Security & privacy

No tool submits, posts, edits or deletes anything in Canvas, and none ever will. The extension never sees your Canvas password: it reads the session you already have, for the courses you picked, and nothing else.

save_academic_memory saves a study note into Syla's own store, only when its scope was granted, and only when you asked for something to be remembered. It never writes anywhere a school system can see, and every memory is yours to read and delete in Syla settings.

Every request is authenticated and reads exactly one student's account; there is no cross-student surface. Scopes are the access model: an assistant or token holds only what was granted, ungrated tools are absent from tools/list, and revocation is immediate.

For automations that only schedule, mint a token without files:read: an agent that knows a reading is due does not need to be able to open it.

Privacy policy · Terms · security contact: founder@usesyla.app. If you believe you have found a vulnerability, mail that address; a human reads it.