Privacy
Last updated 22 August 2026
Waypoint reads your Canvas coursework and shows you what it means. This page says exactly what that involves — what is read, what is kept, what is not, and who can see it. Every statement here describes how the software is actually built, not an intention.
Waypoint cannot change anything in Canvas
The Canvas client in Waypoint implements only read requests. There is no code anywhere in it that can submit an assignment, post a reply, or delete work — not disabled, absent. When your institution issues sign-in credentials, the permissions requested are read-only and enumerated, and your Canvas administrator can see and revoke them.
What is stored
Canvas user id and display name
To know who you are across sessions. It is the only identifier that survives the move from access tokens to institutional sign-in.
Your school's Canvas address
To know which institution to talk to.
Email address
Only if Canvas shares it, and only to send the notifications you switch on.
Time zone
Read from your browser, so your group can see what time it is where you are without anyone having to ask.
Notification preferences
The switches you set.
Subscription status
Whether you are on the free or paid tier, and a Stripe customer reference if you have paid.
Group messages, tasks and files
Things you and your groupmates write and upload inside Waypoint. These do not exist in Canvas — you created them here.
What is not stored
Your Canvas password
Waypoint never sees it. Sign-in happens on your school's own Canvas.
Assignment text, discussion posts, or submissions
Read to compute what is shown on your screen, returned to your browser, and not written down.
Your grades
Calculated on request from what Canvas reports. No grade history is kept.
Access tokens
A personal access token is used for the request and discarded. Under institutional sign-in, the refresh token is stored encrypted; nothing else is.
Credentials
If you connect with a personal access token, it stays in your browser. Each request sends it, the server uses it to read Canvas, and it is discarded when the request ends. It is never written to a database, a log, or a cache. Signing out removes it from your browser, and there is nothing on our side left to delete.
Under institutional sign-in, a refresh token is stored because it has to be — that is what lets you return without signing in again. It is encrypted at rest with AES-256-GCM, never logged, and never sent to a browser.
Group workspaces
Messages, tasks and files inside a group are visible to the people Canvas placed in that group, and to nobody else. Files are held in private storage with no publicly reachable address; every download re-checks that the person asking is a member. There is no shareable link, and no way to make one.
Your group can see the time zone your browser reports and roughly when you were last active. That is the point of it — it is what stops the first three days of a group project going on logistics. Nothing else about you is shared with them.
Who else sees any of this
Nothing is sold, and nothing is shared with advertisers or data brokers. Your coursework is not used to train any model. The only third parties involved are the ones that run the software:
Vercel hosts the application and the file storage. Neon hosts the database. Both are in the United States. Stripe handles payment if you subscribe — card details go to Stripe directly and Waypoint never sees them.
Deleting your data
Signing out clears your browser. To remove the rest — your account row, notification preferences, and stored credentials — email the address below and it will be deleted.
Group messages are the one thing that is not purely yours: they are part of a conversation other people participated in, so removing your account does not delete the group history your groupmates can still see. Files you uploaded can be removed by you at any time from the group.
Students under 13
Waypoint is built for higher education and is not directed at children under 13. If you believe a child has an account, email the address below and it will be removed.
Changes
If what the software does changes, this page changes with it and the date at the top moves. A policy that has drifted away from the implementation is worse than no policy, because it is a false assurance rather than a missing one.