Privacy & data practices

Effective date: July 16, 2026. Operated by Andersen Labs LLC. Written to be read, not skimmed past — if anything here is unclear, email hello@trymorningbell.com and a human (Luke) answers.

The short version

Morning Bell reads your school's LMS with the access token you give us, builds one email every morning, and keeps almost nothing. Your token is encrypted the moment it arrives. We are read-only — provably, not just as a promise. You can cut off our access yourself, instantly, and one short email deletes everything we hold. Your data is never sold or shared. Period.

What we access

With your access token we read, and only read: your active courses and official course grades, assignments and due dates, your own submission records (so we never call something overdue without checking), and professor announcements from the last 24 hours. The complete list of API calls we make is published below in the API calls section and generated from our actual code. The token you create cannot submit, post, message, or change anything on your behalf through our code: we make zero write calls.

What we store

The minimum that a "what changed since yesterday" email requires:

• Your account: email address you signed up with, the address you want the brief sent to, your send hour, your school and its Canvas web address, and your timezone (used only to send at 6 AM your time).
• Your access token: encrypted at rest in a secrets vault the moment you paste it, with keys managed outside the database. It is never written to logs, never present in our website code, and no one — including us — can read it through the normal database.
• Course snapshot: your current courses (code, name, grading type).
• Grade history, 14 days: one number per course per day, kept exactly 14 days so we can compute day-over-day movement, then deleted. We are not building an archive of your academic record.
• Assignment status: the current verified state of recent assignments (submitted / open / overdue / can't-verify) — status flags, not your work. We never store the content of anything you submitted.
• Announcement IDs only: a numeric ID per announcement we've already told you about, so you're not told twice. The text of announcements is not stored.
• Send log: which days we sent you a brief, so you get exactly one.

What we never store

Announcement bodies (we read them, and pass the text once to Anthropic for the summary — see "Who processes what" below — but never keep them). Submission content. Files. Discussion posts. Messages. Classmates' anything. Your LMS password (we never see it — a token is not a password and cannot log in as you).

What sticks around, and for how long

A few operational scraps outlive the moment, and you should know about them. If you unsubscribe, we keep your email address and the reason — that's how we make sure we never email you again. If you joined the early waitlist, that email sits in its own table until you ask us to remove it. A signup you start but never finish (your email and your school's Canvas address) expires after 24 hours and is physically deleted within the following week. Briefs we've already sent persist for a time in our email provider's (Resend's) delivery logs, under their own retention policy — email, once sent, is like that. And our database keeps no automated backups today, so a deleted row is simply gone; if we ever add backups, they'll rotate out within days, and this page will say so before it happens.

Deletion — real, and yours to trigger

Two independent levers, spelled out step by step on the delete your account page. First: you can revoke the access token in your school's Canvas settings at any time, all by yourself, and Morning Bell is locked out on the spot — no waiting on us. Second: one short, pre-filled email to us and we hard-delete your encrypted token from the vault, every row of your data, and the account itself — no soft delete, no "processing period," no backup ghost copies (see above). We do it within 7 days of your email, usually the same day.

Every brief also carries a one-tap unsubscribe that stops all sending instantly (your account pauses; deletion is the bigger hammer).

Selling, sharing, advertising

Your data will never be sold, shared, rented, or used for advertising. There are no third-party analytics on your LMS data. If Morning Bell ever costs money, it will be a price you see and choose — never your data behind your back.

Who processes what

• Supabase hosts our database and runs our code (US region).
• Anthropic summarizes professor announcements. To write the 1–2 sentence summary in your brief, we send the text of a new announcement to Anthropic's AI API (the claude-haiku-4-5 model). That text is all that goes — no name, no email, no grades, no token — and we don't store it afterward (announcement IDs only, as above). If the AI call fails, your brief simply carries a plain, non-AI excerpt instead.
• Resend delivers the email. The brief's content passes through them to reach your inbox and, like most email providers, they keep delivery logs for a time — so a sent brief persists on Resend's side even after we delete our copy.
• Vercel hosts this website (the site itself holds no LMS data).

That's the whole list as of the effective date above — and if it ever grows, this page changes first and you get an email before it does (see Changes below). No data brokers, no ad networks, no analytics companies with access to academic data.

Security honesty

Tokens encrypted at rest with managed keys separate from the database; read-only API usage; deny-by-default access rules on every table; secrets never in code or logs. If we ever have a breach affecting your data, we will tell you directly and promptly — not in a footnote.

Email practices

Every brief includes a working one-tap unsubscribe and our physical mailing address (CAN-SPAM). Subject lines say what the email is. We monitor complaint rates and stop sending to anyone who marks us as spam.

Changes

If these practices ever change materially, you get an email before the change takes effect, written in the same plain English.

Every API call Morning Bell makes — the complete list

This list is published here ("Read-only, provably"). It is generated from the actual client code (supabase/functions/_shared/lms/client.ts); any code change that adds an endpoint must update this list in the same commit, and vice versa. All calls are HTTP GET — the token we ask for is used exclusively to read. Morning Bell makes zero write calls of any kind.