Last updated: October 4, 2026
Effective date: October 4, 2026
Version: 2026-10-04 (recorded with your acceptance)
1.1 We collect information when we have a reason to do so: to provide the Extension Services, communicate with you, and keep them secure and useful. This notice explains what we collect, how we use and share it, how long we keep it, and the choices you have. Lecture Hat, Inc. ("Lecture Hat," "we," "us") provides the Lecture Hat Study Companion extension for Google Chrome (the "Extension"). "Extension Services" means the Extension and the authentication, storage, indexing, synchronization, Cactus, and Live Subtitles features it connects to. The Extension requests acceptance of its terms and the collection disclosures before the corresponding features are used; reading this notice alone is not consent.
1.2 The Extension supports study from materials you are authorized to use: organizing selected Canvas course materials in your Lecture Hat notebooks, answering contextual questions about a notebook or an explicitly shared page, and adding user-selected tab audio to Lecture Hat Live Subtitles. Information is used to provide and improve those functions, rather than to build a general browsing profile.
1.3 The Extension is not affiliated with, sponsored by, or endorsed by Instructure, Inc. or Canvas.
1.4 This Policy's collection, use, sharing, and Limited Use restrictions continue to govern information obtained through the Extension, including after it reaches your Lecture Hat account and when derived records are created. The Lecture Hat Privacy Policy supplies the account notice and other processing details; it does not expand these permissions or displace these restrictions.
2.1 The Extension is offered only to users 18 or older who can legally form a binding agreement. The Lecture Hat account age check and the handling of authentication records created before onboarding are explained in the main Minors and Age Requirement notice.
2.2 If you believe a person under 18 has used the Extension, contact us at [email protected]. We will verify the report and delete the associated information.
3.1 Information you provide or authorize includes course materials, messages, attached images, shared-page content, and audio selected for captions ("Your Content"). Canvas course materials are received from the course and account you direct the Extension to use. The Extension reads them through your existing logged-in Canvas session and transmits them to Lecture Hat for storage and indexing in your personal notebook. Your Content can include course files, syllabus and overview content, modules, assignments, announcements, pages, discussions, quizzes, calendar items, rubrics, and course media or links; surfaces that are not files become Markdown documents before upload. The Extension links a course to a notebook, creates a notebook, and imports a category only when you ask it to. After an initial choice, an opted-in background sync can repeat imports as described in Section 3.5.
3.2 When you import a discussion, the Extension reads participant identifiers and names to determine which posts are yours. Before upload it replaces other participants' author labels with role labels and may keep your own display name to label your post. It transmits the visible text of posts and replies, titles, links, and attachment names. Names or other identifying information inside that text or those items are not automatically removed; replacing an author label does not make the discussion anonymous.
3.3 If you import assignments, the resulting notebook content can include your grade and score, submission status and timestamps, instructor submission comments, attached or recorded feedback, and rubric assessments.
3.4 Canvas Inbox import is off by default. If you enable it for a course, the active and archived course-scoped Inbox conversations Canvas returns, including message and forwarded-message bodies, participant information, timestamps, and attachments, are transmitted to Lecture Hat, stored in your notebook, and indexed. Canvas Inbox message contents are sensitive personal information under California law.
3.5 File names, document titles, course and module identifiers, source links, content types, and modification times accompany the items you import. Each upload carries its Canvas file identifiers, so importing the same item twice does not create a second copy. If you enable auto-sync for a linked course, the Extension periodically checks that course and imports changes to the categories you selected.
3.6 The Extension keeps operational state locally in Chrome: the active-course list returned after you accept the current Extension terms and request your courses, the course IDs you hide or keep visible, and a rolling list of at most 300 Canvas hostname, course-ID, and last-visit timestamps that ranks Recent courses. An archived-course list is fetched only when you click Show archived courses and stays in the open panel's memory. Before syncing a linked archived course, the Extension can recheck enrollment records to confirm you still have access. The course-list, visibility, and visit-history stores are not transmitted to Lecture Hat; identifiers and metadata for items you choose to import are transmitted as described in Section 3.5.
3.7 The two Boolean controls that enable Canvas import and background auto-sync are stored with chrome.storage.sync. If Chrome Sync is enabled in your browser, Chrome copies those settings to your Google account. No other Extension data uses Chrome Sync.
3.8 The Extension reads your Canvas user ID and display name from your active Canvas session, and stores the user ID in local Extension storage with account-pairing and linked-course records to prevent cross-account imports. Canvas's user API can also return a login identifier or other profile fields; our pairing and account display use the ID and name. The Extension does not ask for your Canvas password or extract your Canvas session cookie. Canvas requests execute inside your own Canvas browser tab, and the browser sends the session credential to Canvas as usual; that credential is not sent to Lecture Hat. Identifiers included in imported material are separate from this local pairing record.
3.9 When you sign in to Lecture Hat, we process your account identifier and email address through our authentication provider, Clerk, so imported files land in the correct notebook. The Extension caches Clerk's revocable browser-session context in local Extension storage to request short-lived authentication tokens, which lets an authorized sync run without an open Lecture Hat tab. It does not receive your password.
3.10 When you use the Cactus assistant, we process the message text you send, any images you paste or attach, the notebook you select, and excerpts retrieved from it. For a personal notebook, message and response text is saved by default in your chat history with an attachment's name, type, and size; attached-image data is processed for the request and is not saved there. A class notebook can require ephemeral chats under its class privacy settings. A separate research transcript is off for personal notebooks by default; the software has an operator configuration that can enable it, subject to prior disclosure of a change. A standard class retention policy can permit storage; pilot or strict-privacy class logging requires the student's latest opt-in. The record includes message and response text, page text appended for grounding, and model identifiers. Retention does not itself authorize separate research reuse or human review: permitted use remains limited by Section 13 and the applicable content license, specific permission, and executed DPA. That record is not shown to a teacher and is not used to train a model.
3.11 Page sharing is off by default. When you click Share current page, the Extension reads the page and captures a screenshot of the visible portion of the tab into a local snapshot; that click alone transmits nothing, and navigation invalidates the snapshot. Only if you then send a message while sharing remains on do we process the page title, path-only address (query strings and fragments are omitted), visible page text, selected text, headings, image alt text, meta description, page language, and screenshot. The saved chat keeps only the page title and path.
3.12 When the Extension communicates with our servers we receive your IP address, the country or region inferred from it, browser and operating-system information conveyed by the User-Agent, request timestamps, error reports, and feature-use events. We use them to operate, secure, troubleshoot, and rate-limit the Extension Services. Our network provider, Cloudflare, processes this data on our behalf. See our Subprocessor List.
3.13 The information we receive depends on the features you use, the services you authorize, and the choices available. Background synchronization is limited to linked courses and opted-in categories; it does not authorize general browsing surveillance. A personal Canvas import uses your own institutional session at your direction and does not itself establish an institutional contract or FERPA school-official relationship.
3.14 Tab audio is optional. When you invoke the Extension on a tab, approve Chrome's optional tab-capture permission, and choose Add for an active Live Subtitles session, Chrome supplies that tab's audio stream to the Lecture Hat tab. The Extension processes the tab label and capture status to show the active source and Stop control; it does not itself record, store, or upload the audio. Lecture Hat Live Subtitles processes the stream for captions as described in Section 5.6. Stop ends the added capture.
We use information to provide the Extension Services: authenticate and pair your accounts, rank the course picker, import and synchronize selected categories, store and index content, answer contextual questions, save permitted history, speak a response through a local browser voice, and add selected tab audio to captions. We also use operational information to maintain quality, troubleshoot failures, prevent abuse, enforce applicable terms, and meet legal obligations. Separate verbatim logging follows the controls described in Section 3.10. Review of Your Content must stay within delivery and security of the requested features or be authorized by separate, specific permission, subject to the executed DPA and Section 13. A class retention setting or acceptance of this notice does not supply that separate permission or authorize a use outside the Extension's disclosed single purpose.
5.1 Imported content is stored, parsed, and indexed on infrastructure Lecture Hat operates. Entity extraction during indexing runs on AWS Bedrock.
5.2 Cactus uses AWS Bedrock for two bounded helper tasks. To choose a notebook, Bedrock can receive the current message, short excerpts from recent conversation, notebook identifiers and names, and, when page sharing is on, the shared page title, path, headings, and a bounded portion of page text. To generate a chat title, it receives a short excerpt of the first message and response. Neither includes attached-image data or the visible-page screenshot.
5.3 To generate a Cactus answer, we send your message, relevant notebook text excerpts, up to three retrieved page images from imported documents, attached images, and any current-page content or screenshot you explicitly share to Amazon Web Services (AWS Bedrock). During indexing, rendered pages from imported PDF and slide documents may be sent to AWS Bedrock to locate extracted entities when local optical character recognition does not, and rasterized pages from supported handwritten-note files are sent there for transcription. Our AI Disclosure names the models these routes use.
5.4 Read Aloud is user-invoked and local to your browser. When you click Read Aloud on an assistant response, the Extension asks browser speech on your device to speak it. The Extension does not send that response text to Lecture Hat or to a text-to-speech provider.
5.5 Lecture Hat does not use Your Content to train, fine-tune, or otherwise adjust the parameters of any AI or machine-learning model. AWS states that inputs and outputs submitted to Bedrock are not used to train the underlying models. AWS documents that retention and possible AWS human review depend on the selected model and effective account or project retention mode, and states that content sharing with model providers is not currently supported. We have not independently verified every production request's effective mode and do not promise categorical zero retention. See AWS data-retention documentation and the Subprocessor List.
5.6 The optional tab-audio feature hands the selected live stream to Lecture Hat Live Subtitles, which can send it to ElevenLabs for live transcription. Lecture Hat does not persist the live stream as an audio recording; a transcript or local transcript draft can be retained. Requests ask ElevenLabs to disable logging, but the contractual coverage, account-level Zero Retention Mode, and model-improvement opt-out applicable to our account have not been verified. Its published business terms incorporate a DPA; the request flag does not establish a categorical provider no-retention or no-training guarantee. These provider limitations do not authorize uses beyond Section 13's Limited Use restrictions. Live Subtitles is excluded for institutional data under the standard DPA until contractual coverage and configuration are verified and approved for covered processing. Uploaded media is stored and processed separately from the live stream. Satisfy applicable recording-consent, notice, and institutional requirements before adding another person's speech.
7.1 We share information with vendors that need it to deliver the Extension Services: Clerk for identity, AWS Bedrock for indexing and AI answers, ElevenLabs when you add tab audio to supported live captions, and infrastructure, security, and backup providers in the Subprocessor List. Core relational data and uploaded files are stored in Lecture Hat-operated PostgreSQL and MinIO on Amazon EC2/EBS in us-east-1; GPU processing runs on a Lecture Hat-operated US server. Direct encrypted backups use Amazon S3 in US East (N. Virginia, us-east-1). Backblaze B2 is the legacy backup provider in US East. Any remaining historical copies are archived and removed after verified restore checks; new direct backups use Amazon S3, as described in Section 8.3. Google Chrome Sync can separately receive the two settings in Section 3.7 when Chrome Sync is enabled; it does not receive all the Extension's local records.
7.2 We may disclose responsive information to comply with applicable law or valid legal process, or for a security purpose such as investigating abuse. We can also disclose aggregated and de-identified information for internal operations where it cannot reasonably identify you, subject to the Limited Use restrictions below. In connection with a merger, acquisition, or sale of all or part of our assets, we will transfer data obtained through the Extension only after obtaining your explicit prior consent, as required by the Chrome Web Store User Data Policy.
8.1 We generally discard information when it is no longer needed to provide the requested function and we are not legally required to retain it. Imported Canvas content and its indexes normally remain while the content is in your notebook and your account is active. Chat history and the request-only items described in Sections 3.10 and 3.11 are retained as stated there. The research transcript has no automatic deletion deadline; those records remain until deleted through the applicable class chat-deletion control, account deletion, or manual deletion by Lecture Hat. Turning off a student opt-in stops the logging authorized by that opt-in for future requests; it does not remove existing records or override a separate standard-class retention policy. Contact support or use the available deletion controls to request removal.
8.2 Deleting a saved chat hides it from your history immediately. After 30 days its row becomes eligible for permanent deletion, and the installed lifecycle-cleanup timer removes eligible rows from the active database in bounded batches. A legal obligation or a security or abuse investigation can require limited additional retention. A backup created before that purge remains until a later rotation run deletes it, on the schedule in Section 8.3.
8.3 Account deletion begins a 30-day grace period during which you may cancel it. After the grace period ends, cleanup removes current application records and stored objects. Derived retrieval-index cleanup is queued separately; completion is asynchronous and is not established by the account-deletion transaction. Legacy lecture-audio objects in the retired notebook-recordings bucket are outside the current job, and we have not verified completion of their separate manual cleanup. Deletion tombstones retain deleted account, class, and Stripe Customer identifiers; permanent storage-cleanup tombstones retain the bucket and object key, which can include a filename. These records retain identifiers and object names rather than document or message bodies; those identifiers and filenames can still be personal information. They do not include Stripe event payloads. Backup targets include hourly database dumps for 48 hours, daily dumps for about 14 days, and weekly or search-index dumps for about 28 days. Direct encrypted database and Redis backups in Amazon S3 are targeted for deletion after about 35 days. Encrypted EBS volume snapshots can include all database records and uploaded files on the volume and target hourly retention for 48 hours and daily retention for 14 days. Uploaded files are also mirrored to Lecture Hat-operated backup storage. An encrypted copy of uploaded files is also kept in Amazon S3, including while Amazon EC2 is the primary host. The current copy targets hourly synchronization; replaced or deleted objects target removal from backup history after about 14 days. Backblaze B2 is the legacy backup provider in US East. Any remaining historical copies are archived and removed after verified restore checks; new direct backups use Amazon S3. Migrated historical archives have a separate expiration target of no more than 35 days after migration; they are outside routine dump and file-history pruning, and deletion still depends on successful cleanup. Missed or failed pruning runs can extend these periods or create gaps. The policy target of removing residual backups within 90 days is not mechanically enforced, and restore tooling does not automatically exclude previously deleted accounts. We may retain limited records where required to comply with legal obligations, address security or abuse, resolve disputes, or enforce our agreements.
8.4 The local Canvas state described in Section 3.6 remains in Chrome until replaced, until you clear the Extension's stored data, or until you uninstall the Extension; the recency list rolls over at 300 entries. It is never stored in your Lecture Hat account. The two settings described in Section 3.7 remain in Chrome Sync until you change them or remove them through your Chrome or Google account controls.
8.5 Account-linked AI usage events, costs, quota counters, and rate-limit events are stored in databases with no automatic age-based expiry and are removed by account cleanup, subject to Section 8.3's backup and legal exceptions. Separate application request, feature-use, error, security, and operational rate-limit logs remain until overwritten by configured size-based Docker or system-journal rotation. Those operational logs are not organized for account-by-account deletion, so deleting an account does not remove an entry before rotation. A documented security or legal incident can be preserved longer where necessary.
9.1 We use safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction, including authenticated access and encrypted public connections. Cloudflare terminates public TLS connections and can access transmitted request contents; this is not end-to-end encryption, and some internal connections use HTTP. Our Security Statement describes current measures and limitations. Human access to Extension data is limited by Section 13. No transmission or storage method is completely secure, and we cannot guarantee absolute security.
9.2 Your Content is primarily stored on the Amazon EC2/EBS systems Lecture Hat operates in us-east-1, with GPU processing on our own US server and backup locations described in Section 8.3. AWS Bedrock can process requests in supported commercial AWS regions, including us-east-1, through global inference profiles. Clerk and Cloudflare may route or process data in the United States or other countries through global service endpoints and edge networks, as described in our Subprocessor List. Extension Read Aloud uses the local browser voice. Optional tab audio for Live Subtitles follows the speech-provider route in Section 5.6.
10.1 You may view and delete imported content and saved chats in Lecture Hat. A deleted chat disappears immediately and follows the purge schedule in Section 8.2.
10.2 You may request account deletion from your Lecture Hat account settings. Section 8 explains the grace period, cleanup stages, retained metadata, and deletion limitations.
10.3 You may leave Canvas Inbox import off, turn page sharing off, stop added tab audio, disable auto-sync, revoke optional site or tab-capture permission, clear local Extension data, or disable or uninstall the Extension. Uninstalling does not by itself delete content already stored in your Lecture Hat account.
10.4 To access, correct, port, or delete your data, email [email protected]. Section 12 describes the process and the additional rights that may apply where you live.
The table below describes the categories of personal information the Extension collects, using the category names in Cal. Civ. Code § 1798.140(v). We collect each category from you and from the Canvas and Lecture Hat accounts you direct the Extension to use.
| Category | Examples | Purpose | Recipients | Retention |
|---|---|---|---|---|
| Identifiers | Canvas user ID and display name; Lecture Hat account identifier, email address, account name, and IP address | Prevent cross-account imports, authenticate you, route imports to the correct notebook, and secure and rate-limit the Extension Services | The Canvas user ID used for account pairing stays in local Extension storage. Names or identifiers embedded in imported content reach the recipients in Sections 5 and 7. Clerk, Cloudflare, and other service providers receive account and request identifiers needed for their functions. | Canvas user ID per Section 8.4; a display name inside imported content and other account identifiers per Section 8; IP addresses per Section 8.5 |
| Education information | Imported course materials, coursework, grades, submission status, rubric assessments, course and file metadata | Store and index the content in your notebook and answer your questions about it | AWS Bedrock, service providers | Until you delete it or delete your account, then as described in Section 8 |
| Internet or other electronic network activity information | Cactus messages and responses; shared page title, path, text, and headings; the local Canvas state in Section 3.6; the import and auto-sync settings; AI usage and quota records, rate-limit events, and error reports | Choose a notebook, title and answer the chat, rank the Canvas course picker, apply your import and sync choices, and operate, secure, and troubleshoot the Extension Services | AWS Bedrock, Cloudflare, hosting and backup providers; Chrome Sync receives only the two settings in Section 3.7; local Canvas state and Read Aloud text reach no one | Saved chat text until deleted, then Section 8; shared full-page content is request-only except a consent- or class-policy-gated research transcript; local state per Section 8.4; database usage records and separate operational logs per Section 8.5 |
| Audio, electronic, visual, or similar information | Rendered pages from imported PDF and slide documents sent for entity-location processing, rasterized pages from supported handwritten-note files, retrieved notebook page images, screenshots of a tab you share, images you attach to Cactus, and live tab audio you add to captions | Locate entities and transcribe supported handwritten notes during indexing, answer your question, or transcribe the live audio you add | AWS Bedrock for content and images; ElevenLabs for supported live audio | The live audio stream is not persisted by Lecture Hat; provider limitations in Section 5.6 apply. Stored page renders remain with the imported content until deletion under Section 8. Rasterized note images, retrieved copies, attached-image data, and shared-page screenshots are processed for the request and are not saved in chat history. |
| Sensitive personal information (contents of communications) | Canvas Inbox message bodies and attachments, instructor submission comments | Store and index the content in your notebook and answer your questions about it | AWS Bedrock and hosting, network, and backup providers described in Section 7 | Until you delete it or delete your account, followed by the cleanup and backup limits in Section 8 |
| Sensitive personal information (account access credentials where applicable) | Lecture Hat account identifier together with cached Clerk session context and short-lived authentication tokens; Canvas cookies attached by your browser to Canvas requests | Authenticate requested features and prevent cross-account imports | Clerk, Lecture Hat, and network providers for Lecture Hat authentication; Canvas receives its own session cookie, which is not sent to Lecture Hat | Tokens are short-lived and refreshed while signed in; local Extension context follows device and account controls. Canvas manages its session separately. |
| Inferences | Indexes, embeddings, and extracted entities derived from Your Content | Retrieve relevant material when you ask a question | Service providers listed in our Subprocessor List | Queued for cleanup after deletion of the source content; completion and backup limits are described in Section 8 |
12.1 We do not sell personal information and we do not share personal information for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We will not discriminate against you for exercising a privacy right.
12.2 Canvas Inbox import and assignment feedback can contain sensitive communications. Content you attach, share, or caption can also contain sensitive information. We use it for the requested feature, service security, and legal obligations, rather than to infer unrelated sensitive characteristics or serve advertising.
12.3 Depending on your state of residence, the law's coverage requirements, and applicable exceptions, you may have the right to access, correct, delete, or obtain a portable copy of your personal information, to limit certain uses and disclosures of sensitive personal information, and to appeal a denial. To exercise a right, email [email protected]. Where permitted or required, we verify requests through your account or another proportionate method; California opt-out and limitation requests do not require a verifiable consumer request. We respond within the deadline for the particular right and explain a permitted extension. Authorized-agent requests follow applicable proof-of-authority requirements and power-of-attorney exceptions, as described in the main Privacy Policy Section 11.2. To appeal a denial, reply to our decision with the subject line "Privacy Appeal." We respond within the applicable state appeal deadline and, if we deny it, identify the state authority to which you can complain.
12.4 Lecture Hat, Inc. is a United States company. Section 9.2 and our Subprocessor List state where service providers may route or process data, and the Lecture Hat Privacy Policy states the rights that may apply to users outside the United States and the need to identify an applicable executed transfer mechanism; it does not claim every user transfer is covered by signed clauses.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Our collection, use, and transfer of all user data obtained through the Extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We collect, use, and transmit only data necessary for the disclosed single purpose, including related operation, security, and performance measurement. These restrictions cover raw, scraped, aggregated, anonymized, de-identified, and derived data; import into Lecture Hat does not remove them. Transfers are limited to those necessary for that purpose, applicable law, protection against fraud or abuse, or a business transfer with explicit prior user consent. We do not use or transfer this data for advertising, resale, creditworthiness, or lending. Human reading requires explicit consent to read specific data, necessity for security or applicable law, or aggregated and anonymized data used for internal operations in accordance with law. General policy acceptance, a class retention setting, or removing names alone does not satisfy those human-access exceptions. Provider disclosures and a research opt-in do not authorize a purpose outside these limits.
*.instructure.com) to read and synchronize the course categories you choose from your active Canvas session.lecturehat.com and clerk.lecturehat.com) to upload imported content, use Cactus, and refresh short-lived authentication tokens.cookies, limited to the Lecture Hat and Clerk hosts above and used only to refresh your revocable Lecture Hat session and obtain short-lived authentication tokens. The Extension does not read your Canvas cookies.storage to keep, locally in your browser, your acceptance of this Policy, your linked courses and sync checkpoints, which files have already been imported so that nothing is imported twice, resumable jobs, Clerk's authentication context, and the local Canvas state described in Section 3.6. Only the two settings in Section 3.7 use Chrome's synced storage.scripting to run a read-only script inside Canvas that fetches the course items you selected using your own session, and, only after an explicit Share current page click, to read the active page into a local Cactus snapshot.activeTab to identify the active Canvas course and, after a Share current page click, to read the current tab and capture a local screenshot of its visible area.alarms to schedule background checks for new material in the courses for which you enabled auto-sync.sidePanel to display the Extension in Chrome's side panel.tabCapture to supply the active tab's audio to an existing Lecture Hat Live Subtitles session only after you invoke the Extension and approve the request. Stop ends capture; revoke the permission in Chrome to prevent future use.canvas.yourschool.edu, you add that one address in Settings and Chrome asks you to approve that specific site. The Extension requests and stores only the host you enter, never blanket access to all sites, and you can revoke it at any time.We may update this Policy and will revise the "Last updated" date and version above. For material changes affecting how we handle your data, we will give notice in the Extension or by email and request renewed consent within the Extension before you continue using it. Changes take effect on the stated effective date; continued use does not substitute for consent required for new collection.
Lecture Hat, Inc. · 7710 SW 67th Ave, South Miami, FL 33143-4532 · [email protected]
Template credit and reuse: Adapted from Automattic's Privacy Policy. Lecture Hat changed the service scope, Canvas and shared-page collection, audio feature, providers, retention, user controls, and Chrome Limited Use provisions. This adapted policy text is available under CC BY-SA 4.0. Automattic does not endorse Lecture Hat.