How MachReach handles account, study, Canvas extension, and subscription data.
Plain-English summary: MachReach helps students track focus time, courses, grades, flashcards, quizzes, rankings, streaks, friends, and study progress. We collect only what the product needs, we never sell your data, passwords are hashed with bcrypt, and you can disconnect Canvas or delete your account from Settings.
Last updated: July 17, 2026
MachReach is operated from Santiago, Chile. Privacy and data-rights questions can be sent to support@machreach.com.
Account information: your name, institutional or Canvas email address, your university, and your password hash. When you create an account through Canvas, MachReach reads the email address exposed by your Canvas profile so you can log in later with that email and the password you set.
Canvas LMS data: if you connect Canvas, the MachReach browser extension reads your course list from your own logged-in Canvas session and sends it to MachReach so we can show your classes and power class-level leaderboards. We only read your course list — we do not submit assignments, change grades, or publish content.
Courses you add manually: if your university doesn't use Canvas, or you simply prefer to, you can add courses by typing a course code and name. To help other students at your own university fill these in faster, course codes and names you add may be saved to a shared, university-scoped autofill catalog. This catalog stores only the course code and course name together with the university — it is never linked to your identity, your grades, or your study activity, and it is only ever shown to other students at the same university.
Study materials: files, notes, and text you choose to upload or type for features such as quizzes and flashcards.
Study activity: focus sessions, minutes studied per course, XP events, streaks, badges, quiz attempts, flashcard reviews, leaderboard rank, course outcomes, grades you enter, and in-app coin activity.
Social activity: friend connections and referral activity if you invite friends. We store who you are friends with and how many people joined with your referral link.
Focus Guard extension: extension settings and active-session state are used to support focus sessions. Some settings may be stored locally in your browser.
Payment data: billing is processed by Lemon Squeezy. We receive subscription status and IDs, never card numbers.
Technical data: security and application logs, IP address and browser information used for abuse prevention, session cookies, consent choices, error diagnostics, and optional product analytics after consent.
We use HTTPS/TLS, CSRF protection, rate limiting, strict security headers, parameterized SQL, HTML escaping, secure cookies in production, hashed passwords, and access controls for sensitive account data.
These providers may process data outside Chile under their applicable contractual and security safeguards.
Account and study data is kept while your account is active. Permanent deletion first attempts to cancel an active subscription and then removes account-linked data from the primary application database. Limited billing-event, security, fraud-prevention, and deletion records may be retained where necessary to complete the request, resolve disputes, prevent duplicate charges, or comply with law. Copies may remain temporarily in protected provider backups until those backups expire under the provider's schedule.
You can request access, correction, deletion, objection, and data portability. MachReach provides a JSON export and permanent deletion in Settings. You can also disconnect integrations, opt out of optional study emails, or contact support@machreach.com. We may need to verify your identity before acting on a request.
Chile's updated personal-data framework under Law 21.719 takes effect on December 1, 2026. MachReach is preparing its processes for the additional rights and obligations effective on that date.
MachReach is not intended for children under 16. If you believe a child under 16 created an account, contact us so we can investigate and remove it.
We will post material changes on this page and update the date above. Questions, complaints, or data-rights requests: support@machreach.com.