BAP AI Tutor Smart Importer Privacy Policy

1. Single Purpose

The BAP AI Tutor — Smart Importer extension's single purpose is to import user-selected course content (courses, assignments, due dates, files, and supported discussion-topic information) from a small list of supported learning-management systems into the user's BAP study workspace, and to authenticate the user to BAP for that purpose.

2. Chrome Web Store Limited Use Compliance

BAP's use and transfer of information received from Google APIs and from any LMS site accessed by the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Specifically, BAP certifies that information collected, transferred, or processed by the extension:

1. is used or transferred only to provide or improve the user-facing features of the extension that are prominent in the extension's Chrome Web Store listing and user interface;
2. is not used or transferred for purposes unrelated to the extension's single purpose;
3. is not used or transferred to determine creditworthiness or for lending purposes; and
4. is not sold and is not used or transferred to serve personalized or targeted advertising, including retargeting and interest-based advertising.

We do not allow humans to read user data, except: (a) with the user's affirmative opt-in consent; (b) where strictly necessary to investigate security, abuse, fraud, or compliance with applicable law; (c) where the data has been aggregated and is used for internal operations consistent with the Limited Use rules; or (d) where strictly necessary to comply with applicable law.

We do not use extension data to train general-purpose machine-learning or AI models.

3. Supported Websites

The production extension is limited to these websites, declared in the extension's manifest.json:

• https://bap.best/* — for BAP sign-in and account connection.
• https://*.gradescope.com/* — for Gradescope imports.
• https://*.instructure.com/* — for Canvas imports.
• https://brightspace.nyu.edu/*, https://*.brightspace.com/*, and https://*.d2l.com/* — for Brightspace / D2L imports.
• https://*.blackboard.com/* — for Blackboard imports.
• https://classroom.google.com/* — for Google Classroom imports.

The extension does not request <all_urls> or any other broad host permission, and it does not run on unrelated browsing pages.

4. Permissions And Why We Use Them

Permissions the extension does not request, and capabilities it does not have:

• No cookies permission.
• No history, topSites, or browsingData access.
• No microphone, camera, geolocation, or USB access.
• No <all_urls> or wildcard host access.
• No externally_connectable entry — websites cannot directly send messages to the extension's background service worker.
• No remote-code execution and no remote module loading.

5. Data We Collect Or Process

The extension collects or processes the following data only when needed for sign-in, extension operation, or user-initiated import flows. Categories below match the Chrome Web Store data-disclosure taxonomy.

6. Data We Do Not Collect

• We do not collect your LMS password.
• We do not collect health, medical, fitness, or insurance information.
• We do not collect financial or payment information through the extension. Subscription billing on the BAP web app is handled by Stripe directly; the extension is not involved.
• We do not collect precise location, GPS coordinates, or nearby-device information.
• We do not collect biometric identifiers such as faceprints, voiceprints, or fingerprints.
• We do not collect general web-browsing history outside the supported BAP and LMS domains.
• We do not log keystrokes, mouse movement, or form input.
• We do not embed third-party advertising pixels, analytics SDKs, or tag managers in the extension.

7. How Sign-In Works

When the extension needs BAP authentication, it opens the BAP web app at https://bap.best/auth/extension. If you are not signed in, the BAP web app asks you to sign in. After successful web sign-in, the BAP backend issues a short-lived Firebase custom token that the extension exchanges for a Firebase ID token.

Authentication messages travel only between the BAP web app's tab and the extension's content script using window.postMessage with strict origin allowlisting and one-time nonce checks. Tokens are not put into page URLs, are not shared with third-party sites, and are not exposed to any other origin.

Authentication tokens are stored in chrome.storage.session when available so they expire when the browser session ends. Limited local settings — your account email, backend URL, and import preferences — are stored in chrome.storage.local.

8. Optional LMS Download Auto-Upload

The extension can optionally upload supported LMS file downloads into your BAP cloud library. This setting is off by default. When off, the extension only uploads files that you explicitly select inside the side-panel import UI. When you turn it on, the extension processes file-download events that Chrome reports for the supported LMS hosts listed above. You can turn it off at any time from the extension popup.

9. AI And BAP Backend Processing

After content reaches your BAP account, the BAP backend may send selected content (your prompt, a relevant retrieved passage from the imported file, and the conversation context) to AI service providers — currently Anthropic, PBC and Google LLC — to answer your tutor questions and generate study artifacts. We use these providers under commercial-API terms that prohibit them from using your content to train their general-purpose foundation models. The extension itself does not call any AI provider.

Full details of how BAP processes content after import — including AI providers, retention, sub-processors, and your data-subject rights — are in the BAP web-app privacy policy at bap.best/privacy.

10. Remote Code

The extension does not use remote code. All extension JavaScript, WebAssembly, and HTML are bundled inside the Chrome extension package distributed through the Chrome Web Store. The extension does not load externally hosted scripts, does not execute strings with eval or new Function, does not insert remote HTML through innerHTML or document.write, and does not use any remote module loader.

11. Where Data Is Sent

Imported materials and metadata are sent over HTTPS to BAP backend servers operated for BAP by OVHcloud US, LLC, and to Google Cloud (Firebase Authentication, Firestore, Cloud Storage), so that the materials can be stored in your BAP account and shown in your BAP workspace.

Authentication transactions go to the BAP backend and to Firebase Authentication.

Beyond that, the extension does not transmit your data to any third party. The extension does not contact AI providers, analytics services, ad networks, or other third-party APIs directly. All third-party processing — AI providers, payment processor, email transport — happens server-side and is described in the BAP web-app privacy policy.

12. Data Retention And Deletion

• Authentication tokens stored by the extension expire automatically and are cleared when you sign out of BAP from the extension or uninstall the extension.
• Local extension settings remain in chrome.storage.local until you change them, sign out, clear extension storage, or uninstall the extension.
• Files and metadata that the extension has imported into your BAP account are governed by the retention rules in the BAP web-app privacy policy. You can delete them inside the BAP web app or by emailing [email protected].

13. Your Choices And Controls

• You choose when to start an import from the extension side panel.
• You can select or deselect detected courses, assignments, files, and supported content before importing.
• You can sign out of BAP from the extension at any time.
• You can disable the optional LMS download auto-upload from the extension popup.
• You can uninstall the extension at any time, which removes all extension-local storage from your browser.
• You can delete imported materials from your BAP account through the BAP web app.

14. Children And Minors

The BAP service is intended for users 18 and older. The extension is offered as a companion to BAP and is not directed to children under 13. We do not knowingly collect personal information from a child under 13 through the extension. If you believe a child under 13 has used the extension to send personal information to BAP, contact [email protected] and we will delete that information promptly. Additional COPPA, parental-consent, and minor-protection rules are described in the BAP web-app privacy policy.

15. Student Records And Institutional Use

The extension is intended to help users access and organize materials they are authorized to view. You are responsible for ensuring you only import materials you are permitted to use in BAP under your school's acceptable-use policy. Where federal or state student-records laws apply (for example, FERPA in the United States), use BAP consistently with those obligations and your school's instructions. Where your school contracts with BAP, BAP can operate as a "school official" under 34 CFR § 99.31(a)(1)(i)(B); see the BAP web-app privacy policy, Section 11.

16. Security

The extension uses origin-restricted authentication messaging with one-time nonces, scoped Chrome permissions, HTTPS endpoints, Firebase authentication, least-privilege host access, and an extension-page Content Security Policy of script-src 'self'; object-src 'self'. The production extension does not request <all_urls>, does not request cookie access, and does not run on arbitrary websites.

If you discover a security issue, please email [email protected].

17. International Users

The BAP service is operated from the United States. If you install the extension while located outside the United States, the data the extension sends to BAP will be transferred to and processed in the United States. The international-transfer safeguards described in the BAP web-app privacy policy, Section 14 apply.

18. Changes To This Policy

We may update this policy as the extension changes. When we make material changes, we will update the "Last updated" date above and publish the revised policy at this URL. Where required by law, we will also notify users in-product or by email.

19. Contact

For privacy questions or data-deletion requests, contact [email protected] or [email protected]. Use the subject line "Privacy request" so we can route your message correctly.

Operator. The BAP service and this extension are operated by BAP, Inc., a Delaware corporation. For privacy questions and legal notices, contact [email protected].