Privacy Policy

Classmax is a study tool. A Chrome extension reads your university's learning platform while you are signed in to it and copies your coursework into a web app, where an AI assistant can answer questions about it. This policy explains exactly what that involves: what we collect, why, how long we keep it, and every company it reaches.

Classmax is run by CLASSMAX LTD, a company registered in England and Wales with company number 17523850, which is the data controller for the information described here. Classmax is independent: it is not run by, affiliated with or endorsed by any university, or by Blackboard, Canvas or Moodle. Questions, requests and complaints: privacy@classmax.ai.

What we collect, and why

Account and preferences

Your email address, display name, and optionally your institution. Your password is handled by our login provider and stored only as a salted hash; we never see it. Alongside this we store the settings you choose: language, grading scale and how you want grades worded, theme and colour palette, term dates, and any facts you add under "About you" so the assistant remembers them. At sign-up you also give your year of birth, to confirm you are 18 or over. If you sign in with Google or Microsoft, we receive your name, email address and profile picture from them. We also store where you heard about Classmax and your time zone. From version 1.4 of the extension, when it is signed in through the app it gets a sign-in session of its own, like a second device, and we keep a record of when each one was created so we can limit and tidy them. Used to give you an account, keep you signed in, and make the product behave the way you set it.

Your coursework

Course names and codes, the names of your lecturers where your platform lists them, assignments and their descriptions, due dates, whether you have submitted them, announcements, the course items in your platform's calendar (never your personal calendar entries), and your course materials, including the full text we extract from documents, slides and PDFs. Where a course page links to a public webpage or PDF, such as a reading on the open web, or to a file your lecturer shared so that anyone with the link can download it, such as slides on Google Drive, our server fetches that address to read its text. Nothing of yours is sent with that request, and a page that needs a login is not read. Classmax never gets around a file's sharing settings. When your materials sync, it checks these files at most once a week. If your lecturer has turned off downloads, Classmax keeps the copy it already read for you. If two checks a week apart find the file is no longer shared or has been deleted, Classmax deletes the text it kept; anything you already made from it stays yours. Where your platform returns it with the assignment, which today means Canvas, we also keep the score you received on that assignment and the points available, and whether it has been marked. On Blackboard, a test's own settings in your course content also say when it is due and whether your lecturer set it as formative (practice); we keep those two, never a mark. When places in a course give different upcoming due dates for the same work, Classmax shows you each one and where it came from, and keeps the one you choose. We do not read your gradebook, your course total, your marker's feedback comments, or anyone else's marks. Used to build your dashboard and calendar, and to give the AI the context that makes its answers specific to your courses. This is the core of the product; without it Classmax is a generic chatbot. We keep the course name exactly as your platform gives it, and show a tidied version of it; if you rename a course yourself, we store the name you chose. We also keep a record of what changed between syncs, such as a new assignment or a deadline that moved, so we can tell you.

What Classmax prepares for you

After each sync, an AI model labels each new assignment with the kind of work it is. Each week, Classmax prepares outlines, plans, start guides and flashcards for your next pieces of work from your synced coursework and keeps them in your account. If you add your timetable, we keep your class times and rooms. Labels, estimated grades and draft feedback are AI estimates to help you study. No decision with a legal or similarly significant effect on you is made automatically.

Sync records

Each time the extension syncs, we record when it ran, which version of the extension sent it, how many courses, assignments, materials and announcements it found, how many documents it could and could not read and why, how many due dates came from each place in your course, any errors, and the web address of your platform (older error records may hold the full address of the page you were on). Used to find and fix sync problems.

Things you create

Files you upload to your Library and the text extracted from them. Drafts you write or import into Draft Review, the feedback and estimated grade produced for them, any real mark you record, and any brief you paste in. Your chat history. Study sets, flashcards, practice exams and your attempts at them. Bug reports you send, including which page you were on. Used to provide those features and to let you return to your work later.

Billing

If you subscribe, we store your subscription status, plan, renewal date, and the customer and subscription identifiers Stripe gives us. Your card details are entered on Stripe's payment form and go to Stripe directly; they never touch our servers and we cannot see them. We also store any promo or referral code you use and how many referrals you have earned.

Product analytics

We record events describing how the product is used, for example that a draft review was requested or a study set was created, along with non-content details such as how many characters a draft had. These events are stored against your account and are not anonymous. We do not put the content of your work in them. Used to see which features are actually reached and which are broken.

Link clicks

When you follow one of our short links, we record which link, the time, and the host that referred you, for example "instagram.com". No account, no cookie, no IP address, no device fingerprint. This is counted before anyone signs up and cannot be tied to a person.

Which platform account you connected

When you connect your university's learning platform we store the identifier that platform uses for your account there, along with its web address. This is an internal number or code from your university's system, not your name, your email or your student number, and we never receive your university password. We keep it for one reason: so that if a different person signs into their own university account in the same browser, we can tell that it is not you and refuse to copy their coursework into your Classmax account. We also record when a platform is added to your account, or when that check fails, so that a mistake can be found and undone rather than going unnoticed.

If you teach at your university as well as study there, Classmax does not copy anything from a course you teach on Canvas or Blackboard Ultra, including work your students have submitted and material they cannot see yet. We record how many courses were skipped for that reason, so we can explain why your dashboard looks empty. We do not keep their names. On Moodle and older Blackboard sites, Classmax cannot yet tell which courses you teach, so please do not connect an account you teach on there.

Stored in your browser

The extension keeps, in Chrome's extension storage on your computer: your Classmax sign-in (from version 1.4, only its sign-in tokens, your account email and your name; before 1.4, a copy of the app's sign-in, which also included your profile details), the platforms you have synced from, sync progress and counts, a copy of the coursework read by the most recent sync (and, before version 1.4, if you were signed out when a sync ran, the coursework it read, held until you signed in), a short log of recent sync errors, your theme, whether you closed the sign-in reminder, and on Moodle a list of course link addresses and of documents it has already tried to read. If you add your university's address yourself, that address is kept in Chrome's synced storage, so it follows you to other computers where you use Chrome with the same Google account. Removing the extension removes all of it.

On classmax.ai and in the Classmax web app, your browser keeps your sign-in session, your display settings and which hints you have dismissed, and, if you arrived through a referral or promo link, that code until it has been added to your account. All of this is needed for the site to work as you set it. We set no advertising, tracking or analytics cookies, which is why the site shows no cookie banner.

How the extension reads your platform

The extension runs on your university's learning platform pages while you are already signed in there, and reads the same content the page shows you. It also downloads attached files, such as assignment briefs, to extract their text. It requests permission for Blackboard, Canvas and Moodle addresses, and for your Classmax tab so it can read your Classmax session. If your university uses an address we do not list, you can grant access to that specific site yourself. Nothing is read from a site you have not connected.

It syncs when you open a page of your platform, and again while a tab of your platform stays open: from version 1.4 at most every 2 hours for each site, from one tab, and never between midnight and 7 a.m.; before 1.4, about every 15 minutes. From version 1.4 it does not read a platform you have disconnected in Settings, and it is blocked from opening any page that starts, takes or submits a quiz, test or lesson. When the extension opens a page or file to read it, your platform may record that you viewed it or tick a "viewed" requirement.

We never receive your university password. The extension uses the session already present in your own browser. It sends the coursework it reads to our servers over HTTPS. It does not read pages unrelated to your coursework, and it does not send anything to anyone other than Classmax.

Why we are allowed to use it

UK data protection law needs a legal basis for each use. Ours are:

• To provide the service you signed up for (contract): your account, syncing your coursework, the AI features, what Classmax prepares for you, and billing if you subscribe.
• Our legitimate interests in keeping Classmax working and safe: sync records and error logs, product analytics, the check that a platform account is yours, the age check, operational alerts, and setup and reminder emails, the weekly email, a one-time email offering it and notes about a problem with your account, all of which you can turn off in Settings or unsubscribe from. You can object to any of these by emailing us.
• Your consent: tips and Classmax news, which are off unless you turn them on, and which you can turn off at any time.
• Legal obligation: keeping billing records for as long as tax law requires.

Who we share it with

This is the complete list. These are service providers acting on our instructions, not independent users of your data. We share your data with no one else.

• Supabase

  Receives: Everything you store in Classmax: account, coursework, files, drafts, chats, preferences, analytics events.

  Why: Our database, login and backend run on Supabase. It is where your data lives.

• Anthropic (Claude)

  Receives: Your message or draft, plus the course context relevant to it, when you use an AI feature. Also, without you asking: the title, course name and opening text of each new assignment after a sync, to label what kind of work it is, and each week the instructions, marking criteria and course material for your next pieces of work, to prepare your weekly study material. That context can include the score you received on an assignment.

  Why: Generates chat replies, draft feedback, flashcards, practice questions, brief summaries, assignment labels and your weekly study material.

• Voyage AI

  Receives: The text of your course materials and uploaded files, and the text of your questions.

  Why: Turns your materials into a search index, and your question into a search, so the assistant can find the right passage.

• Stripe

  Receives: Your email and name, and your card details, which go from your browser to Stripe directly and never reach our servers.

  Why: Takes subscription payments and manages billing.

• Cloudflare

  Receives: Standard request data: IP address, browser user agent, and the pages requested.

  Why: Serves classmax.ai and app.classmax.ai and protects them from abuse.

• Resend

  Receives: Your email address, your first name, and what the email says, which can include course names, assignment titles and due dates, or the study material prepared for your week.

  Why: Sends Classmax emails to you: finishing setup on a laptop, welcome emails, deadline reminders if you choose them, the weekly email if you keep it on, a one-time email offering it, tips and news only if you choose them, and, rarely, a personal note about a problem with your account. You choose which in Settings, under Notifications, and every email has an unsubscribe link. Processed in the EU.

• Discord

  Receives: Operational alerts only: the domain of a new signup (for example "regents.ac.uk", never the address), how you heard about us, counts, the kind of email sent, and the web address of the university platform involved in a sync event. Never your name, email or coursework.

  Why: Tells us a signup or a sync happened so we can spot breakage early.

Anthropic and Voyage AI process what we send in order to produce a result and, under their API terms, do not train their models on it. We may also disclose data where we are legally required to, or if Classmax is ever acquired or merged, in which case we will say so on this page before your data moves.

Limited use

Data the Classmax extension collects is used only to provide and improve the features described in this policy. It is never sold, never transferred for advertising, never used to determine creditworthiness or for lending, and never used to train third-party AI models. Humans do not read your content except where you explicitly ask us to look at something, where it is necessary for security, or where the law requires it. To find and fix sync problems we look at counts, errors and scrambled (hashed) titles that cannot be read, not your content, unless you have agreed in writing that we may look at your synced coursework to fix a problem.

What we never do

• We do not sell your data.
• We do not use your data to train AI models, and our providers do not either.
• We do not share your data with your university, your instructors, or anyone at your institution.
• We do not share your data with other Classmax users. Every table is protected by row-level security tied to your account, so your account can only ever read its own rows.
• We do not see or store your university password.
• We do not run advertising, and we set no advertising, tracking or analytics cookies.

How long we keep it

Your coursework, files, drafts and chats are kept while your account exists, so the product works when you come back. Each sync adds what is new and updates what changed. When an assignment disappears from your platform, Classmax hides it and deletes it 3 days later, unless you set its date yourself or Classmax prepared something for it. When a course disappears, Classmax hides it and deletes it with its synced content 3 days later, unless it holds work you dated yourself or prepared work; your chats, study sets and uploaded files from that course are always kept. If you disconnect a platform in Settings, its courses and their synced content are deleted, and your chats, study sets and files are kept. If you subscribe to your calendar feed, your calendar app fetches your assignment titles and due dates from a private link; anyone with that link can read them, so keep it to yourself. Billing records are kept for as long as tax and accounting law requires, normally six years, even after you close your account. Sync records, error logs and product analytics are kept while your account exists and are deleted with it. Link-click records contain no personal data and are kept as aggregate counts. Everything else is deleted within 30 days of you asking us to close your account.

Where it is stored

Your data is stored in encrypted Supabase Postgres databases and served through Cloudflare. Our providers operate in the United States and the European Union, so your data is transferred internationally. Those transfers are protected by the UK-US data bridge where a provider is certified under it, and otherwise by the standard contractual clauses those providers offer with the UK International Data Transfer Addendum. Connections to and from our servers use HTTPS/TLS, and access is enforced by row-level security policies at the database level.

Your rights and your choices

You can ask us for a copy of your data, for corrections, for deletion, or for us to stop processing it. Email privacy@classmax.ai and we will act within 30 days. If you are in the UK or the EU you also have the right to object, to restrict processing, to data portability, and to complain to your data protection regulator, which in the UK is the Information Commissioner's Office.

You can disconnect at any time by removing the Classmax extension, which stops all reading of your university platform immediately. To close your account and have its data deleted, email us at the address above and we will do it within 30 days. There is no self-service delete button in the app; the request goes to a person.

Age requirement

Classmax is intended for university students aged 18 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account, email privacy@classmax.ai and we will delete the account and its data.

Changes to this policy

If we change what we collect or who we share it with, we will update this page and the date at the top. If the change is significant we will tell you in the app before it takes effect.

Contact

Privacy questions, requests and security reports: privacy@classmax.ai. If you think you have found a security problem in Classmax or the extension, please tell us there.