What we know about you.

Everything on our side, by design.

The data pipeline is deliberately tiny. No Margin server ever handles your academic data. Your assignments move from your school's class portal, to your browser plugin, to your Todoist, to your device, using your own credentials at every step. We do run a small control plane for sign-in and device sync. It holds your account and plan, your devices and their settings, your encrypted Todoist token, and the record of any license key you've redeemed — never your assignments. Here's the full accounting:

The browser plugin reads your already-authenticated session with your school's LMS, the same way you read it. We never see your university password and we never log you in. The plugin then writes those assignments to your Todoist using your Todoist OAuth token. The device reads from Todoist using the same token. To save you from re-typing it on the device, our control plane relays that token, encrypted at rest, and only to a device you've claimed under your account. Your assignments never pass through us.

Two sign-ins are involved, and we handle them differently. Your Google sign-in just proves who you are: we verify the one-time token Google sends, store your email and the account ID Google provides, and throw the token away. Your Todoist token is the one we keep a copy of, encrypted, for the single purpose of handing it to a device you own so you don't have to type it in. Your LMS login is never a token we touch at all; the plugin just uses the session already open in your browser.

One purpose, and that's the device.

What little data passes through anything we run is used for one thing: running your device and keeping it showing what's due. Your account signs you in and tracks your plan; your device settings and Todoist token get your dashboard set up and synced. That's the whole purpose. We don't use any of it for advertising, recommendations, training models, market research, or any other secondary purpose.

Specifically, we never:

• Sell your data to anyone, for any reason.
• Share your data with advertisers, brokers, or affiliates.
• Use your assignment titles to train AI models.
• Profile you, your study habits, or your academic performance.

These aren't aspirations. They're commitments. If we ever wanted to do any of these things, we'd have to update this policy and notify you first. We won't.

Where each piece of data lives.

Your academic data lives in five places. None of them is a server we operate:

• Your school's LMS (Canvas, Blackboard, D2L, or Moodle), where your assignments already live. We don't have an account there. The browser plugin reads your existing session, the way a tab in your browser would.
• Todoist, where your LMS assignments are mirrored. The browser plugin writes them using your own Todoist OAuth token. The device reads them the same way. Doist (the company behind Todoist) is the data processor for every assignment that passes through this pipeline. Their privacy practices: doist.com/privacy. Doist is headquartered in the EU; data may be stored there.
• Your browser, where the extension keeps its configuration: the LMS URL, your course-to-Todoist-project mapping, your Todoist OAuth token, and your sync preferences. Chrome's encrypted local storage. We can't read any of this remotely.
• Your Margin device, in your room. Holds the Todoist OAuth token, Wi-Fi credentials, the iCal URLs you subscribed to, and a cached copy of the most recent assignment list for offline display. A factory reset wipes all of it.
• Whatever calendar service you point at the device (Apple, Google, Outlook, Proton, Notion, your school's academic calendar). The device reads the public iCal feed URL you gave it during setup. No account is created on either side.

And on servers we do run:

• The waitlist record, until pre-orders open. That's your email plus whichever of the three optional fields (school, who you're buying for, an open note) you chose to fill in. Stored in a Supabase database with strict access controls so no one outside our team can read it. Supabase is a managed Postgres provider; we use them as a data processor only. Their privacy practices: supabase.com/privacy. No academic data passes through this database. Only the waitlist record.
• The control plane, once you sign in and set up a device. It holds your account (the email and account ID from your Google sign-in, plus your plan status and any license key you've redeemed), your device records and settings (registry timestamps; theme, timezone, and the city you chose for weather with its coordinates; any queued remote command), and your Todoist token, encrypted at rest. Its job is to sign you in, let you manage your device from the extension, and hand the device its Todoist token so you don't type a key. No assignment titles, due dates, or grades ever pass through it.

Three outside services each handle one narrow thing:

• Google, who you sign in with. Google tells us your account email and a stable account ID, and nothing more; your password stays with Google. Their privacy practices: policies.google.com/privacy.
• The merchant-of-record, who handles any payment (a Margin Pass or a license key). They take the card, the tax, and the refund, and pass us your name, email, and an opaque reference that links the purchase to your account. We never see or store card numbers, and no academic data is part of a checkout. There is no payment processor on the free Preview tier at all.
• Open-Meteo, a free public weather API. The first time the device comes online it sends the city or region name you entered during onboarding to Open-Meteo's geocoding service once, to look up coordinates; it then caches those coordinates and afterward sends only a fixed latitude and longitude to fetch the local forecast. No account, name, email, or other personal information is sent.

That's the complete list. There are no other third parties. No marketing pixels, no analytics scripts, no chat widgets, no data brokers.

The same accounting, integration by integration. The column that matters is the last one: where the data lives. Only one row points at a server we run, and that row holds a license check and a billing identity, never your coursework.

Plain durations. The numbers got smaller.

Real numbers:

• Assignment data is never on our servers, so there's no retention window to publish. It moves from your LMS into your Todoist and onto your device. Doist's retention rules cover the Todoist copy. Check theirs.
• Your waitlist record is kept until pre-orders ship. That record is your email plus whichever of the three optional fields you chose to fill in. When we email you about ordering, the record transitions to either "ordered" or "didn't order" and we stop sending anything to that address. You can ask us to delete it sooner, at any time. Never marketing.
• Your account, device settings, and encrypted Todoist token stay on our control plane while your account is active. "Delete server data" in the extension's settings removes all of it in one action, immediately; disconnecting Todoist deletes just the token, and revoking a device drops that device's settings and stops it from receiving the token. We don't keep backups beyond thirty days.
• Calendar feed contents pass through, they don't sit. The device fetches iCal URLs fresh on every refresh and discards the previous copy. We don't keep a history. We also can't, because we don't see them.
• Local device and extension data (assignment cache, Wi-Fi credentials, your Todoist OAuth token, course-to-project mapping) lives where it lives until you remove the extension or reset the device. A factory reset wipes the device clean. If you sell or give away your device, run the reset first.

What you can ask us to do.

You can:

• See everything we have on you. Email us and we'll send you a complete export within seven days. In practice that's your waitlist email (if you joined), your account email and plan, any key you've redeemed, your device list, settings, and check-in timestamps, and your encrypted Todoist tokens, which we decrypt to provision your device and to keep your sync working — identifying your Todoist account and refreshing access, never reading your coursework. There's no profile, no behavioral data, no academic record on our side.
• Delete everything we hold, in one action. "Delete server data" in the extension's settings removes your account (the email and Google account ID), your encrypted Todoist tokens, every device's settings and queued commands, and the records linking your purchase to your identity — immediately, no email required. Your devices return to their claim screens. The license key itself survives and can be redeemed again: the purchase outlives the account. Two smaller levers exist too: disconnecting Todoist in the extension deletes the token, and revoking a device clears its claim. For the waitlist email, write to us and we'll remove it within seven days. No "backup" copies are kept after thirty days. For the data in Todoist, in your browser, and on your device, you delete it directly: revoke Margin's access from Todoist's settings page, uninstall the browser plugin, and factory-reset the device.
• Correct anything that's wrong. We rarely have anything to correct, but if something on our end looks off, tell us.
• Stop the sync without deleting anything. Just uninstall the browser plugin. The device will show its last cached state and stop receiving new assignments. Your Todoist stays as it was.

These rights apply to everyone, regardless of where you live. Not just people in California or the EU. We don't think basic data rights should depend on jurisdiction.

Practical measures, not promises.

The actual safeguards in place today:

• All data is encrypted in transit (HTTPS / TLS 1.2 or newer).
• Your stored Todoist token is encrypted at rest (AES-GCM), so a stolen copy of our database doesn't expose it.
• The database is configured so one person's data can't be read by another, even if a query is misformed or compromised.
• Passwords for university LMS accounts are never sent to us. The browser plugin uses your existing session.
• Local device files containing API tokens are stored in a non-world-readable location on the device's SD card.

What we don't claim: that we're impervious to breach. No company can honestly claim that. If a security incident affects your data, we'll tell you what happened, what we know, and what we're doing about it. Within seventy-two hours of confirming the breach. Not "as soon as practicable." Not "in due course." Within seventy-two hours.

Margin is for readers 13 and older.

We don't knowingly collect data from anyone under 13. If you're a parent or guardian and you believe your child has registered for Margin, email us and we'll delete the account and all associated data, no questions asked.

This policy aligns with COPPA (the U.S. Children's Online Privacy Protection Act). Schools and districts that wish to provide Margin to students under 13 should contact us first. We don't currently support that use case.

The world is bigger than the U.S.

Margin is operated from the United States. The waitlist database is hosted on Supabase (U.S.-region servers), and the control plane that holds your account, device settings, and encrypted Todoist token also runs in the United States. If you use Margin from outside the U.S., joining the waitlist or signing in means that data is transferred to and stored in the United States. By doing so, you consent to this transfer.

Your academic data is a different story. It flows from your browser to your Todoist to your device, and Doist is headquartered in the European Union. None of that data passes through any U.S. server we run.

For readers in the European Economic Area, the United Kingdom, or Switzerland: we process your waitlist email to perform the pre-order contract you entered into (you asked to be told when we ship), and we process your account and device data to provide the device you signed up for. Both rest on the legal basis of performing a contract with you. You have the rights described in section 05, plus the right to lodge a complaint with your local data protection authority.

For California residents: the rights in section 05 satisfy the requirements of the CCPA and CPRA (California's consumer privacy laws). We don't sell your data and we don't "share" it for cross-context behavioral advertising. There is no advertising on Margin.

How you'll know we changed something.

If we update this policy in any meaningful way (adding a new third party, changing what we collect, changing how long we keep it), we'll email every active reader at least thirty days before the change takes effect. The email will say what changed, in plain language, and link to a diff of the old and new policies.

Cosmetic edits (typos, clarifications, link fixes) don't count and won't trigger an email. The "last updated" date at the top of this page reflects every change, cosmetic or otherwise.