For reviewers: Print this page to a one-page PDF (File → Print → Save as PDF). Public copy: gpaceapp.org/security.html

Institutional review

Canvas OAuth security & privacy summary

GPAce · September 2026 · Not a personal access token request

GPAce is a student GPA tracker for iOS and Android (gpaceapp.org). Students do not create a GPAce account. This note describes a read-only Canvas OAuth Developer Key: one app registration so a student can authorize their own Canvas login. We are not asking the institution to issue tokens to the developer or to any student.

Access model

The student signs in with their own school Canvas / SSO credentials on Canvas’s login page.
The resulting token is limited to that student. GPAce cannot see other students’ records.
No write, delete, admin, masquerade, or SIS provisioning scopes.
The student can disconnect in the app or revoke the app in Canvas (Account → Settings) at any time.

Requested Canvas scopes (GET only)

url:GET|/api/v1/users/:user_id/profile
url:GET|/api/v1/courses
url:GET|/api/v1/courses/:id
url:GET|/api/v1/courses/:course_id/assignment_groups
url:GET|/api/v1/courses/:course_id/assignments

Used for: the student’s profile, enrollments, category weights, assignments, and that student’s scores (including include[]=submission on their own assignments).

Not in scope

Posting, editing, or deleting grades or content
Instructor or admin roles
Other users’ accounts or gradebooks
LTI placement inside Canvas courses
Advertising or sale of academic data

Where data is stored

Grades and course data stay on the student’s device. GPAce does not operate a grade database or student profile store.
OAuth tokens are stored on device (iOS/Android secure storage). The GPAce backend holds the Developer Key client secret (it cannot live in the mobile app) and exchanges the authorization code / refresh token with Canvas. Tokens are returned to the device and are not kept as a grade archive.
After login, the native apps call Canvas from the device. A request proxy exists for web use; it forwards an API call and does not retain grade records.
Optional school-search analytics record query text and selected school id only — not names, tokens, or grades.
In-app purchases go through Apple or Google and RevenueCat. Payment processors never receive Canvas credentials or gradebooks.

OAuth configuration

Redirect URI (register on the Developer Key): https://gpace-api.onrender.com/auth/canvas/callback

App return (allowlisted): gpace://

The backend only completes the OAuth redirect to that GPAce app scheme. It will not hand an authorization code to an arbitrary URL.

Student controls & contact

Disconnect Canvas in the app, delete local courses, or uninstall to remove on-device academic data. Full policy: gpaceapp.org/privacy.html.

Developer: Kai Greenberg, student, The University of Texas at Dallas

Privacy / review: support@gpaceapp.org · iOS com.kai.gpace · Android com.kai.gpace

GPAce is not affiliated with Instructure, Inc. or the student’s institution. Canvas is a trademark of its respective owners. This summary describes the current GPAce implementation as of September 2026.