Privacy

AuraList is a small task app for students, run by one person (the admin) at no charge. It exists to manage your tasks, not to collect data about you. You need to be 13 or older to have an account.

What is stored

• Your account: name, email, and a hashed password (the actual password is never stored and cannot be read by anyone).
• Your lists, tasks, notes, due dates, and completion history.
• Settings you choose to enter: Canvas address and token, AI provider, key and model, work window, standing commitments, calendar link, theme, and app name.
• Class notes, chat history with the planner and class chat, and the last plans (day and week) it generated for you.
• Cached copies of Canvas assignment descriptions for your imported tasks, so time estimates can use them without refetching.
• Class materials: files you upload (stored encrypted), and the text read out of them and out of your Canvas course pages, assignments and syllabus, which is kept in a searchable index so the planner and class chat can find passages. That extracted text is not encrypted at rest.
• When you create an account, the email address and the network address (IP) you signed up from are kept briefly, only to limit abuse of sign-up. They are cleared within a couple of days, or when other people sign up.

How it is used

• Only to provide the app's features to you. There are no ads, no third-party analytics or trackers, and nothing is ever sold or given to third parties. The app counts which of its own pages and features get used, so the admin knows what to improve.
• Your email is used to confirm your account, reset your password, and tell you when someone shares a list or task with you. If you turn on the daily digest, it also emails you your own task and list names. Nothing else.
• Your Canvas token is used only to read your own courses, assignments and course material from your school's Canvas, never to change anything there. That happens when you click fetch, and also in the background: a quiet check for new assignments and changed due dates each time you open the app (at most every few hours), loading a class's materials, the Canvas course pages, and when an AI feature needs an assignment's instructions.
• When you use the planner, the week plan, brain dump or chat, the AI provider configured for your account (OpenAI or Google Gemini) receives what the feature needs to answer: your open tasks and notes, due dates, list and class names, checklist steps, assignment descriptions, standing commitments, today's calendar events, your earlier chat messages and last plan, and passages from your uploaded files and Canvas material. On a list you share, other members' tasks are included too. If you have not added your own AI key, the admin's key is used instead (the admin may switch it on for everyone), so those requests reach the provider under the admin's account, with a daily limit per person. Their terms apply to that processing.
• Your calendar link is fetched only to read your events: today's events for the planner, and upcoming events when you choose to import them as tasks. The link is stored as you entered it (not encrypted), so treat a private calendar link like a password.

Who can see what

• Your tasks and settings are private to your account. Other users cannot browse accounts or see your tasks. Sharing is by email address, and the person sharing is told whether that address has an account and sees the name on it, so anyone who knows your email can find out whether you have one. Someone sees what you share with them, including their own edits and what others add, for as long as the list is shared.
• If the admin's AI key is on for you, you can use it but never see it. AuraList keeps only how many requests you make, not what they say.
• The admin operates the server and could technically access the database; passwords stay hashed regardless.

Encryption

• Everything in transit is encrypted: all traffic between your browser and this app uses HTTPS (TLS), and so does every connection this app makes to Canvas, the AI providers, and Google Calendar.
• Stored credentials are encrypted at rest: your Canvas token and AI keys are kept in the database only in encrypted form, and uploaded files are stored encrypted. Not everything is: the extracted text of class materials and your calendar links are stored as plain text in the database.
• Your password is never stored in any form that can be read or decrypted: only a one-way bcrypt hash is kept.
• The database lives on an access-controlled server that only the admin can reach.

Cookies

One session cookie keeps you logged in. That is all.

Deletion

Delete your account any time in Settings, under Account. Your lists, tasks, notes, files and settings are removed right away. The server takes a nightly backup that is rotated out after 14 days, so copies there are gone within about two weeks.

Last updated: 4 Nov 2026. Questions: contact the site admin.