What we know about you.

Changes taking effect 28 October 2026.

• Margin Study. If you turn on Margin Study's sync, part of the Margin Pass, we keep the dates of your exams and a rough result for each topic, under random IDs, until the end of the term. Names, titles, grades and scores stay in your browser. If you never turn it on, nothing changes for you. The full list is under “What we collect”. We announced this on a card in the plugin.

Changes taking effect 27 October 2026.

• Circles. If you use Circles, part of the Margin Pass, we keep the display name you type and your circles and memberships while you're in a circle, and the start and end times of your focus blocks until the end of the term. The full list is under “What we collect”. We announced this on a card in the plugin.

Changes taking effect 24 October 2026.

From that date, two things change in this policy.

• An optional setup checklist. The plugin has a switch, Help us see if Margin works, in Settings → Diagnostics. It is off unless you turn it on. Our server accepts no checklist before this date. After it, if the switch is on, the plugin sends a few small reports, listed in full under “What we collect”, and one last note if you turn it off again. Your coursework is not part of it.
• How we tell you about changes. We tell you about meaningful changes in the plugin, and by email where we have your address. Both changes on this list were announced on one card in the plugin. See “Changes to this policy”.

Everything on our side, by design.

The path your data takes is deliberately short. No Margin server stores or reads your assignments, course names, exam titles or grades, apart from one known gap in error reports, described below. One exception is Margin Study's sync, which is off until you turn it on. If you do, we keep your exam dates and a rough result for each topic, solid, mixed or weak, under random IDs, and use them to plan your study blocks. Margin Study's free readiness estimate is worked out in your browser, from your own checks and the scores the plugin already sees. It sends nothing to our server. If you use Circles, a circle’s name is whatever its owner types, so it could name a course. Your assignments move from your school's class portal, to your browser plugin, to your Todoist, to your device, using your own credentials at every step. We do run a small control plane for sign-in, device sync and the Pass's features. It holds your account and plan, your license key records, your devices with their settings and health, and your encrypted Todoist token, plus your Circles and Margin Study records if you use them — never your assignments. Here's the full accounting:

The browser plugin reads your already-signed-in session with your school's LMS, the same way you read it. We never see your university password and we never log you in. The plugin then writes those assignments to your Todoist using your Todoist OAuth token. The device reads from Todoist using the same token — and writes back one thing: when you mark an assignment done on the device, it completes that task in your Todoist. It writes nothing else. To save you from re-typing it on the device, our control plane relays that token, encrypted at rest, and only to a device you've claimed under your account. Your assignments never pass through us, apart from the one known gap in error reports described below. The other exception is the course pages research testers choose to give us (see Anthropic in section 03).

Two sign-ins are involved, and we handle them differently. Your Google sign-in just proves who you are: we verify the one-time token Google sends, store your email and the account ID Google provides, and throw the token away. Your Todoist token is the one we keep a copy of, encrypted, for the single purpose of handing it to a device you own so you don't have to type it in. Your LMS login is never a token we touch at all; the plugin just uses the session already open in your browser.

One exception: error reporting. We report application errors and health signals to ourselves so we can find and fix bugs. It's on by default, and it's yours to switch off. Two narrow streams, and nothing else:

• The plugin sends a redacted error log — crashes, failed syncs, plugin errors — to our own error tracker. Tokens, secrets, and sign-in links are stripped before anything leaves your browser, and your account identity is never in it. A report can include the address the plugin was reading on your school's course site, since that is often where an error happens. Your network address reaches the server, as it does for any request, and is used only to limit how often one address can send; it is held in memory and is not stored.
• The device sends metadata-only health signals — a render crash, an unhealthy feed, a clock that failed to sync — as fixed fields that cannot carry coursework or anything personal.

We keep coursework and task content out of it, with one known gap: a rare sync error can carry the title of the assignment it was about. We're closing that gap and will update this page when it is closed. Neither the error log nor the device health events carry an account or device ID, and our error tracker keeps both for 90 days. Each device’s latest health report is also kept with that device’s record (see the device item above). It's on by default, used only for fixing bugs; you can turn it off any time in Settings → Diagnostics.

Off unless you switch it on: the setup checklist. If you turn on Help us see if Margin works in Settings → Diagnostics, the plugin sends a short checklist at day 7 and day 30 after you install it, and, if you have held a Pass that has ended, once more 14 days after it ends. That is at most four sends in the life of an install, counting the final note described below. It is never sent with an account, token, or cookie.

The day-7 checklist holds: the plugin version; the week you installed (the week, not the day); which setup steps you have finished, from this list: installed, onboarding opened, signed in, Canvas connected, sources chosen, Todoist connected, first sync worked, first assignment synced, preview page opened, Pass line seen, “Get the Margin Pass” clicked, Pass activated; a rough time bucket for how long the first assignment took to arrive (under an hour, under a day, one to three days, longer, or none); whether you have never held a Pass, hold one now, or held one that ended; which kinds of source you use (Canvas, a calendar feed, or another kind of course site); and rough counts, in buckets (none, 1–5, 6–20, more), of failed syncs, page-layout changes the plugin could not read, and times it needed you to sign in again. The day-30 and Pass-ended checklists hold the same, minus the plugin version, the time bucket, and the source kinds.

Nothing in it names you, your school, your classes, or your assignments. Our server counts each checklist toward totals for that install week and keeps only the totals. It discards the checklist itself. Your network address reaches the server, as it does for any request, and is used only to limit how often one address can send; it is held in memory and is not stored. We do not call this anonymous: when only a few people install in a given week, that week’s counts can describe a single person.

Turning the switch off stops all of it. It sends one final note, which says only that the switch was turned off and the week you installed, and then nothing. Settings shows you exactly what the next checklist would contain.

Used to run Margin. Nothing else.

What we hold is used to run Margin for you. Your account signs you in and tracks your plan; your device settings and Todoist token get your dashboard set up and synced; and, if you use them, your Circles records run your circles and Margin Study's sync plans your study blocks. Error diagnostics are used to fix bugs, and the weekly Circles totals and the optional setup checklist tell us whether Margin works. That's all of it. We don't use any of it for advertising, recommendations, training models, market research, or any other secondary purpose. Course pages that research testers give us are used only for the study their consent form describes.

Specifically, we never:

• Sell your data to anyone, for any reason.
• Share your data with advertisers, brokers, or affiliates.
• Share your data with anyone else without your consent, apart from the outside companies named in section 03, each for the job described there, or where the law requires it.
• Use your assignment titles to train AI models.
• Profile you, your study habits, or your academic performance. Margin Study’s topic results, if you turn its sync on, are used only to plan your own study blocks.

These aren't aspirations. They're commitments. If we ever wanted to do any of these things, we'd have to update this policy and notify you first. We won't.

Where each piece of data lives.

Your academic data lives in these five places, and none of them is a server we operate. If you turn on Margin Study's sync or use Circles, their records sit on our control plane, described after the list:

• Your school's LMS (Canvas, Blackboard, D2L, or Moodle), where your assignments already live. We don't have an account there. The browser plugin reads your existing session, the way a tab in your browser would.
• Todoist, where your LMS assignments are mirrored. The browser plugin writes them using your own Todoist OAuth token. The device reads them the same way. Your tasks live in your own Todoist account, operated by Doist (the company behind Todoist) under their own privacy policy: doist.com/privacy. Doist is headquartered in the EU; data may be stored there.
• Your browser, where the plugin keeps its configuration: the LMS URL, your course-to-Todoist-project mapping, your Todoist OAuth token, and your sync preferences. The plugin's sandboxed local storage, which no web page or other plugin can read. We can't read any of this remotely.
• Your Margin device, in your room. Holds the Todoist OAuth token, Wi-Fi credentials, the iCal URLs you subscribed to, and a cached copy of the most recent assignment list for offline display. A factory reset wipes all of it.
• Whatever calendar service you point at the device (Apple, Google, Outlook, Proton, Notion, your school's academic calendar). The device reads the public iCal feed URL you gave it during setup. No account is created on either side.

Research testers who sign a consent form also give us instructor-written course pages. They sit in a Google Drive folder shared with us and on our own computer, not on a Margin server, and Anthropic reads them as its entry below describes.

And the two records we keep:

• The waitlist record, until device pre-orders ship. That's your email, the page you joined from and when, plus whichever of the three optional fields (school, who you're buying for, an open note) you chose to fill in. It is stored in our own database on our server in the European Union (Hetzner, Finland), the same server as the control plane below. The form reaches that server through Cloudflare, which handles the submission in transit. No academic data passes through it. Only the waitlist record.
• The control plane, the server we run, once you sign in, buy a Pass, or set up a device. It holds your account (the email and account ID from your Google sign-in, or the email you used at checkout if you bought first, plus your plan status and any license key you've redeemed), your license key records (each key's own record, its browser records, and any giveaway note), your device records, settings and health (registry timestamps; the health each device last reported; theme, timezone, and — only if you turn on the optional weather widget, which is off by default — the city you chose for weather with its coordinates; any queued remote command), your Todoist token, encrypted at rest, with your Todoist account ID, and, only if you use them, your Circles records and Margin Study's sync data. Section 01 lists every item. Its job is to sign you in, honor your Pass, let you manage your device from the plugin, hand the device its Todoist token so you don't type a key, and run Circles and Margin Study's sync. No grades are stored on it, no assignment titles except in the rare error report described in section 01, and no due dates except the exam dates Margin Study's sync keeps if you turn it on.

Outside companies each handle one narrow thing. Here is each one, and what it sees. The same list, grouped and with each company's region, is on our subprocessors page:

• Google, who you sign in with, and who runs its servers around the world. Google tells us your account email and a stable account ID, and nothing more; your password stays with Google. Google sees that you signed in to Margin. Research testers who sign a consent form share their course pages with us through a private Google Drive folder that only they and we can open. If we let your account test Margin Almanac and you connect Google Calendar, Margin also asks Google when you are busy on the calendars you pick (only start and end times come back), and writes the study blocks you add to Margin's own calendar there, so Google sees those requests. Their privacy practices: policies.google.com/privacy.
• Lemon Squeezy, the merchant of record, who handles any payment (a Margin Pass or a license key), in the United States. They take the card, the tax, and the refund, and pass us your name, email, and an opaque reference that links the purchase to your account. We keep the email and the reference, not the name. We never see or store card numbers, and no academic data is part of a checkout. There is no payment processor on the free tier or the website preview at all.
• Open-Meteo, a free public weather API, on servers in Europe and North America, reached only if you turn on the optional weather widget (off by default). With the widget on, the first time the device comes online it sends the city or region name you entered to Open-Meteo's geocoding service once, to look up coordinates; it then caches those coordinates and afterward sends only a fixed latitude and longitude to fetch the local forecast. Open-Meteo sees the device's network address and the city or coordinates, but no account, name or email.
• GitHub hosts the software updates for Margin devices, in the United States and other countries. A device asks it for updates, so GitHub sees the device's network address. Nothing about you or your account is sent.
• To check that its Wi-Fi works and to set its clock, a device also contacts connection checks run by Google, Microsoft and Mozilla and public internet time servers, around the world. They see only its network address.
• Hetzner, the company that provides our one server, in its data center in Finland. Everything in section 01 is stored on that server, along with our error tracker. We run the software on it ourselves. How long each thing stays is in section 04.
• Cloudflare hosts this website from the place in its worldwide network nearest you, carries the waitlist form to our server, and counts visits (below). Like any web host, it sees your visits to this site: your network address, your browser and the pages you open. It also sees the waitlist form as it passes through. Cloudflare also keeps a short log of each waitlist form request, for a few days, which we can read. What the plugin and your device send to our server doesn't go through Cloudflare. Cloudflare keeps its own records, mainly in the United States and the European Economic Area, under its own policy: cloudflare.com/privacypolicy.
• Backblaze stores a copy of our nightly backup, in its EU region (Amsterdam). The backup is encrypted on our server before it's sent, with a key that is kept off our server, so neither Backblaze nor our server can read it. A storage rule we set on 23 October deletes each copy about 30 days after it is made, and is removing the older copies now (section 04).
• ntfy.sh, a public notification service that runs on DigitalOcean but doesn't publish in which country. When someone joins the waitlist, it sends us a phone alert that says only that someone joined, and from which page. Nothing you type in the form goes to it. When a purchase needs a manual check, it also sends us an alert with a reference number and no name or email.
• Zoho runs our email, in the United States. It holds what you write to us, at privacy@margin.computer or any of our addresses, and the emails we send you, such as our replies. We keep each email for 24 months after the last message in its thread, or delete it sooner if you ask. A problem report you copy from the plugin and paste into an email to us is kept as part of that email, for as long as the email.
• Anthropic, only for people who join a research test and sign a consent form that names it. The instructor-written course pages they give us are sent to Anthropic's Claude Haiku, in the United States, to find deadlines. Anthropic doesn't train its models on this text and deletes it within 30 days (longer only if its safety systems flag it or the law requires). We send Anthropic nothing from any other Margin user.

That's the complete list of outside companies that touch your account or your data, besides the services you use with Margin yourself: your school's course sites, Todoist, any calendar you add, and any AI you paste a prompt into. Our error tracker runs on our server in Finland (the error reporting described earlier), so error reports aren't sent to any other company. No marketing pixels, no chat widgets, no data brokers.

On this website, Cloudflare also counts visits. Cloudflare Web Analytics adds a small script to these pages as Cloudflare serves them. It sets no cookies. What it gives us is aggregate counts: page views and visits, by page, referring site, country, browser, operating system, and device type, and how long pages take to load. It runs on margin.computer alone, never in the plugin or on the device.

The same accounting, integration by integration. The column that matters is the last one: where the data lives. Three rows point at a server we run. The license and billing row holds a license check and a billing email. The Circles and Margin Study rows hold only what section 01 lists, and only if you use them. None of the three holds your assignment titles or grades.

Plain durations. The numbers got smaller.

At a glance. Where there's a number, it's the number our server uses. The details follow the table.

Real numbers:

• Assignment titles, due dates and grades are not on our servers, so there's no retention window to publish for them. They move from your LMS into your Todoist and onto your device. Doist's retention rules cover the Todoist copy. Check theirs. The exception is Margin Study's sync, if you turn it on: the exam dates and topic results it holds are kept to the end of the term (below).
• Your waitlist record is kept until device pre-orders ship. That record is your email, the page you joined from and when, and whichever of the three optional fields you chose to fill in. It gets only the emails listed in section 01: word that the Pass is open, word when device pre-orders open, and one note in January if you ask for one. When we email you about ordering the device, the record transitions to either "ordered" or "didn't order" and we stop sending anything to that address. You can ask us to delete it sooner, at any time. No newsletter.
• Your account, device settings and health, encrypted Todoist token, and Todoist account ID stay on our control plane while your account is active. "Delete server data" in the plugin's settings removes all of it in one action, immediately; disconnecting Todoist deletes just the token and your Todoist account ID, and revoking a device stops it from receiving the token at once; its settings and health stay with your account until you delete it. An account we created from a checkout email is kept and deleted the same way.
• A license key's own record outlives your account, so we can handle refunds and misuse of a key. Its browser records and any giveaway note are deleted with your account, or with the last account that holds the key; a key used without any account keeps them.
• Error diagnostics are kept 90 days, then deleted. Neither the error log nor the device health events carry an account or device ID. Each device's latest health report is kept with that device's record until you delete your account.
• Early-access records, if we let you create circles or use Margin Study's sync before they open to everyone, are deleted with your account.
• Encrypted backups are not yet held to 30 days. Older encrypted copies can still be stored. A storage rule we set on 23 October deletes each copy about 30 days after it is made and is removing the older ones now. Once they are gone, anything you delete is gone from the backups about 30 days later.
• Calendar feed contents pass through, they don't sit. The device fetches iCal URLs fresh on every refresh and discards the previous copy. We don't keep a history. We also can't, because we don't see them.
• Local device and plugin data (assignment cache, Wi-Fi credentials, your Todoist OAuth token, course-to-project mapping) lives where it lives until you remove the plugin or reset the device. A factory reset wipes the device clean. If you sell or give away your device, run the reset first.
• Circles block times are kept until the end of the term in which the block started, then deleted, even if you left the circle earlier. Memberships go when you leave a circle; your display name goes when you leave your last one (a name you type but never use to join or create a circle goes after a day). Invite records are deleted 24 hours after an invite is used, revoked or expires. A circle's name is kept while the circle exists. The record of who joined a circle this term (for the Pass's two-swap limit) is kept to term end, or until the circle is deleted. Deleting your account removes all of it at once, except that the join record stays to term end, no longer linked to your account.
• Margin Study data is kept until the end of the term it belongs to, then deleted. The record that your sync is on is kept while it is on. If you turn the sync off and choose to delete, or delete your account, it goes at once. If you turn it off and choose to keep it, it stays only to the end of the term.

What you can ask us to do.

You can:

• See everything we have on you. Email us and we'll send you a complete export within seven days. In practice that's your waitlist record (if you joined); your account email, Google account ID and plan; any key you've redeemed, with its own record, its browser records and any giveaway note; your device list, with each device's settings, health, check-in timestamps and any queued command; your encrypted Todoist tokens, which we decrypt to set up your device and to keep your sync working — identifying your Todoist account and refreshing access, never reading your coursework — and your Todoist account ID; any early-access record; the record of what pays for your Pass and any signed-out session IDs; if you use them, your Circles records (your display name, circles and memberships, the names of circles you own, invites you made, your focus-block times and the join records) and Margin Study's sync data; and the emails between you and us that we still keep. There's no profile on our side.
• Delete your account and what's tied to it, in one action. "Delete server data" in the plugin's settings removes your account (the email and Google account ID), your encrypted Todoist tokens and Todoist account ID, every device's settings, health and queued commands, the records linking your purchase to your identity, your Circles records and Margin Study data, and any early-access record, and any signed-out session IDs — immediately, no email required. It also deletes your license key's browser records and any giveaway note, or, if another account also holds the key, leaves them for the last account that holds it. Your devices return to their claim screens. Some things stay: the license key's own record (below); a circle you named, if other people are still in it; the record of who joined a circle this term, kept to term end (sooner if the circle is deleted) and no longer linked to you; the emails between you and us, kept 24 months after the last message in each thread unless you ask us to delete them; and error reports, which carry no account apart from a one-way hash of the buyer's Margin account ID or checkout email on an alert about a failed purchase, and which expire on their own after 90 days. Encrypted backups hold a copy until it expires. A storage rule we set on 23 October deletes each copy about 30 days after it is made and is removing older copies now. The license key itself survives and can be redeemed again: the purchase outlives the account. Two smaller levers exist too: disconnecting Todoist in the plugin deletes the token, and revoking a device stops it at once. For the waitlist email, write to us and we'll remove it within seven days. For the data in Todoist, in your browser, and on your device, you delete it directly: revoke Margin's access from Todoist's settings page, uninstall the browser plugin, and factory-reset the device.
• Correct anything that's wrong. We rarely have anything to correct, but if something on our end looks off, tell us.
• Stop the sync without deleting anything. Just uninstall the browser plugin. The device will show its last cached state and stop receiving new assignments. Your Todoist stays as it was.

You can check much of this yourself. In the plugin's Settings → Diagnostics, Recent errors shows the redacted error log kept in your browser, which error reports are made from, and Show what would be sent shows the next setup checklist, built by the same code that sends it. In Margin Study, Export my study data saves a file that, while the sync is on, includes what our server holds for it, exactly as our server returns it. And Chrome's own page for the plugin (chrome://extensions, then Details) lists the sites it can read.

These rights apply to everyone, regardless of where you live. Not just people in California or the EU. We don't think basic data rights should depend on jurisdiction.

Practical measures, not promises.

The actual safeguards in place today:

• Everything the plugin and your device send to our server is encrypted in transit (HTTPS, TLS 1.2 or newer). The waitlist form is sent over HTTPS too.
• Your stored Todoist token is encrypted at rest (AES-GCM), so a stolen copy of our database doesn't expose it.
• Every database query is scoped to your account and uses parameterized statements, so one person's data is not returned to another and injected input cannot cross that boundary.
• Passwords for university LMS accounts are never sent to us. The browser plugin uses your existing session.
• On a Margin device, the file holding your tokens is encrypted, with a key made from that device's serial number, so the tokens aren't stored in plain text on its SD card.

What we don't claim: that we're impervious to breach. No company can honestly claim that. If a security incident affects your data, we'll tell you what happened, what we know, and what we're doing about it. Within seventy-two hours of confirming the breach. Not "as soon as practicable." Not "in due course." Within seventy-two hours.

Margin is for readers 13 and older.

We don't knowingly collect data from anyone under 13. If you're a parent or guardian and you believe your child has registered for Margin, email us and we'll delete the account and all associated data, no questions asked.

This policy aligns with COPPA (the U.S. Children's Online Privacy Protection Act). Schools and districts that wish to provide Margin to students under 13 should contact us first. We don't currently support that use case.

The world is bigger than the U.S.

Margin is operated from the United States. The control plane that holds everything listed in section 01 runs on servers in the European Union (Finland), and so does the waitlist record, in our own database on the same server (section 03). The waitlist form passes through Cloudflare's network on its way there. The emails between you and us are stored in the United States, by Zoho (section 03). By joining the waitlist or signing in, you consent to the processing described here.

Your academic data is a different story. It flows from your browser to your Todoist to your device, and Doist is headquartered in the European Union. None of that data passes through any U.S. server we run. If you use Circles or turn on Margin Study's sync, those records sit on the control plane in Finland.

For readers in the European Economic Area, the United Kingdom, or Switzerland: we process your waitlist email to perform the pre-order contract you entered into (you asked to be told when we ship), and we process your account and device data to provide the device you signed up for. Both rest on the legal basis of performing a contract with you. You have the rights described in section 05, plus the right to lodge a complaint with your local data protection authority.

For California residents: the rights in section 05 satisfy the requirements of the CCPA and CPRA (California's consumer privacy laws). We don't sell your data and we don't "share" it for cross-context behavioral advertising. There is no advertising on Margin.

How you'll know we changed something.

If we update this policy in any meaningful way (adding a new third party, changing what we collect, changing how long we keep it), we tell you in the plugin, and by email where we have your address. The notice says what changed, in plain language, and links to the updated policy. The plugin card and the email announce the same change.

One exception: a change that affects only people who sign a consent form describing it is announced in that form and with a dated line below, because no one else is affected.

Cosmetic edits (typos, clarifications, link fixes) don't count and won't trigger a notice. The "last updated" date at the top of this page reflects every change, cosmetic or otherwise.

Added 30 October 2026. Section 03 now lists Anthropic, only for people who join a research test and sign a consent form that describes it. Those testers share their course pages with us through Google Drive, and sections 01, 02 and 04 now say what we hold for them and for how long. We send Anthropic nothing from any other Margin user.

Updated 30 October 2026. We added one promise to section 02: we don't share your data with anyone else without your consent, apart from the outside companies named in section 03, or where the law requires it. Section 03 now also says that ntfy.sh alerts us when a purchase needs a manual check, and where each company handles your data, as the company itself publishes it. Nothing new is collected.

Corrected 29 October 2026. We corrected this page. It now names every outside company that handles your data and how long we keep each thing. Nothing new is collected.