Privacy

What Sherpa keeps, what it never touches, and who else handles any of it. Sherpa keeps as little as it can: student trust is the whole product.

Last updated November 2, 2026

The short version

Only you can see it

Your schoolwork is locked to your account. No other student can see it, and Sherpa never shows it to anyone.

D2L, read-only

The extension reads your courses. It never sees your D2L password and can't submit, post or change anything.

Never sold

No ads, no selling, no tracking. Sherpa doesn't train AI on your work, and OpenAI's terms say it doesn't either.

Gone when you say

Delete your account in Settings and everything Sherpa holds goes with it, right away.

What Sherpa keeps

Your account: Your name, email, and the classification and major you gave. Private links for your extension and calendar.
From D2L: Your courses, assignments, quizzes, rubrics, calendar events, announcements, Content pages and what professors write on Content folders; threads your professor starts; the words in files they attach; your grades and written feedback exactly as D2L shows them; and whether you handed something in.
What you add: Your notes, to-dos and steps, the words from anything you add, and what you've finished or planned.
What Sherpa works out: Steps, time estimates, and what it's learned about each course — you can remove any of it.
Only if you use them: Class transcripts and notes, notification settings, a background photo, and problem reports.

What Sherpa never keeps

Your D2L password
What you submit
Files from D2L, or photos and PDFs you add
Class audio
Classmates' posts and anyone's replies
Your class list
Your questions to Sherpa
Graders' private notes
Your card number

Who else handles it

Supabase: Stores your account in the United States, locked so only you can read it.
Vercel: Runs Sherpa's website and servers, in the United States.
OpenAI: Writes steps and estimates, answers questions, reads what you add, writes up classes — sent only the text each feature needs, and not trained on.
Groq: Turns recordings and dictation into words (OpenAI is the backup).
Resend: Sends sign-in emails, and problem reports to Joshua.
Stripe: Takes payment for Sherpa Plus; Sherpa never sees your card.
Your browser: Apple, Google or Mozilla deliver the notifications you turn on, encrypted.

Nobody else — no advertising and no third-party analytics.

The details

The Chrome extension

Runs only on d2l.oru.edu and only ever reads. It keeps a discussion thread only when the class list shows a teacher started it — the class list is checked in your browser and never sent. Attached files are sent once to pull out their words, then thrown away. So it doesn't re-send the same things, it keeps a short record in your browser of what it last read; anything untouched for 45 days is dropped.

Steps, estimates and Ask Sherpa

An assignment's title and instructions go to OpenAI to make its steps and time estimate — never your notes or anything about you. Asking about an assignment or course sends only what Sherpa has for it, your own notes labelled as yours, and only when you ask. Questions and answers aren't saved.

Photos and files you add

Sent to OpenAI to be read. Sherpa keeps the words; the file is deleted.

Recording, translation and dictation

Only while you're recording or the mic is on. Audio goes in short pieces to Groq (or OpenAI) to become words, and isn't kept — a piece that fails is retried once and deleted within a day. A finished recording's transcript goes to OpenAI to be written up as notes when you press Enhance, with the names and folders of the course's D2L files (never the files) so Sherpa can point out ones mentioned in class. Translations are shown, not saved. Sherpa asks you to confirm you have permission to record first.

Notifications and calendar apps

Only if you turn them on. Notifications name an assignment or announcement; a grade notification never says the grade. A calendar app reads a private, unguessable link with your open homework's names and due dates — "New link" in Settings stops the old one.

Background photos and problem reports

A background photo is shrunk in your browser first (which strips where it was taken) and kept private. A problem report keeps what you wrote, the page, your browser and screen size, and any screenshot, and is emailed to Joshua with your name and email so he can write back.

Your choices

Delete your account in Settings › Account — everything goes, immediately.
Hide a course and the extension stops reading it.
Delete a recording and its transcript and notes go.
Remove the extension, your calendar link, notifications or background any time.

Questions, or something here that looks wrong? Report a problem, in Settings, goes straight to the person who builds Sherpa. Last updated November 2, 2026.

SherpaBeta