What we do with your data.

Your study sessions, sleep records, screen time and grades are encrypted on your own device before they are transmitted to us. The encryption key is derived from your password, and your password never leaves your browser.

This is a property of the system rather than a policy commitment. We hold encrypted data and possess no means of decrypting it.

This is verifiable. If you forget your password, your data becomes unreadable to you and to us alike. Were we able to recover it on your behalf, this statement would be false.

For that reason, a recovery key is issued when you set your password. It is a 25 character code, generated in your browser, displayed once, and never transmitted to us. It unlocks a second copy of the same encryption key. If you forget your password, that code is the only way to regain access, and if you lose the code as well, no party can restore your data, because we never held either credential. You may issue a replacement key at any time from Settings, which invalidates the previous one.

One qualification applies if you sign in to Home Access Center using your password rather than the browser extension. Data already stored remains unreadable to us, but we would retain the ability to retrieve a fresh copy of your gradebook, because signing in to Home Access Center does not require your Insight password. This is described in full below, and disconnecting the integration ends it.

The following are visible to us:

• That your account exists, and your email address
• The campus and grade level you selected
• Your date of birth
• How many entries you have created and when, but not their contents
• Which assignments you have marked as complete and when, but not what those assignments are

The last of these exists so that evening reminders do not list work you have already finished.

There are three exceptions, described in full below.

Canvas. If you connect Canvas, we store your Canvas access token in a form our server can read, because our server must call Canvas on your behalf. Disconnecting Canvas deletes it.

Home Access Center. Retrieving your official grades requires your Home Access Center username and password so that we can sign in on your behalf. A second method previously existed, in which the browser extension read Home Access Center using your existing browser session and never saw a password. That method was more protective of your privacy, but it functioned only on desktop computers, and it has been withdrawn.

Consequently, if you connect Home Access Center, we store that password in a form our server can read, which means we are able to access your gradebook. This is the only component of Insight for which that is true. Your study sessions, sleep records and all other entries remain encrypted under a key we do not hold; your Home Access Center gradebook does not.

The password is used solely to sign in, retrieve the classwork page, and pass it to your browser, which parses and encrypts it before anything is stored. It is never included in a web address and never written to a log or error message. Nothing is saved unless the sign in succeeds, and disconnecting deletes the stored credential entirely.

If your Home Access Center password is also your school email password, as is frequently the case, we recommend changing one of them before using this feature.

The browser extension and desktop applications. None of these can encrypt data, because encryption requires your password and we do not supply it to them. This is deliberate: software running continuously on your computer is not an appropriate place to hold that key. While a session is active, they therefore transmit website and application names in readable form, and these are held in a staging area our server can read until you next open Insight. At that point your browser encrypts them and the readable copy is deleted. Records that are never collected expire after six hours and are removed, both when a device next reports and once daily regardless.

In practical terms, this means that for a period of several hours we are able to see that a given website was open for a given number of minutes during a session. We cannot see what you read or watched, and we receive nothing at all from outside an active session. This is the single point at which the design does not hold, and we prefer to state it plainly.

Insight sets no advertising cookies, no analytics cookies and no tracking pixels. Every item described below is strictly necessary for the service to function, and none is optional. For that reason no consent banner is presented.

• Authentication cookies, set by Clerk, our sign in provider. These maintain your signed in session between pages. Without them, no page could identify the requesting user.
• Your encryption key, if you selected the option to stay unlocked on the device. It is held in your browser’s IndexedDB storage, never in a cookie, and never transmitted to us. A cookie is sent with every request, which is precisely why this key is not stored as one. Deselecting that option or choosing Lock this device in Settings erases it.
• A small number of preferences in local storage, recording when you last viewed your grades, which setup prompts you dismissed, and when Canvas last synchronised. These remain on the device that wrote them and are not readable by us.

Clearing your browser data removes all of the above. You will be signed out and asked for your Insight password again. No data is lost, as none of these items constitute your data.

• Your location. Selecting “Library” records the word “Library” and nothing further. No GPS data is collected at any time.
• Your browsing outside a study session. The extension records website names only while a session is running.
• The contents of your screen. The desktop application records how long an application was in the foreground, not what was displayed or typed.
• Screen time screenshots. These are processed on your device and never uploaded. Only the resulting figure is stored, after you confirm it.

Once a pattern has sufficient supporting data, Insight may send a short summary to Groq, a third party service, in order to express it as a sentence of advice.

The summary contains the validated pattern and the names and dates of upcoming assignments. It does not contain your name, email address, school, grades, sleep records or any individual session. The feature can be disabled, and it does not operate until a validated pattern exists.

Insight is available only to users aged 13 and over. We request each user’s date of birth, and it is used for no other purpose. Users under 13 cannot proceed, and no further information is collected from them.

This reflects the requirements of privacy law rather than any judgment about the user. Collecting information from a child under 13 requires verifiable parental consent, and providing that reliably is beyond what this project can undertake at present.

A parent of any student may request access to everything we hold, request its deletion, or close the account.

• Export all of your data as a file
• Delete individual entries, or your entire account
• Disconnect Canvas, disconnect Home Access Center, remove the extension, or uninstall the desktop applications, independently of one another
• Disable any category of insight you do not wish to receive

• Data is retained for as long as your account remains open
• On deletion of your account, data is erased within 30 days, and from backups within 90 days
• Dormant accounts are not deleted automatically. If you no longer wish to use Insight, please delete your account, which removes your data. We do not wish to state a retention practice we have not implemented.

Insight receives no information from Frisco ISD. Data obtained from Canvas or Home Access Center is retrieved through your own account, with your authorisation. Your school cannot access your Insight data. FERPA, which governs records held by educational institutions, does not apply, as no institution transfers records to us.

We use third party services only to operate Insight itself: hosting and database provision, authentication (Clerk), email delivery (Resend), and the recommendation service described above. None is permitted to use your data for its own purposes. We do not sell data, we do not display advertising, and we do not use your data to train artificial intelligence models.

Enquiries may be directed to kapilesh.rajaravi@gmail.com. If we make a material change to this policy, we will notify you by email before it takes effect.