Privacy Policy

Last updated: October 23, 2026

Dyyno ("Dyyno", "we", "us") is a web application that helps schools monitor student progress from their Canvas learning management system: counselor caseloads, official progress reports, read-only links for parents and a portal for teachers. This policy explains what information Dyyno collects, how it is used and protected, who it is shared with, how long it is kept and the choices people have. It applies to the website dyyno.xyz and to every school workspace at <school>.dyyno.xyz.

1. Schools are in control of student information

Dyyno is used by schools. The school decides which Canvas account Dyyno connects to, which staff members get access, and which information is shared with parents and teachers. For student information, the school is responsible for it (the "controller") and Dyyno processes it only on the school's behalf and according to its instructions (as a "processor", or a "school official" under the U.S. Family Educational Rights and Privacy Act, FERPA; see FERPA and student privacy). Students do not use Dyyno themselves, and Dyyno is not directed at children.

2. Information we collect

Information the school provides from Canvas

With an API token supplied by the school's Canvas administrator, Dyyno reads (and never changes) the following from the school's Canvas account: student names, school email addresses and Canvas IDs; courses, terms and enrollments; grades, assignment completion and last activity dates; and teacher names, school email addresses and course assignments.

Information created in Dyyno

Staff accounts (school administrators and counselors): name, school email address, role, the campuses a counselor may see, and a password (never stored in readable form).
School settings: school name, logo, report settings, policy thresholds, the Canvas address and the Canvas API token, which is stored encrypted.
Notes and observations written about students by staff or teachers, campus assignments, and weekly snapshots of progress data.
Teacher and parent links: long random codes that open a teacher's classes or a student's read-only report. We record when a parent link was last opened and when a teacher last used their portal.
Audit records of important administrative actions (for example changes to settings or access), kept for security and accountability.

Demo requests

When someone asks for access to the Dyyno demo school through the form on our website, we collect their name, school, email address and, if they choose to give them, their role and a message. We use these details only to send a personal demo link and to follow up about Dyyno, never for advertising, and we do not share them with anyone except our service providers. The demo school itself contains only fictional data. Demo requests are deleted after one year, and demo links 90 days after they expire; you can ask us to delete yours sooner at the address in section 11.

Information collected automatically

One essential cookie keeps staff members signed in. Parents and teachers do not need cookies to use their links.
Server and security logs: IP address, date and time, the page requested and the browser type, used to keep the service secure and to fix errors.
Dyyno does not use advertising cookies, tracking pixels or analytics profiles, and does not sell or rent information.

3. Google user data (Sign in with Google)

Dyyno offers "Sign in with Google" so that school staff (administrators and counselors) can sign in with their Google account instead of a password. This section explains exactly what Google user data Dyyno accesses and what it does with it.

Google user data Dyyno accesses

When you choose "Sign in with Google", Dyyno requests only two permissions (scopes): openid and email. With them Dyyno receives only:

your Google account identifier (a number that identifies your Google account);
your email address and whether Google has verified it.

Dyyno does not request or receive access to your Gmail, Google Drive, Google Classroom, contacts, calendar, files or any other Google data, and cannot act in your Google account.

How Dyyno uses Google user data

Dyyno uses this information only to identify you and sign you in to your school's Dyyno workspace: the Google account identifier and email address are matched to the staff account your school created for you. Dyyno does not use Google user data for advertising, does not sell it, does not use it to build profiles, and does not use it to train or improve artificial intelligence or machine learning models. It is not used for any purpose other than signing you in.

How Dyyno stores and protects Google user data

Dyyno stores only your Google account identifier and email address, linked to your staff account, in its database in the European Union (Germany). Dyyno does not store Google passwords and does not keep Google access tokens after sign-in is complete. Data is protected by encrypted connections (HTTPS), strict access control (only the people your school allows can see staff accounts, and each school's data is kept separate), and daily backups.

Dyyno does not share, sell, transfer or disclose Google user data to anyone, except: the service providers that host and secure Dyyno (who process it only on our behalf to run the service), your school's Dyyno administrators (who can see which staff accounts are linked to Google), or where required by law.

Retention and deletion of Google user data

Dyyno keeps your Google account identifier and email address only while your Google account is linked to your Dyyno staff account. You can unlink your Google account at any time from your account settings, and your school administrator can remove the link or your staff account; Dyyno then deletes the stored Google account identifier immediately, and it disappears from backups within 30 days. You can also remove Dyyno's access at any time from your Google account (myaccount.google.com, "Security", "Third-party apps with account access"). To ask us to delete your data, contact us at the address in section 11.

Limited Use

Dyyno's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

To provide the service to the school: show progress rosters and reports, generate printable and Word reports, run the scheduled Canvas sync, let teachers write observations and let parents view reports.
To sign people in, control who can see what (for example counselors only see their assigned campuses), and keep each school's data separate from every other school.
To keep the service secure, reliable and backed up, and to provide support when a school asks for help.

We do not use student information for advertising or marketing, to build profiles, or for any purpose other than providing Dyyno to the school.

Information is visible inside a school only to the people the school gives access to. We share information outside Dyyno only with service providers that help us run the service, bound by confidentiality and data protection obligations:

a hosting provider in Germany (European Union), for the servers and the database;
a network security and delivery provider, for encrypted connections and protection against attacks;
Google, for Sign in with Google (if used) and the web fonts used on Dyyno pages;
Instructure (Canvas): the school's own Canvas account, from which Dyyno reads data.

Schools can ask us for the current list of service providers.

We may also disclose information if required by law, or to protect the safety of people or the security of the service. We never sell personal information.

6. How we protect information

All connections use HTTPS encryption.
Each school's data is separated, and automated tests check every page of the app to make sure one school can never see or change another school's records.
Access is limited by role; counselors only see the campuses assigned to them.
Passwords are never stored in readable form and Canvas API tokens are encrypted; parent and teacher links are long random codes that the school can revoke at any time and can set to expire.
Sign-in and public links are protected against repeated guessing, and the database is backed up every day.

Our Security & Student Privacy page describes these measures in more detail.

7. How long we keep information

We keep a school's information for as long as the school uses Dyyno. When a school stops using Dyyno, or asks us to, we delete its information from the live service within 30 days. Database backups are kept for up to 30 days and are then deleted automatically. Server logs are kept for a limited time for security purposes. Demo requests are kept for one year and demo links for 90 days after they expire (see "Demo requests" in section 2).

8. Your choices and rights

Parents, students and staff who want to access, correct or delete information should contact their school, which controls that information; we will help the school respond. Staff members can also unlink a Google account from their settings. Depending on where you live (for example in the European Union, the United Kingdom or U.S. states with student-privacy laws), you may have additional rights, which you can exercise through your school or by contacting us.

9. Where information is stored

Dyyno's servers and database are located in the European Union (Germany). Our network security and delivery provider may process connections in other countries to deliver the service securely.

10. Changes to this policy

We may update this policy as Dyyno changes. We will change the date at the top of this page and, for important changes, inform the schools that use Dyyno.

11. Contact

Questions about this policy or about your information: [email protected].