What we know about you.

Changes taking effect 28 October 2026.

• Margin Study. If you turn on Margin Study's sync, part of the Margin Pass, we keep the dates of your exams and a rough result for each topic, under random ids, until the end of the term. Names, titles, grades and scores stay in your browser. If you never turn it on, nothing changes for you. The full list is under “What we collect”. We announced this on a card in the extension.

Changes taking effect 27 October 2026.

• Circles. If you use Circles, part of the Margin Pass, we keep the display name you type, your circles and memberships, and the start and end times of your focus blocks until the end of the term. The full list is under “What we collect”. We announced this on a card in the extension.

Changes taking effect 24 October 2026.

From that date, two things change in this policy.

• An optional setup checklist. The plugin has a switch, Help us see if Margin works, in Settings → Diagnostics. It is off unless you turn it on. Our server accepts no checklist before this date. After it, if the switch is on, the plugin sends a few small reports, listed in full under “What we collect”, and one last note if you turn it off again. Your coursework is not part of it.
• How we tell you about changes. We tell you about meaningful changes in the extension, and by email where we have your address. Both changes on this list were announced on one card in the extension. See “Changes to this policy”.

Everything on our side, by design.

The path your data takes is deliberately short. No Margin server stores or reads your assignments, course names, exam titles or grades. The one exception is Margin Study's sync, which is off until you turn it on. If you do, we keep your exam dates and a rough result for each topic, solid, mixed or weak, under random ids, and use them to plan your study blocks. Margin Study's free readiness estimate is worked out in your browser, from your own checks and the scores the plugin already sees. It sends nothing to our server. Your assignments move from your school's class portal, to your browser plugin, to your Todoist, to your device, using your own credentials at every step. We do run a small control plane for sign-in and device sync. It holds your account and plan, your devices and their settings, your encrypted Todoist token, and the record of any license key you've redeemed — never your assignments. Here's the full accounting:

The browser plugin reads your already-signed-in session with your school's LMS, the same way you read it. We never see your university password and we never log you in. The plugin then writes those assignments to your Todoist using your Todoist OAuth token. The device reads from Todoist using the same token — and writes back one thing: when you mark an assignment done on the device, it completes that task in your Todoist. It writes nothing else. To save you from re-typing it on the device, our control plane relays that token, encrypted at rest, and only to a device you've claimed under your account. Your assignments never pass through us.

Two sign-ins are involved, and we handle them differently. Your Google sign-in just proves who you are: we verify the one-time token Google sends, store your email and the account ID Google provides, and throw the token away. Your Todoist token is the one we keep a copy of, encrypted, for the single purpose of handing it to a device you own so you don't have to type it in. Your LMS login is never a token we touch at all; the plugin just uses the session already open in your browser.

One exception: error reporting. We report application errors and health signals to ourselves so we can find and fix bugs. It's on by default, and it's yours to switch off. Two narrow streams, and nothing else:

• The plugin sends a redacted error log — crashes, failed syncs, plugin errors — to our own error monitor. Tokens, secrets, and sign-in links are stripped before anything leaves your browser, and your account identity is never in it.
• The device sends metadata-only health signals — a render crash, an unhealthy feed, a clock that failed to sync — as fixed fields that cannot carry coursework or anything personal.

No coursework, task contents, or personal data is ever part of this. It's on by default, used only for fixing bugs; you can turn it off any time in Settings → Diagnostics.

Off unless you switch it on: the setup checklist. If you turn on Help us see if Margin works in Settings → Diagnostics, the plugin sends a short checklist at day 7 and day 30 after you install it, and, if you have held a Pass that has ended, once more 14 days after it ends. That is at most four sends in the life of an install, counting the final note described below. It is never sent with an account, token, or cookie.

The day-7 checklist holds: the plugin version; the week you installed (the week, not the day); which setup steps you have finished, from this list: installed, onboarding opened, signed in, Canvas connected, sources chosen, Todoist connected, first sync worked, first assignment synced, preview page opened, Pass line seen, “Get the Margin Pass” clicked, Pass activated; a rough time bucket for how long the first assignment took to arrive (under an hour, under a day, one to three days, longer, or none); whether you have never held a Pass, hold one now, or held one that ended; which kinds of source you use (Canvas, a calendar feed, or another kind of course site); and rough counts, in buckets (none, 1–5, 6–20, more), of failed syncs, page-layout changes the plugin could not read, and times it needed you to sign in again. The day-30 and Pass-ended checklists hold the same, minus the plugin version, the time bucket, and the source kinds.

Nothing in it names you, your school, your classes, or your assignments. Our server counts each checklist toward totals for that install week and keeps only the totals. It discards the checklist itself. Your network address reaches the server, as it does for any request, and is used only to limit how often one address can send; it is held in memory and is not stored. We do not call this anonymous: when only a few people install in a given week, that week’s counts can describe a single person.

Turning the switch off stops all of it. It sends one final note, which says only that the switch was turned off and the week you installed, and then nothing. Settings shows you exactly what the next checklist would contain.

One purpose, and that's the device.

What little data passes through anything we run is used for one thing: running your device and keeping it showing what's due. Your account signs you in and tracks your plan; your device settings and Todoist token get your dashboard set up and synced. That's the whole purpose. We don't use any of it for advertising, recommendations, training models, market research, or any other secondary purpose.

Specifically, we never:

• Sell your data to anyone, for any reason.
• Share your data with advertisers, brokers, or affiliates.
• Use your assignment titles to train AI models.
• Profile you, your study habits, or your academic performance.

These aren't aspirations. They're commitments. If we ever wanted to do any of these things, we'd have to update this policy and notify you first. We won't.

Where each piece of data lives.

Your academic data lives in five places. None of them is a server we operate:

• Your school's LMS (Canvas, Blackboard, D2L, or Moodle), where your assignments already live. We don't have an account there. The browser plugin reads your existing session, the way a tab in your browser would.
• Todoist, where your LMS assignments are mirrored. The browser plugin writes them using your own Todoist OAuth token. The device reads them the same way. Your tasks live in your own Todoist account, operated by Doist (the company behind Todoist) under their own privacy policy: doist.com/privacy. Doist is headquartered in the EU; data may be stored there.
• Your browser, where the plugin keeps its configuration: the LMS URL, your course-to-Todoist-project mapping, your Todoist OAuth token, and your sync preferences. The extension's sandboxed local storage — which no web page or other extension can read. We can't read any of this remotely.
• Your Margin device, in your room. Holds the Todoist OAuth token, Wi-Fi credentials, the iCal URLs you subscribed to, and a cached copy of the most recent assignment list for offline display. A factory reset wipes all of it.
• Whatever calendar service you point at the device (Apple, Google, Outlook, Proton, Notion, your school's academic calendar). The device reads the public iCal feed URL you gave it during setup. No account is created on either side.

And the two records we keep:

• The waitlist record, until device pre-orders ship. That's your email, the page you joined from and when, plus whichever of the three optional fields (school, who you're buying for, an open note) you chose to fill in. It is stored in our own database on our server in the European Union (Hetzner, Finland), the same server as the control plane below. The form reaches that server through Cloudflare, which handles the submission in transit. No academic data passes through it. Only the waitlist record.
• The control plane, the server we run, once you sign in and set up a device. It holds your account (the email and account ID from your Google sign-in, plus your plan status and any license key you've redeemed), your device records and settings (registry timestamps; theme, timezone, and — only if you turn on the optional weather widget, which is off by default — the city you chose for weather with its coordinates; any queued remote command), and your Todoist token, encrypted at rest. Its job is to sign you in, let you manage your device from the plugin, and hand the device its Todoist token so you don't type a key. No assignment titles, due dates, or grades ever pass through it.

Three outside services each handle one narrow thing:

• Google, who you sign in with. Google tells us your account email and a stable account ID, and nothing more; your password stays with Google. Their privacy practices: policies.google.com/privacy.
• Lemon Squeezy, the merchant of record, who handles any payment (a Margin Pass or a license key). They take the card, the tax, and the refund, and pass us your name, email, and an opaque reference that links the purchase to your account. We never see or store card numbers, and no academic data is part of a checkout. There is no payment processor on the free tier or the website preview at all.
• Open-Meteo, a free public weather API, reached only if you turn on the optional weather widget (off by default). With the widget on, the first time the device comes online it sends the city or region name you entered to Open-Meteo's geocoding service once, to look up coordinates; it then caches those coordinates and afterward sends only a fixed latitude and longitude to fetch the local forecast. No account, name, email, or other personal information is sent.

That's the complete list of outside services that touch your account or your data. Two pieces of our own infrastructure sit underneath: Cloudflare hosts the site, carries the waitlist form to our server, and counts page views (below), and a self-hosted error monitor catches crashes (the error reporting described earlier). Neither receives your coursework. No marketing pixels, no chat widgets, no data brokers.

On this website, Cloudflare also counts visits. Cloudflare Web Analytics adds a small script to these pages as Cloudflare serves them. It sets no cookies. What it gives us is aggregate counts: page views and visits, by page, referring site, country, browser, operating system, and device type, and how long pages take to load. It runs on margin.computer alone, never in the plugin or on the device.

The same accounting, integration by integration. The column that matters is the last one: where the data lives. Only one row points at a server we run, and that row holds a license check and a billing identity, never your coursework.

Plain durations. The numbers got smaller.

Real numbers:

• Assignment data is never on our servers, so there's no retention window to publish. It moves from your LMS into your Todoist and onto your device. Doist's retention rules cover the Todoist copy. Check theirs.
• Your waitlist record is kept until device pre-orders ship. That record is your email, the page you joined from and when, and whichever of the three optional fields you chose to fill in. It gets only the emails listed in section 01: word that the Pass is open, word when device pre-orders open, and one note in January if you ask for one. When we email you about ordering the device, the record transitions to either "ordered" or "didn't order" and we stop sending anything to that address. You can ask us to delete it sooner, at any time. No newsletter.
• Your account, device settings, and encrypted Todoist token stay on our control plane while your account is active. "Delete server data" in the plugin's settings removes all of it in one action, immediately; disconnecting Todoist deletes just the token, and revoking a device drops that device's settings and stops it from receiving the token. We don't keep backups beyond thirty days.
• Calendar feed contents pass through, they don't sit. The device fetches iCal URLs fresh on every refresh and discards the previous copy. We don't keep a history. We also can't, because we don't see them.
• Local device and plugin data (assignment cache, Wi-Fi credentials, your Todoist OAuth token, course-to-project mapping) lives where it lives until you remove the plugin or reset the device. A factory reset wipes the device clean. If you sell or give away your device, run the reset first.
• Circles block times are kept until the end of the term in which the block started, then deleted, even if you left the circle earlier. Your display name and memberships go when you leave or delete your account. The record of who joined a circle this term (for the Pass's two-swap limit) is kept to term end.
• Margin Study data is kept until the end of the term it belongs to, then deleted. If you turn the sync off and choose to delete, or delete your account, it goes at once. If you turn it off and choose to keep it, it stays only to the end of the term.

What you can ask us to do.

You can:

• See everything we have on you. Email us and we'll send you a complete export within seven days. In practice that's your waitlist email (if you joined), your account email and plan, any key you've redeemed, your device list, settings, and check-in timestamps, and your encrypted Todoist tokens, which we decrypt to set up your device and to keep your sync working — identifying your Todoist account and refreshing access, never reading your coursework. There's no profile, no behavioral data, no academic record on our side.
• Delete everything we hold, in one action. "Delete server data" in the plugin's settings removes your account (the email and Google account ID), your encrypted Todoist tokens, every device's settings and queued commands, and the records linking your purchase to your identity — immediately, no email required. Your devices return to their claim screens. The license key itself survives and can be redeemed again: the purchase outlives the account. Two smaller levers exist too: disconnecting Todoist in the plugin deletes the token, and revoking a device clears its claim. For the waitlist email, write to us and we'll remove it within seven days. No "backup" copies are kept after thirty days. For the data in Todoist, in your browser, and on your device, you delete it directly: revoke Margin's access from Todoist's settings page, uninstall the browser plugin, and factory-reset the device.
• Correct anything that's wrong. We rarely have anything to correct, but if something on our end looks off, tell us.
• Stop the sync without deleting anything. Just uninstall the browser plugin. The device will show its last cached state and stop receiving new assignments. Your Todoist stays as it was.

These rights apply to everyone, regardless of where you live. Not just people in California or the EU. We don't think basic data rights should depend on jurisdiction.

Practical measures, not promises.

The actual safeguards in place today:

• All data is encrypted in transit (HTTPS / TLS 1.2 or newer).
• Your stored Todoist token is encrypted at rest (AES-GCM), so a stolen copy of our database doesn't expose it.
• Every database query is scoped to your account and uses parameterized statements, so one person's data is not returned to another and injected input cannot cross that boundary.
• Passwords for university LMS accounts are never sent to us. The browser plugin uses your existing session.
• Local device files containing API tokens are stored in a non-world-readable location on the device's SD card.

What we don't claim: that we're impervious to breach. No company can honestly claim that. If a security incident affects your data, we'll tell you what happened, what we know, and what we're doing about it. Within seventy-two hours of confirming the breach. Not "as soon as practicable." Not "in due course." Within seventy-two hours.

Margin is for readers 13 and older.

We don't knowingly collect data from anyone under 13. If you're a parent or guardian and you believe your child has registered for Margin, email us and we'll delete the account and all associated data, no questions asked.

This policy aligns with COPPA (the U.S. Children's Online Privacy Protection Act). Schools and districts that wish to provide Margin to students under 13 should contact us first. We don't currently support that use case.

The world is bigger than the U.S.

Margin is operated from the United States. The control plane that holds your account, device settings, and encrypted Todoist token runs on servers in the European Union (Finland), and so does the waitlist record, in our own database on the same server (section 03). The waitlist form passes through Cloudflare's network on its way there. By joining the waitlist or signing in, you consent to the processing described here.

Your academic data is a different story. It flows from your browser to your Todoist to your device, and Doist is headquartered in the European Union. None of that data passes through any U.S. server we run.

For readers in the European Economic Area, the United Kingdom, or Switzerland: we process your waitlist email to perform the pre-order contract you entered into (you asked to be told when we ship), and we process your account and device data to provide the device you signed up for. Both rest on the legal basis of performing a contract with you. You have the rights described in section 05, plus the right to lodge a complaint with your local data protection authority.

For California residents: the rights in section 05 satisfy the requirements of the CCPA and CPRA (California's consumer privacy laws). We don't sell your data and we don't "share" it for cross-context behavioral advertising. There is no advertising on Margin.

How you'll know we changed something.

If we update this policy in any meaningful way (adding a new third party, changing what we collect, changing how long we keep it), we tell you in the extension, and by email where we have your address. The notice says what changed, in plain language, and links to the updated policy. The extension card and the email announce the same change.

Cosmetic edits (typos, clarifications, link fixes) don't count and won't trigger a notice. The "last updated" date at the top of this page reflects every change, cosmetic or otherwise.