Privacy

Your coursework is private

Your courses, assignments, grades, syllabus files and suggestions are readable only by you. No other account can see them under any setting, including people you share a calendar with.

Your Webcourses token

If you connect Webcourses with an access token, that token is encrypted with AES-256-GCM before it is stored. It is never shown again, never written to logs, and never sent to your browser. It is decrypted only on our server, only to make a request to Canvas on your behalf.

A Canvas token carries the full permissions of your Canvas account. Two things follow. First, disconnecting on the Webcourses page deletes the stored token outright rather than hiding it. Second, you can revoke it yourself at any time from Account → Settings → Approved Integrations in Webcourses, which works even if you cannot reach this app.

If you would rather not hand over a token at all, the calendar-feed option needs no credentials and only reads due dates.

What sharing actually shares

A shared calendar contains only the events people put on it. Joining one discloses nothing else about you. Two optional switches, both off until you turn them on, per calendar:

• Busy times — publishes when you have class as blank blocks: day, start and end only. Not the course, not the code, not the room, not your email address.
• Course codes — lets the app notice you share a class with a friend so it can suggest studying together. It only ever compares course codes, and it needs both of you to have turned it on.

Turning a switch off stops the sharing immediately.

The calendar link for your phone

If you turn on calendar sync, the app makes one private link. Apple, Google and Outlook fetch a subscribed calendar from their own servers with no way to log in, so that link is the only credential there is — anyone holding it can read your classes and your due dates. Treat it like a password. We store only a hash of it, plus an encrypted copy so the page can show it to you again.

The feed carries your class times, your confirmed assignments and exams, and events on shared calendars you already belong to. It carries nothing else — not your grades or scores, not your syllabus files, not your lecture transcripts or notes, and nothing at all belonging to anyone else. Replacing the link on the phone page kills every copy of the old one at once, including any your calendar provider has cached; turning sync off deletes it outright.

Invite links

Anyone holding an invite link can join that calendar, so treat one like a password. Links expire, have a limited number of uses, and can be revoked. We store only a hash of each link, not the link itself.

Your location

The campus map can use your device location to show how long the walk to your next class actually takes. It is off until you press Use my location, it stops when you turn it off or leave the page, and your coordinates never leave your device — the walking time is worked out in your browser and is never sent to a server, stored, or shared with anyone on a calendar with you.

Lecture notes and your microphone

The notetaker listens only while you have a lecture page open and have pressed Start listening, and it stops when you pause, leave the page or close the tab. No audio is recorded — none is saved here, and none is uploaded to this app. Your browser turns speech into text as it goes, and only that text is sent to the server.

The speech recognition itself belongs to your browser, not to this app. In Chrome and Edge that means the audio goes to Google's speech service to be transcribed, under Google's terms, exactly as it would on any other site using the same browser feature. If you would rather that never happen, do not press start — type or paste the lecture in instead, and the notes work the same way.

Transcripts and the notes written from them are private coursework: only you can read them, no shared calendar exposes them, and deleting a lecture deletes its transcript with it. Readings and notes you upload to a lecture are held the same way — they are stored with that lecture, only you can see them, and they go when it does. Recording a class is your call to make — check what your professor and your school allow, and tell the people around you.

Other services

Syllabus files you upload are sent to the Anthropic API to extract the schedule. So is a class schedule you upload on the import page — with one exception: an .ics calendar export is read here on the server and sent nowhere. No uploaded schedule is stored either way; only the courses and meeting times you confirm are kept. A lecture transcript goes to the Anthropic API when you ask for notes, together with any readings or notes you uploaded to it and that course's grade weights and upcoming work so the summary can rank what matters — never your name or your email. Making a study guide sends the lectures you chose — their transcripts, the notes written from them, what you typed, and the text of any readings — the same way, and a typed quiz answer is sent to be marked. Your study guides, their questions and your quiz answers are private coursework, held exactly like the transcripts they come from. Campus locations and events come from UCF's public map and events sites. Walking routes may be requested from OpenRouteService using building coordinates only — never anything about you.

Deleting your data

Deleting a course removes its assignments, syllabus files and grade breakdown; the lectures you recorded for it stay, no longer attached to anything. Deleting a lecture removes its transcript, the files you uploaded to it, and its notes. A study guide written from a lecture quotes it, and is kept until you delete the guide itself — deleting the lecture does not delete the guides made from it. Deleting a guide removes its questions and your quiz record. Disconnecting Webcourses deletes the stored token. If you want your whole account removed, ask and it will be deleted along with everything attached to it.