Privacy Policy

What Hawkeye collects when you create, take or review a proctored exam, how long it keeps it, and how to ask about it.

This policy tells you what Hawkeye collects, why it collects it, who sees it and how long Hawkeye keeps it. It applies to the Hawkeye app and to these help pages.

Last updated: October 30, 2026

Who we are

Hawkeye is a remote proctoring service. A student takes an online exam in a browser. During the exam, Hawkeye records the student’s webcam video, microphone audio and screen. The educator who set the exam reviews the recording afterwards.

In this policy, “Hawkeye”, “we” and “us” mean the operator of the Hawkeye service. “Your educator” means the educator who set your exam. To contact us, write to support@hawkeye.com.

What Hawkeye collects

Your account

Your first name and last name.
Your email address, and the time you confirmed it.
Your role: educator or student.
Your password. Hawkeye keeps only a one-way hash of it, not the password itself.
A sign-in history: each sign-in, failed sign-in, sign-out and account change, with the time, your IP address, your browser’s description of itself (the user agent) and a code that identifies the browser.

Canvas

When you open Hawkeye from Canvas, Canvas sends Hawkeye:

Canvas’s ID for you, and your Canvas user number.
Your name and email address.
Your role in the course: teacher or student.
The course and the assignment that you opened.

For a Canvas quiz, Hawkeye reads your quiz submission from Canvas: which attempt it is, when you finished, and any extra time your educator gave you.

An educator can connect their Canvas account. Hawkeye then keeps a Canvas access token that lets it read and change the access code of one quiz at a time, and read its submissions. An educator can also email the class. Hawkeye then reads the course list from Canvas and keeps the name and email address of each active student, to send each one an invite.

During the pre-check and the exam

Your face photo, taken in the pre-check.
A photo of your ID document, taken in the pre-check, if the exam asks for it.
Your webcam video and your microphone audio, from Start the Exam until the exam ends.
Your entire screen, for the same time. Anything on your screen is in the recording, including other windows.
Flags: moments that Hawkeye marks for your educator to check, for example a tab switch or no face on the camera.
A screenshot of your shared screen, one second after you go to another tab or window or leave fullscreen. Hawkeye takes at most one every 30 seconds. It shows the same screen as the recording.
The time you agreed to be recorded, and the times the exam started and ended.
Your educator’s notes and review result for your attempt.

Hawkeye does not record during the pre-check. Recording starts when you press Start the Exam. What Hawkeye records tells you more.

Extra details

Your educator can ask for up to five extra details, such as a student ID or a section. Hawkeye keeps your answers with your attempt.

Technical data

Your IP address. Hawkeye records it each time your browser sends Hawkeye part of your exam.
A device cookie. It holds a random code that identifies your browser. Hawkeye records it with your IP address.
Your browser’s user agent, in the sign-in history.

Emails

Hawkeye keeps the email address of each person that an educator invites, and the name when the educator gives one. It keeps when each invite is due and when it was sent. Hawkeye sends invites, “exam is open” emails, and emails to confirm an address or reset a password.

Why we collect it

To run the exam. Hawkeye needs your account, your recordings and your details to give you the exam and to record it.
To let your educator review it. Your educator watches the recording and decides whether the attempt was fair.
To keep the exam fair. Flags, IP addresses and the device cookie help your educator find moments to check, for example two students on the same device.
For security. The sign-in history helps Hawkeye find and stop misuse of accounts.
To send exam emails. Hawkeye uses email addresses to send invites and reminders.

How the checks work

The face photo checks and the face checks run in your browser, on your computer. Hawkeye adds the network and device flags on its own server after the exam. Hawkeye does not send your video, your audio or your photo to an AI service.

To run the checks, your browser downloads software and models from other companies:

The face detection software from jsDelivr (cdn.jsdelivr.net).
The face photo model from Hugging Face (huggingface.co).
Model files from Google storage (storage.googleapis.com).

These companies see your IP address when your browser downloads the files. They do not get your video, your audio, your photo or your answers. Your browser keeps the face photo model in its cache, so it downloads it only once.

Who sees it

Your educator. The educator of the exam sees your recordings, your face photo, your extra details, your name and email address, the flags and the review result. Another educator does not see them.
Hawkeye support. Hawkeye support can see your data when you ask for help, and when it is necessary to keep Hawkeye secure and working.
Service providers. Hawkeye uses service providers that host Hawkeye and send its email, under contract. They handle data only to provide that service to Hawkeye.

A student sees only their own exams. Hawkeye does not sell personal data.

How long we keep it

The time for the face photo and the recordings counts from the end of the exam. If an exam never ended, it counts from when it started.

What	How long
Face photo	30 days after the exam
Photo of your ID	7 days after the exam
Webcam video, microphone audio and screen recordings	30 days after the exam
Screenshots of your screen	30 days after the exam
The exam record: status, flags, notes, review result, extra details, and the IP addresses and device codes recorded during the exam	Until your educator deletes the exam or their account, or stops using Hawkeye
Invites	Until your educator deletes the exam
Sign-in history	1 year
Your account	Until it is deleted

After 30 days, your educator can still see the flags, the notes and the result, but cannot watch the recordings.

Copies your educator keeps

Your educator can keep copies of your recordings or your results, for example as a screen capture or in your school’s records. Hawkeye cannot delete those copies. Ask your educator what happens to your data after 30 days.

Your choices and rights

Before each exam, the pre-check asks you to agree to be recorded. You can decline. You then cannot start that exam. Contact your educator about another way to take it.

You can ask to see your data or to delete it. Write to support@hawkeye.com. To delete your account, write to the same address. If your school keeps records of your exams, your school can ask you to send some requests through it.

You can correct your name on your account page.

Cookies

Hawkeye uses these cookies. Hawkeye does not use cookies for advertising or tracking across other websites.

Cookie	What it does	How long
Session (`session_token`)	Keeps you signed in	90 days at most; ends after 30 days without use
Sign-in device (`device`)	Identifies your browser in the sign-in history	400 days
Exam device (`hawkeye_device`)	Identifies your browser during an exam, for the device checks	400 days
Sign-up (`signup`)	Lets the browser you signed up with confirm your email address	24 hours
Return path (`return_to`)	Takes you back to the page you wanted after you sign in	15 minutes
Message (`_flash`)	Shows a one-time message on the next page	Until you close the browser
Theme (`offrails_theme`)	Remembers light, dark or system theme	1 year
Canvas sign-in (`lti_state_…`)	Connects a Canvas launch to your browser	10 minutes
Canvas check (`lti_probe`)	Checks whether your browser allows Hawkeye’s cookies inside Canvas	10 seconds
Canvas connection (`canvas_oauth`)	Connects an educator’s Canvas account to the right browser	10 minutes

These cookies are necessary for Hawkeye to work.

Security

Hawkeye sends data over encrypted connections (HTTPS).
Hawkeye encrypts educators’ Canvas tokens when it stores them.
Only the educator of an exam can see its recordings, its face photos and its extra details.

No system is perfectly secure. If you think your account is at risk, write to support@hawkeye.com.