LMK — Privacy Policy

LMK ("Let Me Know") is a planner for students. Its browser extension, LMK Today, reads your own Canvas or D2L Brightspace assignments, and the LMK app tells you what to do today. This page names everything LMK reads, everything that leaves your device, who handles it, how long it is kept, and how to delete it.

In short

• By default, your assignments, grades and work timings stay in your browser, and in your own Google Drive if you sign in with Google.
• LMK's server holds your coursework only if you turn on Sync from anywhere, which is off unless you turn it on. It holds what you type only if you join a class's classmates list, and a push address only if you turn on the morning note on a phone.
• Otherwise, what reaches LMK's server is an anonymous usage counter, crash reports, a random id for your device and, at Brightspace schools, a report on which parts of the school's site answer. None of it carries your name, your coursework or your grades.
• LMK never submits work or changes your coursework, never sells or shares your data, shows no ads, and sends nothing to an AI model. The one AI it can use, if you turn it on, is the one built into Chrome on your own computer (see below).

Age

LMK is for students 13 and over and is not directed at children under 13. LMK does not knowingly collect anything from a child under 13; if you believe a child under 13 has used it, write to hello@lmktoday.app and whatever is held under that random id will be deleted. Anyone under 18 needs a parent or guardian to agree to the terms.

What the extension reads

• From Canvas, through Canvas's own API and the login session already in your browser: your active courses (name, course code, Canvas's current and final grade for you, and the course's syllabus page — its text, up to 15,000 characters, and, when the page links a syllabus file in Word or PDF form, that file's text (up to about 30,000 characters; the file itself is never kept) — so LMK can find exam dates itself); for each assignment its title, open, due and lock dates, points, assignment group and weight, submission type, link, the first 1,200 characters of the instructions and the rubric criteria; your own submission's state, time and score and whether Canvas marked it late, missing or excused; the most recent comment someone other than you left on your submission (first 400 characters); the time Canvas recorded on your quiz attempts; and each course's internal code, which Canvas shows only to people in the course (see Classmates); and (from version 0.9.13) the announcements your instructors posted in your courses in the last 14 days: each one's title, its text (up to 2,000 characters), when it was posted, its link, and whether Canvas shows you have read it. Who wrote an announcement is never kept.
• From Brightspace, the same kinds of things through Brightspace's API: your enrollments; your assignments, quizzes and graded discussions; work your instructor set in Content with a due date (such as publisher homework, surveys and self-assessments); exams on your course calendar; each entry in your grade book with your grade, your instructor's comment on it and your final grade; your submissions and the feedback on them; and how long your quiz attempts took. To tell whether you have posted in a graded discussion, LMK reads that topic's posts and keeps only the times of your own; nothing anyone else wrote is kept.
• If Canvas has signed your browser out, the extension may open your school's Canvas once in an unfocused background tab, so your school's sign-on can renew the session, and closes it as soon as the read finishes or after 90 seconds.
• Your Canvas calendar feed (from version 0.9.12): every Canvas account has a private calendar feed, the address you would give Google Calendar to subscribe. While you are signed in, the extension reads that address, and the time zone set in your Canvas profile (so due dates land on the right day), from your own Canvas profile and keeps them only in the extension on your computer. It is never sent to the LMK page, your Drive or LMK's server. While Canvas has signed your browser out, the extension reads the feed, at most every 15 minutes, for the titles and due dates of your assignments, so new work and changed dates still reach your plan; your submissions, scores and grades wait until you sign in again. If the address ever stops working, the extension forgets it; removing the extension deletes it.
• Your user number, which both systems use to mark which submissions are yours, is used only to pick out your own work. It is never stored or sent. The extension never sees or stores your password.
• Time you spend working: while an assignment page or a quiz on your school's Canvas or Brightspace is visible and you are active, the extension counts minutes toward that assignment. It records only a minute tally per assignment, never what you type, read or click. (A private build that LMK's author runs also times course tools such as MyEducator or Edfinity; the build in the Chrome Web Store does not.)

Where it goes by default

• Everything the extension collects is stored in your own browser (extension storage) and handed to the LMK page when you open it. The LMK page keeps your plan, your done marks and your timings in your browser too.
• If you sign in with Google, LMK saves your data as a file named LMK-data.json in your own Google Drive so your phone and laptop stay in step. LMK uses Google's drive.file permission, which lets it see only the files it created; it can never read anything else in your Drive.
• If you turn on Keep your phone fresh, the extension itself saves each sync as a second file, LMK-canvas.json, in your own Drive under the same drive.file permission, so your phone can pick it up without LMK being open on your laptop. It is off until you turn it on, the Google sign-in token stays inside the extension on your computer, and nothing in it reaches LMK's server.
• Inside claude.ai only: the copy of LMK that runs as a Claude artifact shares anonymous course statistics with other users of that copy: an assignment's Canvas ID, a median number of minutes, and a type vote (for example "done in class"). This never includes your name, your scores, your grades, or which assignments you completed. The app at lmktoday.app shares nothing of the kind: this sharing needs Claude's own storage, which a normal web page cannot reach, so on the website your timings never leave your device.

Sync from anywhere (optional, Canvas only)

So your phone stays current while your laptop is closed, LMK's server can read Canvas for you. It is off unless you turn it on, and you can turn it off under the gear at any time. Brightspace offers students no access tokens, so it does not exist at Brightspace schools. When you turn it on:

• The extension creates one Canvas access token, named "LMK", in your own Canvas account (the same kind you could make under Account → Settings → New Access Token) and sends it to LMK's server. Canvas gives a token like this the same access as your account. LMK uses it only to read: the server sends Canvas nothing but read requests with it, and LMK never submits work or changes your coursework. Canvas lists it under Account → Settings → Approved Integrations, where you can delete it at any time. It expires after six months; while the feature is on, the extension replaces it before then and deletes the old one.
• LMK's server stores the token encrypted, with a key kept in the server's secret store and never in the database. Beside it, as ordinary database rows, it stores a copy of what it reads: per course, its name and Canvas's current and final grade; per assignment, the title, due, open and lock dates, points, link, submission state and time, score, late/missing/excused flags, the first 1,200 characters of the instructions, the rubric criteria, and the most recent comment someone other than you left on your submission (first 400 characters). It also keeps your school's Canvas address and the labels Canvas puts on each assignment (grading type, submission type, assignment group and its weight, quiz number).
• It stores no email, no Canvas user id and no name from your Canvas profile. Each student is a random sync id. A comment someone left on your work is free text, though, and can contain your name.
• Every few minutes the server reads a few courses for the student whose copy is oldest, and it reads yours when you open LMK and the copy is stale. Your devices read the copy back from the server.
• How long it is kept: until you turn Sync from anywhere off. That deletes the token, the course list and every assignment row from LMK's server at once, and removes the token from Canvas the next time you open Canvas with the extension. If you stop using LMK without turning it off, the server deletes the token and the copy on its own once nothing has read the copy for 180 days (neither LMK nor your calendar subscription), or once Canvas has refused the token for 30 days in a row without a successful read (for example after you delete it in Canvas). Canvas itself also expires the token after 180 days unless the extension renews it.
• Turning it off does not take you out of your classes. A classmates entry is kept separately (below): leave each class to remove it, or write to hello@lmktoday.app to delete everything.

Students on a phone with no laptop can paste a Canvas token they made themselves. Everything above applies to it, except that LMK cannot remove a token you made by hand from Canvas: delete it under Approved Integrations.

Your calendar (optional)

Planning around your calendar. Under the gear you can connect a calendar so the plan only uses time you are actually free. With Google Calendar, LMK asks Google for two narrow permissions: to see when you are busy (never what an event is called or who is in it), and to create one calendar of its own, called "LMK", and manage events only on that calendar. It never reads, changes or deletes anything on your other calendars. The busy times stay in your browser. With Apple, Outlook or another calendar, you paste that calendar's private link; because those services do not let a web page read the link directly, LMK's server fetches it for your browser and passes it straight back without keeping a copy, a log or a count, and your browser keeps only when you are busy. The link itself is saved in your LMK data (your browser and your own Drive), never on LMK's server. Disconnect under the gear at any time; Google's permission can also be removed in your Google account settings.

What LMK puts on your Google calendar (if "Put my study time on my calendar" is on): your planned study blocks for the next seven days and your exams, on the "LMK" calendar only. Deleting that calendar in Google removes them all.

Your deadlines in another calendar. With Sync from anywhere on, the gear offers a private calendar link. If you subscribe to it in Google Calendar, Apple Calendar or Outlook, that service fetches the link from LMK's server from time to time and keeps what it receives under its own terms: for each unsubmitted assignment with a due date, its course, title, due time, points, submission type and Canvas link. It never includes a score or a grade. The link is its own key, so anyone who has it can read that list; treat it like a password. Turning Sync from anywhere off makes the link stop working.

Classmates (optional)

For each class you choose to join, LMK's server keeps: the display name you type; a contact handle if you add one, such as an Instagram username (any short line, up to 60 characters); which class it is, meaning your school's address and the course's number; when you joined; and the study sessions you post (a time, a kind of place, an optional note of up to 80 characters and an optional assignment) or say you're in on. A class can also hold one link to its own group chat, which any member can add or change and every member can see; it does not record who added it.

Who sees it: only people who have joined the same class's list in LMK, after LMK confirmed they are in that course. Others in the course who open LMK see only how many have joined. On Canvas the confirmation is a code Canvas shows only to people in the course, read by the extension inside your own session and sent as a hash: never the code itself, never a password or a key. Brightspace has no such code, so there LMK uses the course's offering code, which is a weaker check. Classmates never see your sync id or support code, only a short public id made from a hash of it, and the list never includes your grades, scores, submissions or which assignments you have finished. When Sync from anywhere is connected, LMK's card on a Canvas course page asks the server how many classmates have joined; that request carries your school's address and the course number, nothing about you.

Reports: if you report an entry or a session, the server keeps your random id, the public id of what you reported, up to 200 characters you write, the class and the time, so a person can read it. Write to hello@lmktoday.app to have a report you filed deleted.

How long: until you leave. Leaving a class deletes your entry, the sessions you posted and your marks on other people's sessions the moment you tap. Turning off Sync from anywhere and removing the extension do not do this.

A classmate can send you an invite link that opens a class's list. The link carries no code, says nothing about who shared it, and earns nothing for anyone.

The morning note on a phone (optional)

If you turn it on, LMK's server holds one more thing about you, and it is an identifier: the address your browser's push service (Apple's, Google's or Mozilla's) hands out for that one browser on that one device, with the two keys that encrypt messages to it. It is a long random web address. Anyone holding it together with LMK's private key could make that device show a notification. It is stored against your device's random id (below) and nothing else: no name, no email, no account.

Beside it LMK stores, for each of up to four coming mornings worth waking you for, the moment to send the note, how many things are due and how many minutes they add up to. Your device works those moments out on its own clock, so LMK is never told your time zone or what time you get up, only instants in the future. They run out after four mornings, so a phone whose owner has stopped opening LMK goes quiet rather than being read a stale plan.

What the note says is put together on your phone. No assignment title, no course name and no grade is ever sent to LMK's server or through the push service. The headline ("Today: 3 things, ~2h 10m") travels encrypted; the line naming the first thing is added by your own browser from the plan it already has. Turning the note off in LMK deletes all of it at once. If you block LMK's notifications in your browser or phone settings, or remove the browser, the push service tells LMK the address is gone the next time a note is due and LMK deletes it then; it is also deleted after ten failed sends in a row, and when you turn off a connected Sync from anywhere.

The extension's morning notification on your computer is different: it is built on your computer from the plan the LMK page already showed you, and nothing about it is sent anywhere.

What LMK counts

To know whether LMK is used and where setup goes wrong, the web app at lmktoday.app sends LMK's server one word from a fixed list, plus the date in UTC and, once your school's Canvas or Brightspace has answered a sync, your school's web address (for example canvas.asu.edu). That is the whole message: no identifier, no cookie, no device details beyond whether the word came from a phone (see below), nothing about you, and LMK does not record your network address, so a count can never be traced back to a person. A school's counts are kept apart from everyone else's only once at least ten devices at that school have used LMK; until then the server keeps just the number of devices there and counts every other word with everyone else's, so no school's numbers describe one student. The address LMK uses is the one your school's own site answered from, never one you typed. The server refuses any word not on this list:

• Use: open (once per device per day), install (the first time a device opens the app), firstsync (the first time your school's data arrives), synced (once a day from a device that holds that data), extension (the first time the extension is detected) and school_seen (once per device for each school, the first time that school's data arrives: it is how the server counts devices at a school).
• Setup and coming back, each once per device: each setup screen the device was shown (step_fresh, step_school, step_approve, step_waiting, step_stuck, step_empty, step_phone); which kind of site your school uses, once the school you named on the first setup step tells LMK (lms_canvas, lms_d2l), or lms_other if you said it uses one LMK cannot read yet; a return a day, a week or a month after starting (back_d1, back_d7, back_d30); and sample_try if you try the sample semester.
• Whether LMK helped, counted per student rather than per device (from October 19, 2026): plan_viewed, once ever, the first time your own plan has been on screen for five seconds, and active_w, once a week, when you open LMK with your classes in it. Your device decides whether to send either word from your own data: it remembers that it already sent it, and if you sync with Google that memory travels to your other devices through your own Drive, so a laptop and a phone count as one student. Nothing about who you are is sent to do that; it is the same word and day as everything else.
• How setup goes, for devices new to LMK (from October 19, 2026): a device that first opens LMK on or after that day remembers the day on the device and sends, each once: f_install (that first open), f_ext (the extension was found), f_sync (your school's data first arrived), f_plan (your plan was on screen for five seconds), f_stuck (the extension was there but your school never answered), and f_back1 / f_back7 (you opened LMK again a day, and a week, after that first day). On a phone only the first is sent, as f_install_m. The day stays on your device; the server sees only the word and the date, as with everything else.
• Phone or computer: on a phone or tablet, open, install, firstsync, synced, back_d1, back_d7, back_d30, plan_viewed and active_w are sent with _m on the end (for example open_m), because a phone cannot add the extension and its visits mean something different. That is the only device detail LMK sends.
• Which kind of link brought you: if the address you first opened LMK from ends in ?from= and one of chat, reddit, club, prof, card, search or friend (friend is the link LMK's Invite a friend makes), the device sends from_ plus that word once, and act_ plus the same word when it first syncs: from_chat, act_chat, from_reddit, act_reddit, from_club, act_club, from_prof, act_prof, from_card, act_card, from_search, act_search, from_friend, act_friend. When that device comes back a day, a week or a month after starting, it also sends back_d1_, back_d7_ or back_d30_ plus the same word (for example back_d7_prof). The LMK homepage remembers that word in your browser too, so it still applies after you add the extension from the Chrome Web Store. Anything else after ?from= is ignored.
• Whether the plan worked, once per assignment you finish: fin_ontime or fin_late (it was finished before or after it was due), posted_late (it appeared less than two days before it was due), and, when LMK learns how long something took, est_ok or est_miss (its time estimate was close or not). Your device decides which word applies and sends only the word and the day; which assignment it was never leaves your device.
• Features: ahead_go (a head start taken on a free day), room_share (a share tap in a class), join_seen and join_room (an invite link opened, and the class it then opened), room_nocode and room_denied (a class this device could not open yet), wrapped_shared (a semester recap shared) and invite_share (a tap on Invite a friend). The invite link itself is lmktoday.app/?from=friend plus your school's web address, so your friend's setup can skip the school question; it never names you, and LMK cannot tell who invited whom.

LMK's server also keeps tallies of its own in the same form, a word and a day, when one of its features is used: for example Sync from anywhere being connected, a calendar link being read, a morning note being sent or someone joining their first class. Inside claude.ai the counter is off entirely. When it opens, the app also fetches one small settings file from the same server (an announcement, the store link, whether classmates lists are on); that request carries nothing about you.

Crash reports

If the web app at lmktoday.app hits an error, it sends LMK's server the app's build number, a short label for the part of the app that failed, and the error message, cut to 300 characters. Nothing in it identifies you or your device. An error message is written by the code, not by you, but it can occasionally quote a few characters of the data being read. The server keeps them as a count of identical reports per day, so problems can be traced over time. Inside claude.ai nothing is sent.

A random id for your device

When you finish the welcome screen, the app makes a random id and a random secret for your device. LMK's server keeps the id, a one-way hash of the secret and the date it first saw them, so it can tell that a request about your classes or your morning note comes from you, and from your other devices once they share your synced LMK data. It carries no name, no email and no coursework.

How your school's site answers

When the extension reads a Brightspace school, it tells LMK's server, at most once every 30 days per school from each browser and once more after each update of the extension: the school's web address, the extension's version, which of Brightspace's API routes answered (each route with its numeric ids taken out, its status code, how many items it returned, and the names of its fields, never their values), and how many courses and assignments came back and how many of those have a due date, a submission or a grade. If the extension can't read a Brightspace school, or a school address you added yourself, and it has never read that school in your browser, it sends the same kind of report once a day until it can: the address, the version, whether it tried Canvas's or Brightspace's reader, the status code it stopped on, the first part of the page's path with numbers taken out (like /d2l/home), and the routes it reached, with no counts. It carries no name, no id, no title, no grade and nothing that identifies you; the address identifies the school. The server keeps one row per school (the latest report, how many reports have arrived, and when the first and last came), read on the admin side only. That is how LMK gets fixed for a school nobody who builds it can log in to.

No AI on a server, and nothing sent to one

LMK does not send your assignments, your notes or your grades to an AI model. The grade maths, the estimates and the ranking all run on your own device from what your school's site already gave you. Where LMK offers to open Claude, ChatGPT or Gemini with a prepared prompt, nothing is sent by LMK: the prompt is shown to you first, and it travels only if you click, to the service you picked, under their terms.

Chrome's built-in AI (optional, off unless you turn it on on that computer). Recent versions of Chrome on a computer come with a small AI model that runs on the computer itself. If you turn it on from "From your classes" on Today, LMK gives that model each recent announcement, with the titles and due dates of that class's open assignments, so it can point out a moved due date, new work or a cancellation. The model runs inside Chrome on your computer: LMK sends nothing anywhere to use it, and what it reads does not leave your computer. LMK checks every suggestion against the announcement's own words, and nothing in your plan changes until you tap a button. The suggestions are kept with the rest of your LMK data, on your device and, if you signed in with Google, in your own Drive file, so your phone can show what your laptop read. Chrome downloads the model from Google once (about 4 GB) under Google's terms for Chrome. Turn it off on the same card; "No thanks" keeps the offer away on that computer.

What it never does

• It never sends anything to LMK's server beyond what this page names, and never sends your data to any advertising or analytics service.
• It never sells, rents, or shares personal information with anyone. The one thing you can choose to show to other people is the classmates entry described above, to people confirmed to be in the same course, and only after you join.
• It never submits work or changes your coursework in Canvas or Brightspace. The one thing it ever creates is the "LMK" access token, and only while Sync from anywhere is on.
• It never runs on sites other than your school's Canvas or Brightspace, a school address you approve yourself, and LMK's own pages.

Permissions, and why

These are everything the extension in the Chrome Web Store asks Chrome for:

• storage: to keep the collected assignment data and minute tallies in your browser between visits.
• alarms: to wake the extension to re-read your school's site in the background about every 15 minutes (every half hour before version 0.9.12), to show the morning notification, and to close the background tab described above if a sign-in does not finish.
• notifications: to show that morning notification on your computer.
• identity: to let you sign in with Google for Keep your phone fresh. The sign-in token stays in the extension.
• scripting: to run LMK's reader on a school address you approved yourself, and nowhere else.
• canvas.asu.edu, instructure.com and brightspace.com addresses: to read your assignments through the site's own API in your own session, to time work on assignment pages, and to show LMK's card on Canvas pages.
• lmktoday.app: to hand the collected data to the LMK page you open there.
• dvnson.github.io: LMK's old address. It now redirects to lmktoday.app, so the extension has nothing left to do there; the permission dates from before the move.
• Optional access to other https sites: Chrome lists this as an optional permission for all sites. LMK asks for it only when you choose to add your school's own Canvas or Brightspace address, and then only for that one address, after you type it on the extension's own page and Chrome shows you what it grants.

The private build LMK's author runs also asks for claude.ai, where his own copy of the app runs, and for the course-tool sites named above. It is not distributed.

Who processes data for LMK

• Cloudflare runs LMK's server and its database, and forwards mail sent to hello@lmktoday.app. Like any web host it sees the network address of each request; LMK does not store it. The database keeps point-in-time backups for up to 30 days, so anything deleted from LMK's server is also gone from its backups within 30 days.
• Google, for your Drive files, Google sign-in and Google Calendar if you use them. Google also hosts the mailbox behind hello@lmktoday.app. (LMK's web fonts are served from lmktoday.app itself, so loading a page asks Google for nothing.)
• GitHub Pages hosts the lmktoday.app website and app.
• The Chrome Web Store distributes the extension.
• Browser push services (Apple, Google, Mozilla) deliver the optional morning note on a phone.

LMK takes no new payments and has nothing to buy. Before 14 September 2026 it sold an optional plan through Stripe, which holds those subscribers' card details and email (LMK never saw either). The few records LMK kept of those payments (Stripe's reference numbers, the plan, its dates and the amounts, against the payer's random id) are still in its database, where nothing reads or adds to them.

How long things are kept

• In your browser and your Drive: until you delete them (see below).
• Sync from anywhere: until you turn it off, or write to hello@lmktoday.app. If you don't, it is deleted automatically once nothing has read it for 180 days (neither LMK nor your calendar subscription), or once Canvas has refused the token for 30 days in a row.
• Classmates entry and sessions: until you leave the class. Reports: deleted automatically 180 days after they are made; write to have yours deleted sooner.
• Morning note: until you turn it off or the push service says the browser is gone.
• Crash reports (the app's version and the error's message, counted per day): deleted after 90 days.
• Usage counts: kept as daily totals that identify no one, also per school once ten devices there have used LMK.
• Brightspace school report: one row per school, replaced by each newer report.

Deleting your data

• In your browser: removing the extension deletes everything it stored; clearing the site data for lmktoday.app deletes what the app stored.
• In your Google Drive: delete LMK-data.json and LMK-canvas.json, or revoke LMK's access in your Google account.
• Sync from anywhere: turn it off under the gear. Removing the extension does not delete the server copy, and the server keeps reading Canvas with the token until the token is deleted or stops working. So turn Sync from anywhere off first. If the extension is already gone, delete the "LMK" token in Canvas (Account → Settings → Approved Integrations) and email hello@lmktoday.app.
• Classmates: leave each class you joined.
• Morning note: turn it off in LMK.
• Anything else held under your random id, or everything at once: email hello@lmktoday.app. LMK holds no name or email, so include the support code the gear shows when Sync from anywhere is on, or describe what to look for (for example, the class you joined and the name you used there).

Usage counts and anonymous course statistics (which exist only inside the claude.ai copy) cannot be traced back to you, so they are not deleted individually.

Changes and contact

If this policy changes, the date at the top changes with it. Questions: hello@lmktoday.app.