Discussion Export for Canvas

The Short Version

The sections below describe exactly what the extension touches and why, so you can verify the claim rather than take it on faith.

What the Extension Accesses

The extension does nothing at all until you click its toolbar icon. It has no background activity, no scheduled tasks, and no access to any page you have not explicitly invoked it on.

When you click the icon on a Canvas discussion page

• The content of that page. The extension reads the page's HTML in order to reformat it. For a discussion, that means the topic, the replies, and each poster's display name, avatar image and post date.
• The discussion from your Canvas server's own API. The extension requests /api/v1/…/discussion_topics/… from the same Canvas site you are already signed in to. This is how it retrieves replies that Canvas has not yet loaded into the page, so long threads export completely.

That request goes to your institution's Canvas server — the same one already shown in your address bar — using the session you already have. It is not routed through Sparebrain or anywhere else, and no Sparebrain server is involved at any point.

Where That Information Goes

Nowhere. It is held in your browser and used to render one page.

• Session storage. The captured discussion is placed in chrome.storage.session for the few seconds between your click and the export tab rendering. Session storage is used deliberately: Chrome clears it when the browser closes and does not write it to disk.
• Local storage. One value is kept between sessions — the colour theme you picked, for example "orange". That is the only thing that persists, and it contains nothing about you or your courses.

The exported page is generated in your browser and exists only in that tab. Printing or saving it as a PDF is handled entirely by Chrome; the file goes wherever you choose to save it, and the extension never sees it.

Permissions, and Why Each One Is Needed

• activeTab — grants access to the single tab you are viewing, only at the moment you click the icon. This is what allows the extension to avoid requesting standing permission to your browsing.
• scripting — runs one function in that tab to read the discussion and request it from the Canvas API. It reads and returns data; it does not modify the Canvas page.
• storage — the session and local storage described above.

The extension requests no host permissions. It cannot read tabs in the background, and it has no access whatsoever to any site until you click the icon on it.

Requests Made by the Export Page

For completeness, the export page your browser renders loads two kinds of resource from outside your Canvas server. Neither one receives any of your discussion content; both receive only the ordinary metadata that accompanies any web request, such as your IP address and browser version.

• Styling from jsDelivr. The page loads a stylesheet and web fonts from cdn.jsdelivr.net to lay out the export.
• YouTube thumbnails. If a discussion post embeds a YouTube video, the export shows that video's thumbnail image from img.youtube.com in place of the player, so the printed page is not blank where the video was. This happens only when a post actually contains an embed, and the request carries only the video ID that was already in the discussion.

Images and files attached to the discussion are loaded from your Canvas server, exactly as they were on the original page.

What the Extension Does Not Do

• It does not send data to Sparebrain. There is no Sparebrain server, endpoint, or database associated with this extension.
• It does not sell, rent, or transfer your data to anyone.
• It does not use analytics, telemetry, tracking pixels, or crash reporting.
• It does not create accounts, set cookies, or build a profile of you.
• It does not use your data to determine creditworthiness or for lending purposes.
• It does not use or transfer your data for any purpose unrelated to producing the export you asked for.
• It does not run on any site other than a Canvas discussion page, and never without your click.

Student Records

Canvas discussions frequently contain student names, photographs and coursework, which in the United States are protected educational records under FERPA and elsewhere by comparable law.

The extension never transmits that material anywhere. However, an export you save or print is an ordinary document under your control, and you remain responsible for handling it in accordance with your institution's policies — particularly before sharing it, posting it, or including it in anything published.

Changes to This Policy

If the extension's behaviour changes in a way that affects this policy, this page will be updated and the "last updated" date above revised. Material changes will also be reflected in the extension's Chrome Web Store listing.

Contact

Questions about this policy, or about how the extension works, are welcome at support@sparebrain.org.

Discussion Export for Canvas is an independent tool. It is not affiliated with, endorsed by, or sponsored by Instructure, Inc. “Canvas” is a trademark of Instructure, Inc., used here only to identify the platform this extension works with.