← Back to Deskside

Privacy and terms

Last updated: September 2026

Deskside is a free dashboard that shows your Canvas grades, a GPA calculator, assignments and announcements, and (once connected) Google Classroom coursework and announcements and, optionally, a digest of your unread Gmail. It was made by an individual student developer and is not affiliated with, endorsed by, or sponsored by Instructure, Canvas, Google, Google Classroom, Gmail, or Schoology. This page is written in plain language by the project's author, who is not a lawyer.

The short version

Deskside works two ways. Quick look needs no account: your Canvas token lives only in an encrypted cookie in your own browser, and Deskside's servers store nothing about you. An account (email/password or Google sign-in) lets you connect more than one data source and keep them connected between visits; doing that means Deskside's database now holds an encrypted copy of each connected credential, protected so that even Deskside's own code can only ever unlock the signed-in user's own data. Neither mode sells or shares your information, and neither runs ads or trackers.

Quick look: what happens when you connect

• You give Deskside your Canvas address and an access token you created in your Canvas settings.
• Deskside checks the token with your school's Canvas, then stores the address and token in a cookie in your browser. The cookie is encrypted, is only readable by Deskside's server, and is marked HttpOnly, Secure and SameSite=Strict.
• Each time the dashboard loads, your browser sends that cookie to Deskside. The server decrypts it in memory, asks your school's Canvas for your courses, grades, assignments and announcements, formats them, and sends them straight back to you. That data is not stored or logged by Deskside.
• Deskside only ever contacts the Canvas address you entered. It does not read your Canvas password (you never enter it here).

Accounts: what happens when you connect

• Creating an account (email/password, or "Continue with Google") is handled by Supabase, the company that provides Deskside's login system and database. Supabase stores your email address and, if you use a password, a securely hashed copy of it — Deskside's own code never sees your plain-text password.
• Connecting Canvas from the "Connected accounts" page works like Quick look, except the token is encrypted and saved in Deskside's database (via Supabase) instead of a cookie, so it's there the next time you sign in on any device.
• Connecting Google sends you to Google's own consent screen, listing exactly what Deskside is asking to read: your class list, coursework, and announcements, and — only if you tick the separate, optional checkbox for it — your unread Gmail (sender, subject and a short preview only; Deskside never opens or stores the full message, and never asks to send email on your behalf). Google then gives Deskside a token that only Google — not you and not this app's other users — can trace back to your Google account. That token is encrypted the same way before it's stored. Deskside cannot see or change your Classroom work or your Gmail, and never asks for more access than reading those things.
• If you enter your school's name on the Schoology waitlist card, that name and your account are saved so the developer can follow up if Schoology ever opens self-serve access. Nothing else is collected for this.

What is stored, and where

• Quick look, in your browser (cookie): your encrypted Canvas address and token, for up to 30 days.
• Either mode, in your browser (local storage): your schedule, GPA what-if changes, which assignments you checked off, which digest messages you've read, and (Quick look only) the last Canvas address you typed. This stays on your device and is never sent to Deskside.
• Accounts only, in Deskside's database (hosted on Supabase): your email address; for each connected source, an encrypted credential plus the non-secret details needed to show you what's connected (your Canvas address, or your Google account's email and the specific permissions you granted); your Schoology waitlist entry, if you submitted one. Every one of these rows is restricted by database rules so that only your own signed-in session can ever read or change it — not other users, and not Deskside's own application code taking a shortcut around those rules.
• Neither mode: Deskside does not store your grades, assignments, announcements or messages. Each time your dashboard loads, they're fetched fresh from Canvas or Google Classroom and sent straight to you, not saved anywhere in between.
• Ordinary hosting logs: Deskside runs on Vercel, which, like any web host, briefly processes technical request information such as IP addresses to deliver the site and protect it from abuse. Confirmation emails for new accounts are sent through Resend, a transactional email service. Deskside itself uses no analytics, advertising or tracking scripts.

Your controls

• Quick look — Sign out (avatar menu) deletes the cookie. Sign out and erase data on this device also deletes your saved schedule and settings. Use that one on shared or school computers.
• Accounts — Disconnect any source from the "Connected accounts" page at any time; its encrypted credential is deleted immediately (Google connections are also revoked with Google itself, not just forgotten locally), and Deskside stops reading it right away. Sign out and erase data on this device additionally clears your locally saved schedule and settings.
• Revoke access at the source: in Canvas, remove the token under Account → Settings → Approved Integrations; for Google, remove Deskside's access at myaccount.google.com/permissions. Either cuts Deskside off immediately, even if you forget to disconnect it here first.
• Delete your account entirely: there's no self-serve button for this yet — email the address below and it will be done by hand, including removing your stored credentials and Supabase account. If you'd rather not wait, disconnecting every source and revoking access at Canvas/Google achieves the same practical result today.
• Clearing your browser's site data for this page removes everything stored on your device, in either mode.

Keep your token safe

An access token or a granted Google permission works like a password for the parts of your account it can reach. Only connect sources through sites you trust, disconnect or revoke them when you're done, and don't share your login. Deskside encrypts every credential in transit and at rest, but no system is perfectly secure.

Age and school rules

Deskside is meant for students. If you're under 13, ask a parent, guardian or teacher before creating an account or connecting a data source. Some schools have rules about third-party tools, or turn off student access tokens for Canvas; check yours. Deskside only connects to a data source when you, the student, choose to grant it access from your own account — it never receives a bulk export or class roster directly from a school, and schools are not customers of Deskside. You are responsible for following your school's policies.

Terms

• Deskside is provided "as is" with no warranty and no promise it will always work or be available.
• Grades and dates come from Canvas and Google Classroom and may be delayed or wrong. The GPA calculator is an estimate for your own planning, not an official transcript, and schools calculate GPA differently. Check important numbers directly with your school.
• Google Classroom access is read-only: Deskside cannot submit, grade, or change anything in your classes. Gmail access (optional) is also read-only: Deskside can see the sender, subject and a short preview of your unread mail, but never opens, stores, sends, or deletes a message.
• While Deskside's Google integration is unverified by Google, it may only be usable by a small, fixed list of test accounts and could stop working without notice until that review is complete.
• Don't use Deskside to access anyone else's account, to overload Canvas or Google, or to break the law or your school's rules. The service may be limited or stopped for anyone who does.
• The developer may change or shut down Deskside, or any single integration, at any time.

Contact

Questions, problems, or account deletion requests: matthiasjgarzon@gmail.com