Privacy Policy

Effective September 30, 2026; updated October 8, 2026 (class chat, direct messages, and calendar items from the tutor). Homework Hatch is run by Homework Hatch L.L.C., a Maryland limited liability company ("we"). Questions or requests: sphwbuddy@gmail.com.

Homework Hatch is a study tool you choose to use with your own accounts. It isn't provided by or for your school, and we don't share your data with your school, teachers or parents.

What we collect

  • Your account: email, username, display name, a hash of your password (never the password itself), time zone, birth year, and an optional grade or year. We also ask your birth month to check your age; we don't store it.
  • From your Canvas, through the extension: while you're signed in to Canvas in Chrome, the extension reads every class you're actively enrolled in and sends us:
    • your Canvas name and user ID;
    • class names and terms;
    • assignments: descriptions, due dates, points, your submission status, scores and grades, any late-penalty points and late or missing status your teacher set, rubrics, comments on your work (with the commenter's name) and rubric feedback, and the names of files you turned in;
    • assignment groups and weights;
    • modules, pages and the syllabus;
    • announcements, with the poster's name;
    • the titles and dates of discussion topics and quizzes;
    • calendar events, your Canvas to-do list and your missing-work list;
    • the list of each class's files (names, types and sizes).
    This content can include other people's names and words, like an instructor's comment or announcement. We don't collect class rosters, the text of discussion posts, or the signed download links Canvas uses for files.
  • Calendar links from other school systems, only if you add one: if your school uses Brightspace, Blackboard, Moodle or Schoology, you can paste your personal calendar link. Our server fetches it about once an hour and keeps the due dates and events in it (titles, dates, class names, links) the same way it keeps synced Canvas assignments. The link itself works like a password to your calendar, so we store it encrypted and never show it again. Remove it on the Connect page and we delete it and everything that came from it.
  • A Brightspace check, only if you run it and click Send: on a D2L Brightspace page, which we can't sync yet, the extension can run a check to help us add Brightspace. The report records your school's Brightspace address, the extension version, which Brightspace features answered (how fast, how many items), and the names and types of their fields. It contains no names, grades, course titles or course content, and our server drops anything else. You see the whole report before sending it.
  • Course files, only for classes you choose: for each class you tick under "Which classes' files should we keep?" (or every class, if you choose that), the extension uploads that class's files (slides, readings, handouts) so you can open and study from them here. We skip audio and video. We extract the files' text so search, the tutor and study-set tools can use it. Untick a class, including a past one, and we delete the copies we stored.
  • What you make and add: flashcards, quizzes, summaries, tutor conversations and the files you attach to them, files you upload or pick from Google Drive, calendar items you add (from the tutor's suggestions or by hand) and the items the tutor suggested, class chat messages, your direct messages with classmates (and who you blocked), whether you take message requests, when you agreed to the chat rules, and live-quiz nicknames, answers and scores.
  • Sharing, if you use it: which of your sets you share and how (by link or with your class); when you save someone's shared set, which set your copy came from (so we can remove it if that set is taken down; the person who shared it sees only a count); and reports: when you report a set we keep the reason, what you wrote, a copy of what the set showed at that moment, and your account; when your set is reported we keep the report and any strike against your account.
  • Study plans: the tests you plan for (taken from your synced assignments and calendar, or added by hand), your answers to "is this a test?", the study sessions we schedule and the minutes you log, practice-test scores, and what you write on a session's blank page. We work out which items are tests from your own synced data, without AI. The tutor does see your upcoming tests and planned study sessions with each question, so it can plan around them (see AI features below).
  • Brain Grade: on a class's Grades tab and your dashboard, we split your grade into tests and everything else and estimate what missing and late work cost you, from the grades above and your "is this a test?" answers, each time you open the page. The results aren't stored, and nothing is sent to an AI. If you make a share image, it's drawn on your own device and never uploaded; it shows no class, school or teacher.
  • Google, if you connect it: we connect through Composio, which holds your Google sign-in for us. Composio passes the calendar events and Drive files involved between Google and us. For Google Calendar, we create, update and delete the due-date events we add. For Google Drive, we search your Drive when you look for a file and download only the files you pick. You can also remove access at myaccount.google.com/permissions.
  • Payments, when paid plans are offered: Stripe collects your card details; we never see them. We keep your plan, its dates, and Stripe's customer and subscription IDs, and share your email with Stripe for receipts.
  • Usage and technical data: sync history, sign-in events (failed sign-ins record the IP address, to stop password guessing), how many AI actions you use and what they cost, and the standard request logs kept by our host (which include IP addresses). We use cookies only to keep you signed in, protect forms, remember your seat in a live quiz, and bring you back to a shared set after you sign up. No advertising or cross-site tracking cookies.

How we use it

To run Homework Hatch for you: showing your coursework, grades and calendar, storing the files you chose, generating study materials, answering tutor questions, and keeping the service secure. Buddy Coins are partly earned from your synced submissions and grades. We don't sell your data, show ads, or use it to train AI models.

AI features. When you use the tutor, generate a study set or summary, or have us read a scanned PDF, the material involved and your question are sent to Anthropic (Claude) to produce the answer. A set you make from a description sends that description and the grade or year on your profile. So the tutor can plan with real dates, each tutor question also includes the current date and your time zone, your class names, what's due in the next three weeks, the tests you're planning for, and what's on your Homework Hatch calendar for the next two weeks (including your planned study sessions and which items you've marked done). Dates it suggests are added to your calendar only when you choose to add them. Anthropic doesn't train its models on this content under its commercial terms, and keeps it only for a limited time under its own policies. AI answers can be wrong; check them against your materials.

Who can see what

  • Your synced data, files and study materials are private to your account unless you share a flashcard deck or quiz. Your synced Canvas data and files are never shared.
  • Sets you share (opt-in): anyone with the link sees the set's title, the description you wrote, and the cards or questions that passed our checks (signed-out visitors see only the first few; quiz answers aren't shown on the page, but signed-in users who save a quiz get all of it, answers included). If you share with your class, other Homework Hatch users who synced the same Canvas class also see it listed on that class's page. Your name and account are never shown with a shared set. People who save a copy keep it in their account; you see only how many people saved one. When you share, edit or host a set live, we hold back cards the AI wrote from your class files or uploads and cards you saved from someone else (until you rewrite them), and anything that copies the class materials you've synced to Homework Hatch word for word. That check can't catch everything, so share only your own work. Pages for shared sets ask search engines not to index them.
  • Class chat: each of your Canvas classes has a room shared with the other students who synced the same class (same school, same course) to Homework Hatch. To join a room, the extension sends a scrambled (hashed) form of the course's private Canvas ID, which Canvas shows only to people in the course, so a made-up sync can't guess its way in (we can't fully confirm enrollment beyond that); the name you give a class here doesn't matter. Everyone in the room can read it; when you post, they see your display name and message. Teachers, TAs and others whose Canvas role isn't "student", classes from calendar links, and classes you hide aren't in rooms. We block common forms of phone numbers, emails, social handles and invite links in rooms. You can mute a room, and you don't see room messages from people you blocked.
  • Direct messages: only the two people in a conversation see it. You can be messaged only by a classmate who saw something you posted in a class room, first as a request you accept, decline or block (you can unblock later). Messages stay between people in the same age group, based on the birth date you gave at sign-up, which can't be changed afterward: adults and students under 18 can't message each other (if your birth date doesn't show whether you're 18 yet, direct messages stay off until it does; accounts missing a birth month can add it once), and we block common forms of contact details in conversations with anyone under 18. New accounts can send requests after their first day. If you report a message, we copy it, up to five messages either side of it (including ones since deleted, from both of you), and the sender's username and age group for our moderators, and keep that copy even if either of you deletes the messages or your account. Moderators see nothing else of anyone's direct messages.
  • Leaderboard (opt-in): shows your display name and coins only if you turn it on in your profile.
  • Live quizzes: signed-in players who join with your code see the quiz you host. Players in a game see each other's nicknames and scores. Quizzes our AI made from your course files or uploads can't be hosted, nor can quizzes with questions copied word for word from your class materials, and the Terms forbid hosting course materials. A game made from your flashcards uses only your own cards and cards you saved from someone's shared set, never the AI's wording of your class files or anything copied word for word from your class materials. Sets taken down or waiting for review after a report, and copies and games that came from them, can't be hosted.
  • Your calendar feed link: anyone who has it can see your class and assignment names, due dates and statuses, your Canvas calendar events (titles, times and locations), and the calendar items you added (titles, times, classes and notes). Keep it private; you can reset it on the Calendar page.
  • Our service providers, only to run the service:
    • Render: hosting and logs;
    • Supabase: database and file storage;
    • Anthropic: AI;
    • Composio and Google: only if you connect Google;
    • Stripe: payments, when offered;
    • Google Fonts and Cloudflare's cdnjs: fonts and math-rendering scripts, which receive your IP address when pages load.
    These companies are based in the United States; some may process data in other countries.
  • Us: we can technically access stored data. We only do so to operate the service, fix a problem you report, keep it secure, or when the law requires it.
  • The law: we disclose data if legally required, for example by a valid subpoena.

How long we keep it

Until you delete it or your account. Stored files stay until you untick their class or delete your account, including files your instructor later removes from Canvas. Chat and direct messages you delete are hidden from everyone at once and erased when your account is deleted. Deleting your account also deletes your conversations, including the other person's copy, except the copies kept with reports made in those conversations (including your own messages near a reported one, if you filed the report), which we keep as the record of those reports. Copies other people saved from a set you shared stay in their accounts after you stop sharing or delete yours, unless we take the set down after a report, which deletes those copies too. A set with a report we haven't reviewed can't be deleted until we do, unless you delete your whole account. Reports are deleted with the reported set; if the person who reported it deletes their account, the report stays without their name. Our providers may keep backups for a short period after deletion.

Your choices

  • Export: Settings → Your data downloads your profile, classes (including past ones) and assignments, study sets, quizzes, study plans and sessions, tutor chats (with the calendar items the tutor suggested), your calendar items, chat messages, the direct messages you sent, and coin history. You can download your stored files from each class's Files page, or all at once with the extension's "Download files" button.
  • Delete your account: Settings → Your data deletes your account and everything we store for it: synced data, stored files, study materials, tutor, chat and direct messages, and live-quiz entries. It also disconnects Google. Three things stay: Stripe's own payment records, events already added to your Google Calendar, and copies kept with reports about direct messages (see How long we keep it). To remove upcoming events, turn off Calendar sync before deleting; events for past due dates stay in your calendar.
  • Stop syncing: revoke the extension's token on Account → School links, or remove the extension.
  • Anything else: ask us at sphwbuddy@gmail.com to see, correct or delete your data.

Age

You must be 13 or older to use Homework Hatch. If you're under 18, a parent or guardian must agree to the Terms and this policy. If we learn we have data from a child under 13, we delete it.

Security

Connections use HTTPS, and our server checks that it's really talking to our database before sending anything.

On top of our providers' disk encryption, we encrypt the following ourselves (AES-256), with keys kept apart from the data:

  • your coursework content, grades and feedback;
  • your course files and uploads, and the text extracted from them;
  • your flashcards, quizzes, summaries and practice-test answers;
  • what you write in study sessions and the notes on your study plans;
  • the titles and notes of calendar items you add, and the items the tutor suggests;
  • your tutor, chat and direct messages;
  • your Canvas name, your calendar link, and calendar links you add from other school systems.

Files are encrypted by our server before they're stored, and decrypted only when you open them.

What this doesn't cover:

  • Account details (email, username, display name) and the names and dates of your classes and assignments have only the providers' encryption.
  • Our servers decrypt data to show it to you and to send it to our AI provider, so this protects a leaked copy of our database or file storage, not a compromise of our servers.
  • The extension also keeps a copy of your latest sync in your browser on your device.

Passwords and sync tokens are stored as hashes. Details are in our public security notes. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Do Not Track and changes

We don't track you across other sites, so browser Do Not Track signals don't change anything here. If we change this policy in a way that matters, we'll post the new version with a new effective date and tell signed-in users.

Canvas is a trademark of Instructure, Inc. Homework Hatch is an independent product of Homework Hatch L.L.C. and is not affiliated with, endorsed by, or sponsored by Instructure or any school or university.