Privacy

Your courses, assignments, availability, weekly commitments and planned blocks are stored in this browser’s local storage and are never sent anywhere. There is no server-side copy, which also means:

• Your laptop and your phone hold separate, unsynced copies.
• Clearing site data for this site deletes everything, permanently.
• Nobody, including us, can recover it for you.

This is the default. Nothing asks you to sign in before you have a working week.

Three things are then stored on our server, and nothing else:

• Your email address. Used to send you a sign-in link and to know which week is yours. There is no password, anywhere, so there is none to leak.
• Your week. The same data described above, stored as one record so a new device can pick it up. It is your schedule, so it does contain your course names and what you called things.
• A usage log. One row when you open the app, plan a week, mark a block done or skipped, move a block, or import a calendar.

Each row is an event name, a timestamp, and sometimes a number: minutes, or a count of blocks. It never contains the title of an assignment, a course code, or anything you typed. We keep it because whether students still use this in week four is the one thing that tells us if it works, and that is answerable from timestamps alone.

It is append-only by design. The app can add rows and read its own, and deliberately cannot edit or delete them, because a retention number you can quietly rewrite is not a measurement.

Only you. Every table has row-level security tied to your account, enforced by the database rather than by the app, so a bug in the app cannot expose another student’s week.

The key the browser uses is public by design and is visible to anyone who looks. That is how this kind of database is meant to work: the key identifies the project, and row-level security is what actually protects the data.

Brydon, who builds this, can technically read the database, in the same way any developer can read their own server. Nobody else has access, and it is not sold, shared, or used for advertising.

That link is a credential. Anyone holding it can read your whole schedule, indefinitely, without logging in. So it gets handled carefully:

• It is sent to our server once, only when you press the button, so that we can fetch the calendar. Browsers cannot fetch it directly.
• It is not stored, in the browser or on the server, signed in or not.
• It is not written to any log.
• The server only accepts links on known calendar hosts, and refuses private and internal network addresses.

Because it isn’t stored, refreshing your Canvas data means pasting it again. That is a deliberate trade: a paste costs you seconds, and a leaked feed URL costs your privacy permanently.

A .ics file you import is read in your browser and never uploaded. It does not touch our server at all.

Delete my data in Settings removes your account, your week and your entire usage log, then clears this browser. It is immediate and there is no recovery, for you or for us.

If you only want to stop syncing, sign out instead. That leaves your week on this device and deletes nothing.

• No advertising, and no advertising or tracking scripts.
• No selling or sharing of your data with anyone.
• No third-party analytics.
• No reading of your Canvas account. Only the calendar feed you paste.

Email bmwother1@gmail.com. The code is public, so every claim on this page can be checked rather than taken on trust.