On Pro and during the trial, while Scholarwire is open in a tab, the app also reads your course material in the background, one item at a time: the Canvas pages listed in your modules and your readable course files (PDF, Word, PowerPoint, text, Markdown and HTML, under 15 MB, never a file Canvas has locked). Their text is kept on this device and, encrypted, with your account, like your notes. Course materials, in Settings, Canvas, turns this off and deletes the text already read. Otherwise a course file is read only when you choose it in the app, one at a time.
What Canvas records is what it always records: that your account read your own assignments page. Your school does not receive a notice, a report, or a list of what you looked at in this app.
AI features.
When you use an AI feature, the text or file you chose is sent to the model provider and handled under that provider's API data retention policy. When you ask the Tutor a question, it can also search your notes and send the ones it needs to answer, and the chat lists each note it read. It can also read a course syllabus and the text of course readings already stored on your device, send the part it needs, and list each one it read. Every Tutor message also carries a short summary of your courses, due work and announcement titles. Nothing else is sent in the background, and no AI feature runs unless you click it. If you switch AI off in Settings, every AI surface in the app disappears.
On our servers, through your account. Signing in is the whole setup, and a free account gets credits each month.
A count of the credits and tokens you have spent each month, so the number in Settings is right. The counts are kept while your account exists and deleted with it. We do not keep the text you sent or the answer that came back.
Signing in and sync.
Sign in on Pro or the trial, and every device you sign in on syncs automatically: your notes, decks, quizzes, study plan and settings, not just your account. No separate step to turn it on.
Your notes and study material are encrypted before they leave your device, with a key kept with your account so any device you sign in on can open them. Keeping that key means we could open them. Nobody here does. Only the app itself can use the keys, and every use is written down. Canvas data the extension sends in the background (above) is encrypted by our server with the same key as it arrives, rather than on your device.
What we store is encrypted. Opening it needs the key, and only the app itself can use the key, never a person reading a database.
Sync is part of Pro and your 14-day trial. On Free it pauses: nothing is deleted, and every device keeps what it already has until you upgrade.
Calendar sync.
Calendar sync is off until you turn it on. When it is on, only calendar items are published to a private link: each item's title, date, time, course, location, description and Canvas link. Turning it off deletes them from the server.
It exists because Google Calendar, Apple Calendar and Outlook have to be able to fetch a file over the internet to subscribe to it. The secret in the URL is the only credential, so treat the link the way you would treat a password and turn sync off and on again to issue a new one if you ever share it by accident. It carries only the layers you ticked. It never carries grades, notes, submissions or flashcards. An item you add yourself publishes its title, date, time, course and place, but never its notes.
Accounts and billing.
Every account signs in before using Scholarwire, with Google first or a link sent to your email. An account stores identity and subscription state: an email address, a sign-in credential, your plan, your AI credits, and whether the subscription is active. Your Canvas data, notes and study material live on your device. On Pro and the trial, signing in also starts sync (above), and an encrypted copy is kept in your account, never only on our server. On Free, sync pauses and everything stays on the device.
Card details go to the payment processor and never reach us. Deleting an account removes the identity and subscription record and the encrypted synced copy and its key. It does not touch the data already on your devices, because we cannot reach it.
Claude and ChatGPT.
When you connect Scholarwire to Claude or ChatGPT, our server decrypts your synced records to answer that assistant's questions. It does this only while answering a request you made, only for the account that connected, and it logs the call.
Courses, due dates, announcement excerpts, your notes (it can search all of them for a word), your synced syllabus and assignment readings, and, only if you turn it on per connection, your course-level grade standing. Never a Canvas link, a file's raw bytes, or a per-assignment score.
Settings, Connectors, Disconnect. That stops the connection immediately and does not touch anything already synced to your other devices.
Your syllabus, assignment details, the Canvas pages listed in your modules and the text of your readable course files are stored the same way as your notes: encrypted in the synced copy, and decrypted for the connector only to answer a request you made, like every other record here. Settings, Canvas has a switch for course material syncing. Turning it off stops new material from being read and deletes the text already stored; the rest of your semester is untouched.
Google Drive.
Import one Drive file at a time. You choose the file in Google Drive, and this browser downloads it straight from Google. It never passes through our servers, and Google's permission covers only the files you chose: the rest of your Drive stays invisible to Scholarwire, and nothing is written back to it.
What lands in the note is stored the way every other note is: on your device, and encrypted in your synced copy. The permission itself is held in the tab for the length of the import and is never saved.
The short list.
We use Google Analytics to see how the public site and sign-up are doing: page views, where a visit came from, whether an extension install finished, and whether a checkout started or failed. On the public pages it keeps Google's first-party analytics cookie, so a return visit counts once. Inside the app it stores nothing on your device and sends counts only, never what you study. Google's advertising features and signals are off everywhere, and visitors in the EEA, the UK and Switzerland are counted without cookies on every page. Automated traffic is filtered out before anything is counted. To opt out, block googletagmanager.com in your browser or install Google's opt-out add-on.
Record lecture turns speech into text with your browser's own speech recognition. In Chrome that streams the audio to Google while you record. It never passes through our servers, and nothing is recorded until you press the button.
Our use and transfer of information received through Scholarwire for Canvas adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
What you can do at any time.
Export
One file with everything, in a readable format, not gated behind a paid plan.
Delete
Delete everything on this device clears the browser copy and the extension copy in one action. Settings, Account has Delete my synced data and Delete account for the server copy.
Disconnect
Revoke the site grant in Chrome and the extension can no longer read Canvas.
Who this is for.
Scholarwire is built for college students and is not directed at children under 13. We do not knowingly create accounts for them.
What we keep, and for how long.
We use the usage counts to show your balance, apply the daily Tutor limit and choose which account emails to send you. Deleting your account removes the identity and subscription record, the encrypted synced copy and its key, the AI credit and usage counts (monthly credits and tokens, and the daily Tutor message count), and any calendar feed. Measurements already taken are cut loose from your account and removed once they are 90 days old. A newsletter address stays on our list only so it is never emailed again. Payment records are kept by the payment processor for as long as its own tax and accounting rules require, which is the one part of this we cannot shorten.
Questions, requests and reports.
For a question about this page, a copy of what we hold, or a deletion you cannot do yourself because you have lost access to the app, start at the support page. You can also write to support@scholarwire.app. Write from the email address the account signs in with. Everything else, including export and delete, is a button in Settings and needs no request.
Security problems go to the same place unless a separate address is published here.
If this page changes.
Any change that would move data off your device gets stated in the app, in one plain sentence, at the place where it happens, before it happens. That rule is in the product specification, not just here.
Last updated