Privacy Policy for Coursewake for CUNY Brightspace

Effective date: October 13, 2026
Contact: coursewake@blurxy.net
Developer: Coursewake

1. The short version

Coursewake is a browser extension for CUNY students. It makes Brightspace (brightspace.cuny.edu) and Schedule Builder (sb.cunyfirst.cuny.edu) calmer, and adds your WeBWorK grades (from your CUNY campus's own WeBWorK server, which Chrome asks you to allow the first time you sync) for courses that use it.
On Brightspace and WeBWorK it reads the information your own account can already see: your courses, grades, assignments, quizzes, calendar, announcements and WeBWorK grades. It keeps that in your browser.
Nothing is sent to the developer unless you choose it. Five things can send data, and each happens only because you did something: you open a professor or textbook card (a name or a book title goes to public websites), you turn on encrypted backup (an encrypted copy goes to our server), you send feedback (an encrypted report goes to us, and we file it in our private GitHub repository), you turn on anonymous counts (a few numbers a day go to us), or you import a theme from a GitHub link (GitHub is contacted).
A toolbar badge, a "Due soon" list and optional deadline reminders are worked out on your computer from what is already stored. Reminders are off until you turn them on, and Chrome asks to allow notifications then.
There are no analytics unless you turn on anonymous counts (section 5), no ads, no sale of data and no code loaded from the internet.
You can delete everything at any time (section 12).

2. Who we are, and who we are not

This is an independent project made by a student. It is **not affiliated with, endorsed by, sponsored by or approved by D2L Corporation or the City University of New York (CUNY)**, or by your college. Brightspace is a trademark of D2L Corporation. All D2L marks are trademarks of D2L Corporation. Please visit D2L.com/trademarks for a list of D2L marks. Other names belong to their owners.

3. What the extension reads

On Brightspace and WeBWorK the extension reads only after you have signed in yourself in the normal way, and only after you click Turn on in the first-run card (section 11). It uses your existing sign-in session. It never sees or stores your password.

What	Where it comes from	What it is used for
Your course list (course names, codes, dates)	Brightspace	Showing your current-term courses
Grades: grade items, points, weights, your displayed and final grades, and instructor comments attached to grades. Also the gradebook's grading system and, if it is weighted, its categories and weights	Brightspace "My Grades"	Grade estimates and the grades card
Assignments: names, due dates, instructions (as text and as the original HTML), attachment names and sizes, links, rubric names, submission status, scores, feedback text	Brightspace "Assignments"	Deadlines, "Copy for AI", feedback shown under each assignment
Quizzes: names, open and due dates, attempt counts, instructions	Brightspace "Quizzes"	Deadlines, quiz windows
Calendar events and "Work To Do" items	Brightspace	Deadlines, calendar (.ics) export
Announcements (title, and the first 2,000 characters of the text)	Brightspace "News"	The announcements card
Course content outline: due dates on modules, links to external tools, and syllabus text (up to 20,000 characters per course)	Brightspace "Content"	Finding deadlines, WeBWorK links, and a grading breakdown for grade estimates
Your own feedback on each assignment	Brightspace, when you open the Assignments list	Showing it under the assignment. To ask for it the extension asks Brightspace who you are. The answer includes your name and Brightspace id. The extension uses only the id, for that one request, and keeps neither.
WeBWorK: course name, your WeBWorK login name (as it appears in the page address), your grade table, set scores and open and due dates. From your Brightspace course's tool links: which WeBWorK server and course they point to	Your CUNY campus's WeBWorK server, once you have allowed that server in Chrome's prompt (Chrome asks one server at a time, the first time you sync a course that uses it): whenever you open a WeBWorK page there after turning Coursewake on, and when you choose "Sync WeBWorK"	Folding WeBWorK grades and deadlines into the dashboard
The schedule you are building: course codes, sections, days and times, instructor names, campus, seats, and the textbook title, author and price shown	The Schedule Builder page you are looking at	Course chips, the schedule summary, professor and textbook cards. Read from the page and not stored, apart from the lookup caches in section 4(a).
The text of the assignment or quiz page you are looking at	The page, only when you click Copy for AI there	Building the Markdown that goes to your clipboard
Your settings: theme, imported colour palettes, hidden courses, grade weights you confirm or enter, switches, a tester code if you entered one, and timestamps (when you last changed each setting, when you last saw the dashboard)	You	Remembering your choices

Your Brightspace name and Brightspace user id are not kept in the cached snapshot, the snapshot file or any backup.

On Brightspace, WeBWorK and Schedule Builder the extension only reads. It does not submit, edit, delete, enroll, pin or save anything there. It does not read your passwords, cookies or session tokens: the browser attaches your sign-in to the request itself, and the extension's code never reads it.

The extension also changes how those pages look: it applies a colour theme, hides the course banner image, the floating chat button, and a few homepage panels, widens pages, and puts the course code at the front of the browser tab title with a small coloured icon. This uses no data beyond the page itself.

4. Where the data is stored

(a) In your browser (always). The extension keeps a cached copy of the information above in chrome.storage.local, which is private storage that Chrome keeps inside your own browser profile for this extension. It is not shared with other extensions or websites. It also holds:

short-lived copies of professor lookups (kept up to 7 days) and textbook lookups (kept up to 30 days), which contain public information about instructors and books, including a small photo or cover;
feedback reports you wrote that have not been sent yet (section 8). These are not encrypted while they wait;
if reminders are on, the plan of upcoming reminders (assignment titles, course codes, times and page links), and the page link of each reminder already shown, kept 2 days so clicking it still opens the page.

While you are drawing on a feedback screenshot, the picture is held in Chrome's memory-only session storage, and it is cleared when you send it or close the browser.

(b) In Chrome's sync storage (only for encrypted backup). If you answer the backup question, the extension saves your yes or no in chrome.storage.sync. If you say yes, it also saves the random backup key there. Chrome syncs that storage through your Google account if you have Chrome sync on. Section 7 explains what the key does.

(c) In a file in your Downloads folder (only if you turn it on). If you switch on "Save a snapshot file for AI tools" in Settings, the extension writes the same information as one JSON file, Downloads/brightspace-plus/snapshot.json, and refreshes it automatically at most every 15 minutes, or whenever you click Refresh or Sync WeBWorK. It is off until you switch it on. **This file is plain text and is not encrypted.** Any program or person that can read your Downloads folder can read it, and if your computer backs up or syncs Downloads (for example with a cloud drive), that service will receive it. That is a setting of your computer, not of the extension. To make this file available the extension asks Chrome to hide the "download finished" notification for that one file, and removes the file's entry from Chrome's download list. The file itself stays on disk until you delete it.

(d) Small preferences on the school's sites. To avoid a white flash on page load, the extension stores short values in the browser's site storage. On brightspace.cuny.edu: bsp-theme (light or dark), bsp-theme-id (the palette you chose), bsp-theme-custom (the colours of an imported palette) and bsp-dash (whether you chose the classic homepage, and a list of page numbers it recognises as school home pages). On sb.cunyfirst.cuny.edu: cw-sb-look (whether the modern look is on, and the palette). They contain no grades or course content.

(e) Files you ask for. If you click "Export calendar", the extension saves one .ics file to your Downloads folder, like any other download. It lists your due dates and quiz windows, with reminders.

5. What leaves your browser

On a normal day, the only requests the extension makes are to the school's sites you are already using (Brightspace, WeBWorK, Schedule Builder), with your own sign-in. Those sites receive them as normal page requests and handle them under their own policies. Beyond that, data leaves your browser only in these cases:

When	Where it goes	What is sent	Your choice
You open a professor card, or you turn on instructor photos	The City Tech faculty directory (www.citytech.cuny.edu, for City Tech instructors only), ORCID (pub.orcid.org), OpenAlex (api.openalex.org), RateMyProfessors (www.ratemyprofessors.com)	The instructor's name. To OpenAlex and RateMyProfessors also the instructor's college, as an institution id. Nothing about you. With photos on, the City Tech directory is asked about each City Tech instructor shown on the page, whether or not you open a card.	Chrome asks first. The prompt covers all six sites in this table and the next row; you allow all or none.
You open a textbook card	Open Library (openlibrary.org, covers.openlibrary.org)	The book's title and its first author's surname. The cover is requested by Open Library's own id for the book.	Same prompt.
You click a link in a card ("Look them up", library, price comparison, OpenStax, search)	The site you chose (for example CUNY OneSearch, BookFinder, Google Books, Google Scholar, DuckDuckGo, RateMyProfessors, LinkedIn)	What the link carries: a search for the instructor's name, or the book's title, author or ISBN. Nothing is sent until you click.	You click.
You click Import with a GitHub link in Settings	raw.githubusercontent.com	A request for one file, or for up to five usual theme file names in turn for a repository link. GitHub sees your IP address, browser details and which file. A pasted theme file never leaves the browser.	You click Import.
You turn on encrypted backup	Coursewake Cloud (https://coursewake-cloud.coursewake.workers.dev)	Encrypted data (section 7). After that the extension checks the server every 30 minutes, and again when the browser starts, and uploads at most once an hour after something changes, or 30 minutes after an upload that failed. The first upload also counts toward a limit on new backups, using a keyed one-way hash of your IP address (section 7). Erasing the copy, or turning backup off, sends only the copy's id and token, to delete it; until the server confirms, that request is repeated every 30 minutes.	You answer yes.
You click Send feedback	Coursewake Cloud	An encrypted report (section 8). The service also sees your IP address, as any server does, and uses a keyed one-way hash of it to count reports (section 8).	You click Send.
You turn on Send anonymous counts (Settings, Privacy)	Coursewake Cloud, which stores the numbers in Cloudflare's Workers Analytics Engine	At most once a day: 19 numbers (how many courses you have this term; how many got their weights from the gradebook, the syllabus, you, or nowhere; how many syllabus files of each type were read; how many courses have WeBWorK and how many synced; how many courses or sources failed to load; whether backup, reminders and a tester code are on; the kind of theme; Chrome's major version), plus the day and Coursewake's version and build. No names, courses, schools, grades, page addresses or ids, and nothing that links one day's numbers to another's. The service does not store your IP address with them. Settings shows the exact report under "Exactly what's sent".	Off until you turn it on.

Each of those third-party sites receives your IP address and browser details, as any site does when it is contacted, and handles them under its own policy. We do not control them. The professor and book information that comes back is cached in your browser (section 4(a)).

RateMyProfessors' terms of use forbid automated access. Coursewake asks it for a professor's page only when you open a card, and links you to it. If RateMyProfessors blocks this, the card shows a link instead.

6. What we never do

We do not send your courses, grades, assignments or announcements to the developer, to D2L, to CUNY or to any third party, with two exceptions that only you can start: an encrypted backup you turn on (section 7) and a feedback report you send (section 8), which can include a screenshot you choose and mark up.
We do not sell or rent data, and we do not share it for advertising, profiling, credit or lending decisions.
We do not use third-party analytics, crash reporters, tracking pixels, advertising identifiers or any third-party library that talks to a network. The only counting is the anonymous counts in section 5, which are off unless you turn them on.
We do not load or run code from the internet. All the extension's code ships inside the extension. Anything fetched (theme files, professor and book data, images) is read as data only, and a theme file is reduced to hex colours.
We do not record the pages you visit or your keystrokes. The extension listens for the Ctrl+K (or Cmd+K) shortcut only, and does not keep what you type anywhere.
No person at the project can read your coursework data. It either never leaves your browser or leaves encrypted with a key we do not have. A person does read the feedback reports you choose to send.

7. Coursewake Cloud (encrypted backup)

Backup is off until you choose it. After you turn Coursewake on, a card asks "Have Coursewake on your other computers?" with two answers: "Turn on encrypted backup" or "Keep everything on this computer". You can change your mind in Settings, under Encrypted backup. Your answer is saved in Chrome sync storage, so all your computers follow it. You need to be signed into Chrome sync for a copy to reach your other computers.

How it works.

Your browser makes a random 32-byte key and keeps it in Chrome sync storage. The key never goes to our server.
From that key the extension works out three values: an id (where your copy is filed), a token (proof the copy is yours) and an encryption key. Your data is encrypted with AES-256-GCM in your browser before it is uploaded.
What goes in the copy: your settings (including imported palettes, hidden courses, grade weights, the badge and reminder switches, and any tester code), except four switches that stay on each computer (consent, the consent version, the developer audit switch and the snapshot-file switch); the times you last changed each setting; your cached courses, deadlines, grades and everything else in the snapshot (section 3, including instructor comments, assignment instructions, announcements, syllabus text and the WeBWorK login name); and the time you last saw the dashboard. Professor and book lookups, queued feedback reports and files are not included.
What our server keeps: the id, the SHA-256 hash of the token, a version number, the time of the last write, and the encrypted data (up to 1.5 MB). It cannot read the data. It does not keep your name, email or school.
Who can read it. Our server holds data it cannot open. Google's Chrome sync holds the key but not the data. Reading the data would take both. We do not have access to your Chrome sync data.
Where it runs. The service runs on Cloudflare Workers, Cloudflare KV and a Cloudflare Durable Object (a small database that holds the counters below). Like any web host, Cloudflare handles the network request, so it sees your IP address and when you connect. The service's own code does not store IP addresses and does not log request contents. It reads the connecting IP address only to count requests per visitor (when a backup is first created, and for feedback reports and tester-code checks), and uses only a keyed one-way hash of it (section 8). For a new backup or a report without a tester code it keeps that hash with a counter for two days. To know how many backups it holds, the counter database also keeps each backup's id and the date its copy expires, and deletes the entry with the copy.
Limits on new backups. A visitor can start up to 50 new backups a day, and the service holds a limited number in all. When it is full, a new backup waits (Settings shows that the last sync failed) and existing backups keep working.
Which copy wins. If two computers change things, the newer deadlines and grades win, and each setting follows whichever computer changed it last.

Erasing it. Settings, Encrypted backup, Erase my cloud copy deletes the copy on our server, then deletes your key, and turns backup off on all your computers. Turning backup off erases the copy the same way; everything stays on this computer, and turning backup on again makes a new random key. Your key is deleted only after our server confirms the copy is gone. If the server cannot be reached or does not confirm, nothing is reported as erased. Erase my cloud copy says it could not erase and changes nothing. Turning backup off still stops all uploads at once, but your key is kept, Settings says "A copy is still on the server until it can be erased", and Coursewake tries again every 30 minutes, on any of your computers where it is installed, until the server confirms.

If you remove the extension without erasing first, or while Settings still says a copy is on the server, the encrypted copy stays on our server, unreadable. Because the id comes from your key, we cannot tell which stored copy is yours, so we cannot find and delete it on request. A copy that is not updated for 12 months is deleted automatically; every sync starts the 12 months again.

If you are not signed into Chrome sync, the key stays on this computer only. If you lose this browser profile you lose the key, and the copy can no longer be opened. Everything except your settings and typed-in weights can be fetched again from Brightspace.

8. Feedback

The Coursewake toolbar popup has Send feedback about this page (keyboard shortcut Alt+Shift+F). Anyone can use it, without an account or a code. (Invited beta testers have a tester code that tags their reports; the store version has no place to enter one.)

What a report holds.

A screenshot of the tab you were looking at when you clicked the button. It can be any tab, not only a school site. You can draw on it and use Hide to cover private details with a solid block. Only the flattened image is kept; the original and your drawing steps are not.
Your note and a category (Looks, Something's broken, Idea, Other).
If you leave "Include technical details" ticked: the extension version and build, your tester code, the page address without anything after "?", the page title, your browser name and version, your operating system, your screen size, your theme and dashboard view, and whether your dashboard data loaded completely. If you untick it, only the version and the tester code go. The editor shows exactly what will be sent before you send it.

How it is protected. Your browser encrypts the report with the developer's public key (ECDH P-256 with AES-GCM) before it leaves. Only the developer's private key, which is kept off the extension and off the repository, opens it; the copy the developer then files on GitHub is not encrypted (below). For each report the service stores the encrypted report, its size, the time it arrived, and a label: the tester code if there is one, otherwise the word "public".

Who can send. Anyone. A report with no tester code is accepted, up to 50 a day (8 MB) per visitor and 300 (25 MB) a day in total. To tell visitors apart for that limit the service reads the connecting IP address and turns it into a keyed one-way hash (HMAC-SHA-256 with a secret only the service holds, with the day mixed in), not the address itself. Without the secret the address cannot be worked out from the hash, even by trying every possible address, and one day's hash does not match the next day's. The service keeps the hash and a counter for two days. A report with a recognised tester code is limited to 40 a day per code. A code the service does not recognise is refused and nothing is kept. Every report and every tester-code check also counts towards a limit of 20 a minute per visitor, kept by Cloudflare's rate limiter under the same hash, never the address.

Reports that cannot be sent. A report waits in this browser's local storage, up to 10 at a time, and the extension tries again every 15 minutes. It is not encrypted while it waits. Removing the extension deletes it.

What the developer does with it. The developer opens reports to fix and improve Coursewake, and nothing else. A script on the developer's computer decrypts each new report and files it as an issue in the developer's private repository on GitHub (github.com), so it can be tracked and fixed; a report with the same note about the same page as an issue that is still open is added to it as a comment instead. The issue holds your note, the category, the technical details, the label and the report's id, and the screenshot is uploaded to GitHub as an image attached to the issue. From then on this copy is not protected by the developer's key: GitHub keeps it behind the repository's access settings and under GitHub's own privacy statement. It can be seen by the developer, by anyone the developer gives access to that repository, and by the AI coding assistants the developer uses there, which read issues to help fix them.

How long it is kept. The developer's script deletes the encrypted copy on Coursewake Cloud once it has filed the report and found its screenshot on GitHub. A copy that is not filed is deleted automatically 14 days after it arrives if it was sent without a tester code, and 90 days after if it was sent with one. Each time the script runs (normally once a day), before it files anything new, it deletes the issues labelled "feedback" that are more than 90 days old, comments included; if it does not run or cannot reach GitHub, they wait for the next run. Deleting an issue does not guarantee that GitHub deletes the screenshot file uploaded with it: the script does not delete that file, and GitHub may keep it. Copies made while fixing a report, such as a note quoted in a code change or kept in an AI assistant's session history, are not covered by this deletion.

9. The clipboard ("Copy for AI")

When you click a Copy for AI button, the extension writes Markdown text to your clipboard: your due dates and grade estimates, or the instructions of the one assignment or quiz page you are on, or, on a professor card, what the card shows about the instructor and a short request to an assistant. It does this only when you click, it never reads your clipboard, and it does not send the text anywhere. What happens next depends on where you paste it. If you paste it into an AI service or any other app, that service's own privacy policy applies, and the text may include grades or coursework, so check your course and school rules about using AI tools before you do.

10. Permissions, and why each one is requested

Permission	Why
`storage`	Keep the cached snapshot, your settings, WeBWorK grades, the text of syllabus files you had already opened (to find the grading breakdown), lookup caches and waiting feedback reports in your browser, and your backup choice and key in Chrome sync storage.
`downloads`	Save the `.ics` calendar you ask for and, if you enable it, the snapshot file in Downloads.
`downloads.ui`	Hide Chrome's download notification while the snapshot file is refreshed, so you are not interrupted every 15 minutes. Used only when the snapshot file is turned on.
`activeTab`	Take the screenshot for Send feedback about this page, when you click it or press its shortcut (Alt+Shift+F). Chrome grants it for that tab and that click or key press only.
`alarms`	Repaint the toolbar badge every 15 minutes, fire deadline reminders you turned on, run the encrypted-backup sync and feedback retries, and, only if you turned on anonymous counts, check every 6 hours whether today's have gone yet, because Chrome stops idle extension workers.
`unlimitedStorage`	Hold feedback screenshots that are waiting to send. Chrome's normal limit is 10 MB.
`offscreen`	Open one hidden page that runs the PDF reader (Mozilla's pdf.js, bundled in the extension) on a syllabus PDF you had already opened in Brightspace, to find the grading breakdown. It shows nothing and is used for nothing else.
`scripting`	After you allow a CUNY WeBWorK server, add Coursewake's WeBWorK grade reader to that one server, and remove it again if you take the permission back. Used for nothing else.
Access to `https://brightspace.cuny.edu/*`	Show the dashboard, themes and search on Brightspace pages and read your own data from them.
Access to `https://sb.cunyfirst.cuny.edu/*`	Restyle Schedule Builder and add course chips, a schedule summary, and professor and textbook cards, from what the page already shows.
Optional, asked the first time you open a card: `www.citytech.cuny.edu`, `pub.orcid.org`, `api.openalex.org`, `openlibrary.org`, `covers.openlibrary.org`, `www.ratemyprofessors.com`	Look up the instructor or book on a card you opened (section 5). Chrome shows one prompt for all six. If you refuse, the cards still show links.
Optional, asked one server at a time, the first time you sync a course whose WeBWorK is on a CUNY server: that campus's WeBWorK server (a `cuny.edu` address, or `webwork.lehman.edu`). The manifest declares `https://.cuny.edu/` and `https://webwork.lehman.edu/`; Coursewake asks Chrome for the single server, for example `https://webwork.ccny.cuny.edu/`	Read your own WeBWorK grades and assignment list on that server, read-only. A small Coursewake window names the server before Chrome's prompt asks you to confirm. If you refuse, WeBWorK stays a link in your course.

notifications is optional. It is not asked at install. Chrome asks only when you turn on Deadline reminders in Settings, and the permission is used only to show those reminders and the test reminder. If you refuse, reminders stay off.

The extension does not request access to any other website, except a CUNY WeBWorK server that you allow, one at a time (above).

11. Your consent

The first time you use Brightspace after installing, the extension shows a card, "Turn on Coursewake?", that says it reads your courses, deadlines, grades and announcements from Brightspace with your own login and keeps them in this browser. It reads nothing from Brightspace or WeBWorK until you click Turn on. "Not now" hides the card for the rest of that browser tab's session. You can turn Coursewake off any time in Settings, under Privacy, with **Turn off and clear data**. After you turn it on, a second, separate question asks about encrypted backup (section 7).

Reminders need a further yes of their own: switching them on in Settings makes Chrome ask whether Coursewake may show notifications.

Some things do not wait for that card because they read only the page you are on and keep nothing from it: the colour theme, the hiding of banners and panels, tab titles, and the Schedule Builder look and cards. Looking up a professor or a book needs your permission in Chrome's prompt (section 5).

If a future version changes how data is handled, this policy is updated and the extension shows a notice about it (section 16).

12. How long data is kept, and how to delete it

Data is kept until you delete it. It is refreshed each time you use Brightspace, and the snapshot file (if enabled) is overwritten each time. Professor lookups are reused for 7 days and book lookups for 30 days; an older copy is replaced the next time that lookup is made.

To delete	Do this
The cached snapshot and WeBWorK data in the browser	Open the extension's Settings and click Clear cached data. Your settings and the text of syllabus files Coursewake read are kept.
The above, plus professor lookups and the dashboard's "last seen" time, and withdraw consent	Settings, Privacy, Turn off and clear data. Your settings, book lookups, the text of syllabus files Coursewake read and any waiting feedback reports are kept.
Feedback reports waiting to send	Settings, Feedback, Delete them (shown only while some are waiting).
Anonymous counts	Turn off Send anonymous counts (Settings, Privacy); nothing more is sent. Numbers already sent carry no id that links them to you, so they cannot be found or deleted one by one; Cloudflare's Workers Analytics Engine deletes them after three months.
Everything Coursewake stores in this browser, and the optional permissions you allowed	Settings, Data, Remove all Coursewake data. Whenever a backup key exists, with backup on or off, it first asks the server to erase your cloud copy, and deletes the key with the rest of sync storage only once the server confirms. If it does not confirm, the key is kept, because it is the only way to find the copy: the page says what is left and offers Try again, and Coursewake keeps trying every 30 minutes while it is installed (section 7). It also clears local and session storage and withdraws the optional site and notification permissions. It does not delete files in Downloads or the small preferences on the school's sites.
Your backup copy on our server	Settings, Encrypted backup, Erase my cloud copy, or turn backup off. Do this before you remove the extension, and check that Settings no longer says a copy is still on the server (section 7).
Everything the extension stores in the browser	Remove the extension from chrome://extensions. Chrome deletes the extension's local storage when it is removed.
The snapshot file and any exported calendar	Delete the `Downloads/brightspace-plus` folder and the `.ics` file yourself. Neither Settings button deletes files in Downloads.
The small preferences on the school's sites	Clear site data for brightspace.cuny.edu and sb.cunyfirst.cuny.edu in Chrome's site settings.
A feedback report you sent	Ask us: coursewake@blurxy.net. Say roughly when you sent it and what it said. A report sent without a tester code carries only the label "public" and the time it arrived, so we can find it only by reading reports. We then delete its GitHub issue or comment and its encrypted copy; GitHub may keep the uploaded screenshot file (section 8).

13. Toolbar badge, due-soon list and deadline reminders

These use only what is already in your browser. They fetch nothing and send nothing.

Toolbar badge. After you turn Coursewake on, the toolbar icon shows a number: what is due in the next 24 hours, plus anything late that you can still hand in. It is amber, or red when something is late or due within 3 hours. Hovering over it shows a list with the course, the assignment title and the due time, and how fresh the data is. You can switch the badge off in Settings, under Reminders.
The popup. Clicking the toolbar icon shows a "Due soon" list of up to five items from the next 48 hours or late. Its links open only Brightspace or WeBWorK pages.
Reminders (off until you turn them on). If you switch on Deadline reminders in Settings, Chrome asks you to allow notifications. Coursewake then shows a notification the morning something is due (at 9:00, or at 8:00 PM the evening before for a deadline before 11:00) and 2 hours before, only for work you have not handed in as of its last refresh, and it checks again just before showing one. A reminder holds the assignment title, the course and the due time. Chrome and your operating system show it, so it may be visible on a locked screen, depending on your system settings. Clicking it opens that Brightspace or WeBWorK page. A reminder is never an advertisement. Settings has a button that sends a test reminder.
Scheduling. The extension keeps the plan of upcoming reminders (titles, course codes, times and links) in its local storage, and uses the alarms permission to wake itself up for them. After a reminder is shown it keeps that reminder's link and time for 2 days, so clicking the notification later still opens the page. Turning reminders off removes the scheduled ones and those links.

14. Security

Your cached data lives in your browser profile and, if you turn it on, in the plain-text snapshot file, so it is protected by your computer's account and disk protections. Keep your computer locked and your disk encrypted if the contents matter to you. Backup data is encrypted on your computer before upload (section 7). Feedback reports are encrypted before upload but wait unencrypted in browser storage until they send, and the copy the developer files on GitHub is not encrypted (section 8).

15. Children

The extension is meant for college students and is not directed at children under 13.

16. Changes to this policy

If this policy changes, the effective date above changes and the new version is posted at the same address. If a change affects how your data is handled, the extension will show a notice inside the extension.

17. Limited Use statement

Our use of the information described above adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: we use it only to provide the extension's single purpose (helping you keep on top of your CUNY coursework and course choices in one place), we do not transfer it to anyone except as you ask (an encrypted backup you turn on, a feedback report you send (kept on GitHub, section 8), anonymous counts you turn on, and the name of an instructor or the title of a book sent to the public sites in section 5 when you open a card), we do not use it for advertising, and no human reads your coursework data except what you choose to send in a feedback report (section 8).

18. Contact

Questions, or a request to delete something you cannot delete yourself: coursewake@blurxy.net