In short
- Read-only. Lectern's tools read course information. They cannot submit, post or edit anything.
- No password. You sign in to Brightspace as usual, and Lectern never sees or stores your password.
- Encrypted session. To read Brightspace for you, Lectern keeps your signed-in Brightspace session on its server, encrypted, and uses it only for that.
- Course content passes through. What Lectern reads to answer a question goes to your chat app and is not stored, apart from the items listed below.
- Never sold. No advertising and no tracking across other websites.
- You are in control. Remove a connection or delete your whole account from Manage at any time.
How connecting works
When you connect, the Lectern extension sends Lectern the sign-in cookies for the Brightspace address you approve, and Lectern turns them into an access token. Lectern then reads Brightspace on your behalf, the same way your browser does while you are signed in. Where Chrome allows it, the extension also includes the cookies for your school's sign-in address (for example login.microsoftonline.com), which Lectern uses only to keep that same Brightspace account signed in. Because Lectern reads Brightspace as you, your school and its sign-in provider can see that activity on your account, as they can for any app you use.
Your Lectern account uses an email address you enter and confirm with a code. Lectern does not take an email address from Brightspace.
What Lectern reads
Lectern reads what your chat app asks for: courses, deadlines, submissions, grades, announcements, content, files, syllabuses, discussions, calendars and class rosters. Some of this, such as rosters and discussions, includes information about instructors and classmates. A roster never returns a classmate's email address, account identifier or last sign-in time. What Lectern reads passes through its server to your chat app and is not stored, except for the items below.
What Lectern keeps
- Your connection: your Brightspace session (described above); your Brightspace name and user id; up to twelve course names and your course count; your school's Brightspace and sign-in addresses; your browser family, time zone and extension version; and technical details such as the connection identifier, creation and activity times, connection state, credential and link versions, and which version of the terms you accepted and when.
- Your account: your email address, encrypted, with a keyed fingerprint so it can be looked up; your connections, email settings and time zone; for each browser you sign in from, a sign-in session stored only as a fingerprint, with its start time, last use and user agent; and any pending sign-in code, also stored only as a fingerprint. Connections from the same Brightspace account belong to one account.
- Saved notes: things your chat app saves so later chats remember them, such as an exam's date and room, office hours, grading weights, or the text of a course file Lectern cannot open directly.
- Chats: conversations at lectern.chat/chat are saved so you can come back to them. Only you can see them, and they are kept until you delete them or for 90 days after the last message.
- Activity records: connection attempts, syncs, link changes, sign-ins, emails sent, requests from chat apps and administrative actions, with the time, school, tool, duration, size, status, client, IP address and approximate location. They never include what was asked or answered. A request from a chat app usually carries the app's address, not yours.
Cloudflare, which hosts Lectern, keeps its own request and diagnostic logs for a few days, and these are not removed when you delete a connection. Your private link is masked in Lectern's error logs.
How it is protected
Your Brightspace session is encrypted with a key unique to your connection, and your notes, chats and email address with a key unique to your account. Lectern's server can decrypt them, because it needs your session to read Brightspace for you, so this is not end-to-end encryption. Access to the server is restricted and requires a hardware security key.
No online service can promise perfect security. If your information is ever exposed, we will notify you, and any authorities the law requires, without unreasonable delay. To report a suspected security issue, email hello@lectern.chat, and please do not include any credentials.
Who receives it
Your chat app receives what it asks Lectern for: Anthropic for Claude, OpenAI for ChatGPT, Google for Gemini, or the provider of any other client you connect. Each provider handles that information under its own terms and your settings there, including retention, review and training, and deleting Lectern does not delete what a provider has already received. If you use the chat at lectern.chat/chat, your questions and the Brightspace information needed to answer them are sent to Anthropic through Lectern's account. Cloudflare processes information to host Lectern and send its email. We never sell your information or use it for advertising.
Lectern sends email from hello@lectern.chat. You get sign-in codes when you ask for them. Unless you turn them off, you also get a daily digest of work due in the next two days and a weekly summary of the week ahead, grades released and announcements posted, at times you choose (7 AM daily and Sunday 6 PM by default). Every digest has a link to turn it off, and you can switch either one on or off in Manage.
How long we keep it
- Connections and their sessions: until you delete them, or automatically after 180 days with no questions and no contact from the extension.
- Your account, notes and chats: kept when you remove a connection, until you delete your account, or automatically after 180 days with no connection and no activity. A saved exam is removed 120 days after its date.
- Sign-in sessions: 400 days from last use, or until you sign out. Sign-in codes: 10 minutes.
- Activity records: deleted with their connection, or after 90 days, whichever comes first. Website visit records: 180 days. Daily usage counters: 40 days. Markers that stop a used token from being reused: up to 400 days, with no personal information.
- Record of accepting the terms: each time you accept, we keep the version, time, wording shown, extension version, IP address and its approximate location, browser, connection identifier, Brightspace name and user id, and school. This record is kept for six years, including after a connection is deleted, so the agreement can be shown if it is ever needed.
Clean-up runs on a schedule, so removal can take a little time. Cloudflare's database backups may hold deleted records for up to 30 days.
Deleting your data
To remove a connection, choose Forget in the extension, uninstall the extension, or choose Remove in Manage. This deletes the connection, its session and its activity records, and its private link stops working. Your account, notes and chats remain. To delete everything, choose Delete account in Manage, which removes your account, email address, notes, chats and every connection.
After a deletion, we keep a brief record for 90 days: connection identifier, school, time, country and browser, with no IP address or city. The same brief record is kept when a first connection attempt fails. Uninstalling relies on Chrome opening a Lectern page at that moment; if that does not happen, reinstall the extension and choose Forget, or email hello@lectern.chat.
The Chrome extension
The extension notices when you visit Brightspace pages and remembers up to five recent Brightspace addresses in Chrome's local extension storage. After you connect, it also stores there the connection credentials, private link, school, your name, a course summary and the connection state. lectern.chat can ask the installed extension for the connection state and private link to run its own pages. The extension reads cookies only for sites you approve and sends them only to lectern.chat. Chrome describes every site permission as "read and change"; Lectern only reads. Lectern's use of information from Chrome APIs and Brightspace complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
The website
Signing in sets one cookie on lectern.chat, used only to keep you signed in. Page visits are counted without cookies: we record the page, referring site, campaign parameters, event, time, approximate location, and browser, operating system and device type, under an identifier derived from your IP address and browser that changes every day. We do not track you on other websites, and no advertising or analytics partner can build a profile from our pages. We collect the same minimal record whether or not your browser sends Do Not Track. Cloudflare may add its Web Analytics script to pages and handles it under its own policy.
Who runs Lectern
Lectern ("we" in this policy) is independently developed and operated, and we are responsible for the handling described here. Lectern is not affiliated with, endorsed or approved by D2L Corporation, any school, Anthropic, OpenAI or Google. It runs on Cloudflare, so your information may be processed outside your state or country. You can reach us at hello@lectern.chat.
Your school's rules
Lectern is not approved by D2L or by any school. D2L's licence terms and some schools' policies restrict third-party tools that access Brightspace with your account. Before connecting, check the rules that apply to you and read Lectern's Terms, which set out your responsibilities.
Who can use Lectern
Lectern is for students who are at least 18 and legally adults where they live, connecting only their own student account. It is not available in the European Union, the European Economic Area, the United Kingdom or Quebec. Lectern blocks school addresses and connections that appear to come from those regions; these checks are not exact, and passing them does not make someone eligible. Connections that are not eligible are deleted.
Your rights
Manage shows your email address, connections and email settings, and lets you delete your account; the extension lets you delete a connection. For access to your information, a copy, a correction or any other deletion, email hello@lectern.chat, and please do not include your private link, cookies or tokens. We will verify your request in a reasonable way and respond within the time the law requires. Email you send us is used only to reply and kept only as long as needed.
Legal requests
If a court, regulator or law enforcement agency lawfully requires information about a connection, we provide only what the demand requires and notify the person affected unless the law or the demand forbids it. A demand made directly to Cloudflare or another provider may be answered without our knowledge. We never volunteer information about a connection to a school, D2L or anyone else.
Terms and changes
Connecting requires accepting Lectern's Terms, which include warranty disclaimers, limits on liability, your responsibilities for permitted access, and how disputes are resolved, including the courts that hear them and waivers of jury trials and class actions, each applying only as far as the law allows. Lectern records which version you accepted and when. If the Terms or this policy change materially, the new version is posted here with a new date and the extension asks you to accept it.
Contact
hello@lectern.chat, for questions, privacy requests and security reports. Please do not send passwords, cookies, tokens or private links.
Last updated 2026-10-14.