BAP AI Tutor Smart Importer Privacy Policy

1. Single Purpose

The BAP AI Tutor - Smart Importer extension's single purpose is to import user-selected learning materials into the user's BAP study workspace and authenticate the user to BAP for that purpose. This includes chosen course content from supported learning-management systems and, after an explicit review action, an exact text selection or source link from the current web page.

2. Chrome Web Store Limited Use Release Gate

The Chrome Web Store User Data Policy, including the Limited Use requirements, requires an extension to limit user-data use and transfer to its disclosed single purpose. It also prohibits humans from reading user data unless the user gives explicit consent to read specific data or another narrow listed exception applies.

Current source policy and automated authorization tests route student-imported raw files through one owner-private boundary across direct reads, byte serving, conversion, retrieval, clone, and sharing paths. The exact packaged runtime still requires clean-profile two-user validation. Exact-origin Chrome prompt validation, legal review, and Chrome Web Store policy review also remain open. Only after those gates pass may the production policy include the affirmative Limited Use compliance statement Chrome requires.

The required production commitments are:

1. use or transfer extension data only to provide or improve the extension's prominently disclosed user-facing features;
2. do not use or transfer extension data for purposes unrelated to the extension's single purpose;
3. do not use or transfer extension data to determine creditworthiness or for lending purposes;
4. do not sell extension data or use or transfer it for personalized or targeted advertising, including retargeting and interest-based advertising;
5. do not allow humans to read user data without explicit consent to read the specific data, except for aggregated and anonymized internal operations, security needs, or legal compliance as allowed by the Limited Use requirements; and
6. do not use extension data to train general-purpose machine-learning or AI models.

3. Supported Websites

The production extension's built-in content scripts and required host access are limited to these websites, declared in the extension's manifest.json:

• https://bap.best/*: for BAP sign-in and account connection.
• https://itblnvzmwxszmwzboyuf.supabase.co/*: for the extension's BAP authentication session.
• https://*.gradescope.com/*: for Gradescope imports.
• https://*.instructure.com/*: for Canvas imports.
• https://brightspace.nyu.edu/*, https://*.brightspace.com/*, and https://*.d2l.com/*: for Brightspace / D2L imports.
• https://*.blackboard.com/*: for Blackboard imports.
• https://classroom.google.com/*: for Google Classroom imports.

The extension requests the fixed hosts above by default. Its current manifest also declares the optional HTTPS host envelope https://*/* for custom campus LMS domains. This optional permission is not granted at install. After a user action, the handler requires the exact active HTTPS origin and a supported LMS fingerprint before requesting that one origin. Unknown, changed, mismatched, and unverifiable pages receive no permission prompt. Release still requires validation of the exact Chrome prompt in a clean installed profile.

The separate private page-review flow uses Chrome's temporary activeTab access after you choose "Review page content." It does not request or retain host permission for that web page. Known sensitive pages are blocked. Unknown application surfaces are link-only.

4. Permissions And Why We Use Them

Permissions the extension does not request, and capabilities it does not have:

• No cookies permission.
• No history, topSites, or browsingData access.
• No microphone, camera, geolocation, or USB access.
• No literal <all_urls> pattern. The optional HTTPS-wide host envelope and its release blocker are disclosed above.
• No externally_connectable entry: websites cannot directly send messages to the extension's background service worker.
• No remote-code execution and no remote module loading.

5. Data We Collect Or Process

The extension collects or processes the following data only when needed for sign-in, extension operation, or user-initiated import flows. Categories below match the Chrome Web Store data-disclosure taxonomy.

6. Data We Do Not Collect

• We do not collect your LMS password.
• We do not collect health, medical, fitness, or insurance information.
• We do not collect financial or payment information through the extension. Subscription billing on the BAP web app is handled by Stripe directly; the extension is not involved.
• We do not collect precise location, GPS coordinates, or nearby-device information.
• We do not collect biometric identifiers such as faceprints, voiceprints, or fingerprints.
• We do not collect general web-browsing history. Built-in flows process the supported LMS page involved in a user-initiated or explicitly enabled import. Unknown custom pages fail closed before any optional permission request.
• We do not log keystrokes, mouse movement, or form input.
• We do not capture screenshots, broad DOM snapshots, images, audio, video, or PDF bytes in the private page-review flow. Those media types are represented as source links only.
• We do not embed third-party advertising pixels, analytics SDKs, or tag managers in the extension.

7. How Sign-In Works

When you choose BAP sign-in, the extension starts Google OAuth through Chrome's identity API. It validates a random state value and a one-time nonce, then sends the returned Google ID token directly to Supabase Auth. Supabase returns the BAP session used for authenticated API requests.

Application code does not message the Google ID token or Supabase session to BAP web pages, LMS pages, or content scripts. The BAP web app can send a sign-out intent through an origin-restricted message, but it cannot read extension credentials.

The Supabase client stores its session under a dedicated key in trusted chrome.storage.session and refreshes it before expiry. That storage is unavailable to content scripts and is cleared when the browser session ends. Sign-out removes the local session even if the remote Supabase sign-out request fails. Limited non-credential settings, including your account email, backend URL, and import preferences, remain in chrome.storage.local.

The same trusted browser-session storage holds up to twelve bounded page-review drafts so a service-worker restart does not lose a user-visible review. A draft contains the source receipt and, when applicable, the exact selected text and anchors. Each draft expires after 15 minutes. Changing the active tab or origin invalidates the reviewed draft before save. BAP clears all drafts on sign-out, removes a cancelled draft, and strips selected text from a successfully saved draft. Drafts also disappear when the browser session ends.

8. LMS Download Handling

The packaged extension uploads an LMS file only while an explicit import job started from the side panel is active. Downloads outside an active import remain normal local downloads and are not uploaded to BAP. Older installations may retain a retired auto-upload preference in local storage, but the packaged runtime does not read it and it cannot authorize background upload.

9. AI And BAP Backend Processing

After content reaches your BAP account, the BAP backend may send selected content (your prompt, a relevant retrieved passage from the imported file, and the conversation context) to AI service providers (currently Anthropic, PBC and Google LLC) to answer your tutor questions and generate study artifacts. We use these providers under commercial-API terms that prohibit them from using your content to train their general-purpose foundation models. The extension itself does not call any AI provider.

Full details of how BAP processes content after import (including AI providers, retention, sub-processors, and your data-subject rights) are in the BAP web-app privacy policy at bap.best/privacy.

10. Remote Code

The extension does not use remote code. All extension JavaScript, WebAssembly, and HTML are bundled inside the Chrome extension package distributed through the Chrome Web Store. The extension does not load externally hosted scripts, does not execute strings with eval or new Function, does not insert remote HTML through innerHTML or document.write, and does not use any remote module loader.

11. Where Data Is Sent

Imported materials and metadata are sent over HTTPS to BAP backend servers operated for BAP by OVHcloud US, LLC, and to Supabase (authentication, Postgres database, object storage, and vector storage), so that the materials can be stored and shown in BAP. Exact web selections and source links are stored as private, student-added resources within the chosen course context and are not exposed to classmates or staff through that association. Student-imported raw files are routed through the same owner-private policy across direct and derived reads. Clean-profile two-user validation of the exact package remains required before submission.

Authentication transactions go to Google OAuth and Supabase Auth. Authenticated BAP API requests go to the BAP backend.

Beyond that, the extension does not transmit your data to any third party. The extension does not contact AI providers, analytics services, ad networks, or other third-party APIs directly. All third-party processing (AI providers, payment processor, email transport) happens server-side and is described in the BAP web-app privacy policy.

12. Data Retention And Deletion

• Authentication tokens stored by the extension expire automatically and are removed when the browser session ends. Sign-out removes the local session even if remote Supabase sign-out fails. Clearing extension storage or uninstalling the extension also removes the local copy.
• Private page-review drafts expire after 15 minutes and never outlive the browser session. Changing the active tab or origin invalidates a reviewed draft. Cancelling removes the draft, signing out clears all drafts, and saving strips selected text after the backend accepts it.
• Local extension settings remain in chrome.storage.local until you change them, sign out, clear extension storage, or uninstall the extension.
• Files and metadata that the extension has imported into your BAP account are governed by the retention rules in the BAP web-app privacy policy. You can delete them inside the BAP web app or by emailing [email protected].

13. Your Choices And Controls

• You choose when to start an import from the extension side panel.
• You can select or deselect detected courses, assignments, files, and supported content before importing.
• You can start page review explicitly, inspect the exact selection or link and provenance, choose a private course context, switch to link-only when available, or cancel without saving.
• You can sign out of BAP from the extension at any time.
• You can keep ordinary LMS downloads local by not starting an import. The packaged runtime cannot upload a download outside an active user-started import.
• You can uninstall the extension at any time, which removes all extension-local storage from your browser.
• You can delete imported materials from your BAP account through the BAP web app.

14. Children And Minors

The BAP service is intended for users 18 and older. The extension is offered as a companion to BAP and is not directed to children under 13. We do not knowingly collect personal information from a child under 13 through the extension. If you believe a child under 13 has used the extension to send personal information to BAP, contact [email protected] and we will delete that information promptly. Additional COPPA, parental-consent, and minor-protection rules are described in the BAP web-app privacy policy.

15. Student Records And Institutional Use

The extension is intended to help users access and organize materials they are authorized to view. You are responsible for ensuring you only import materials you are permitted to use in BAP under your school's acceptable-use policy. Where federal or state student-records laws apply (for example, FERPA in the United States), use BAP consistently with those obligations and your school's instructions. Where your school contracts with BAP, BAP can operate as a "school official" under 34 CFR § 99.31(a)(1)(i)(B); see the BAP web-app privacy policy, Section 11.

16. Security

The extension uses OAuth state validation, one-time nonces, HTTPS endpoints, Supabase authentication, trusted browser-session credential storage, and an extension-page Content Security Policy of script-src 'self'; object-src 'self'. Auth failures cross the extension boundary only as fixed messages with allowlisted code and status metadata. It does not request cookie access or the literal <all_urls> pattern. Exact-package two-user validation, exact-origin Chrome prompt validation, legal review, and Chrome Web Store policy review remain pre-release gates.

If you discover a security issue, please email [email protected].

17. International Users

The BAP service is operated from the United States. If you install the extension while located outside the United States, the data the extension sends to BAP will be transferred to and processed in the United States. The international-transfer safeguards described in the BAP web-app privacy policy, Section 14 apply.

18. Changes To This Policy

We may update this policy as the extension changes. When we make material changes, we will update the "Last updated" date above and publish the revised policy at this URL. Where required by law, we will also notify users in-product or by email.

19. Contact

For privacy questions or data-deletion requests, contact [email protected] or [email protected]. Use the subject line "Privacy request" so we can route your message correctly.

Operator. The BAP service and this extension are operated by BAP, Inc., a Delaware corporation. For privacy questions and legal notices, contact [email protected].