Privacy Policy

Syllabus Center (“the app”), operated at syllabuscenter.com, turns syllabus PDFs into a semester plan and puts it on your calendar. This policy describes exactly what it collects, who it sends data to, and how to get rid of all of it. It is written to be read, not to be survived.

What the app stores

• Your Google profile — your Google account id, email address, name, and profile picture URL, received when you sign in. These identify your account.
• A Google refresh token, only if you grant calendar access. It is what lets the app write to your calendar later without asking you to sign in again. It is stored server-side, never sent to your browser, and never logged.
• What was extracted from your syllabi — course names, instructors, meeting times, assignments, exams, due dates, grading weights, and the policy excerpts the extractor quoted.
• Your settings — timezone (reported by your browser so calendar events land at the right local time), which categories you chose to sync, and the section you selected for a multi-section course.
• Identifiers for what it created — the ids of the Google Calendar events and Notion pages the app made, so a re-sync updates them instead of creating duplicates.
• A calendar feed token, if you create a subscription link. See below.

What the app does not store

The syllabus files themselves. An uploaded PDF is read in memory, its text extracted, and the file discarded. It is never written to disk or to a database.

The app also does not store Google access tokens (only the refresh token), does not read any Google Calendar other than the one it created, and does not read your email or files.

There are no advertising cookies and no cross-site trackers here: no ad network, data broker or social network is allowed to follow you from this site. The app sets one cookie for everyone — the signed session cookie that keeps you logged in — and, outside Europe, one more that holds a random id for A/B tests. Analytics sets none; see Analytics and cookies below.

Google user data

Signing in requests four OAuth scopes: openid, email, and profile to identify you, and https://www.googleapis.com/auth/calendar to manage your calendar.

The calendar scope is used for one purpose: creating and maintaining a dedicated secondary calendar named “Syllabus Center” in your account, and the deadlines, study sessions and class meetings inside it. The app writes only to that calendar. It never modifies your primary calendar or any other calendar, and it never deletes a calendar unless you explicitly ask it to while deleting your account.

Syllabus Center’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, and never used to train any model.

Who else sees your data

• OpenAI — the text of an uploaded syllabus is sent to OpenAI’s API to be turned into structured courses and deadlines. Questions you type into the chat are sent along with your extracted plan (course names, dates, weights) so the answer can be specific. Your Google profile, tokens, and email address are not sent.
• Google — the events the app creates on your behalf, as described above.
• Notion — only if you connect it. The app then creates pages and databases in the Notion page you select, containing your course information and deadlines.
• Stripe — only if you buy a Term Pass. Stripe collects and holds your payment details directly; the app never sees or stores a card number. It keeps only Stripe’s own identifiers for the purchase, so it knows which term you paid for.
• PostHog — product-analytics events, described under Analytics and cookies below. No syllabus content and no Google data.
• Hosting — the app runs on Railway, which stores its data on that infrastructure.

No one else. Your data is not sold, rented, or shared with advertisers, data brokers, or your school.

The calendar feed link

If you create a subscription link for Apple Calendar or Outlook, it contains a long random token. Anyone who has that URL can read your schedule without signing in — that is what makes it work in a calendar app. Treat it like a password. You can reset it from the dashboard at any time, which immediately breaks the old link.

Analytics and cookies

To know whether the app is any good — whether people finish setting up, where they get stuck, whether they come back next week — it records a small set of product events through PostHog, a product-analytics provider acting as a processor on the operator’s instructions.

What is sent to PostHog:

• Events — named actions like “signed in,” “uploaded a syllabus,” “saw the paywall,” “started checkout,” with counts and timings.
• A pseudonymous id for your account, so a funnel can tell one person from two. Your email address and name are not sent.
• Ordinary web context — page URL, referrer, browser and operating system, approximate country derived from your IP address, and which variant of an experiment you were shown.

What is never sent: the contents of your syllabi, your course names, assignments, due dates or grades; anything received from Google; your Google or Notion tokens; your calendar feed token; your chat messages; or your email address. Google user data is never sent to PostHog or to any other analytics provider, in keeping with Google’s Limited Use requirements above.

Cookies. Analytics sets no cookie and stores nothing in your browser: PostHog runs in cookieless mode, where an anonymous visitor is recognised across page loads for a day by a server-side hash rather than anything saved on your device. The only cookies are first-party: the session cookie (essential — the app cannot keep you logged in without it) and, for visitors outside the EEA, UK and Switzerland, a random id used to keep you in the same arm of an A/B test. European visitors get no A/B cookie and see the standard version. Nothing is used for advertising, so there is no cookie banner because there is nothing to ask. If your browser sends a Global Privacy Control signal, or you enable Do Not Track, analytics is switched off for you automatically and the app keeps working normally.

Experiments

The app sometimes runs A/B tests — two versions of a screen, a different wording, or a different price — to work out which one serves people better. Which version you see is decided by a random id and is not based on anything personal about you. If you are shown a price, that is the price you will be charged; see the Terms for how pricing experiments work.

Your privacy rights

Wherever you live, you can see, export, correct or delete everything the app holds about you, yourself, from the Account panel — no request form and no waiting. Export gives you the whole record as JSON; delete is immediate and permanent.

If the GDPR or UK GDPR applies to you, the lawful bases are: performance of a contract for your account, your syllabi and the plan built from them (there is no service without them); consent for connecting Google Calendar or Notion, which you give on their own consent screens and can withdraw at any time; and legitimate interests for the product analytics above and for keeping the service secure and affordable — an interest balanced against your privacy by sending no syllabus content and no directly identifying information. You have the rights of access, rectification, erasure, restriction, portability, and objection (including objection to processing based on legitimate interests), and the right to complain to your local supervisory authority.

If you are in California, the CCPA/CPRA gives you rights to know, delete, correct, and opt out of sale or sharing. The app does not sell or share personal information, has never done so, and does not use it for cross-context behavioural advertising — so there is nothing to opt out of. Exercising any of these rights will never get you worse service.

If you are a student, note that this is a service you signed up for personally. It is not operated by your school, it is not a school official under FERPA, and your institution has no access to your account.

To exercise anything the Account panel does not cover, email jaappaz7@gmail.com. Requests are answered within thirty days.

Where data is processed

The app, its database, and its processors (OpenAI, Google, Notion, Stripe, PostHog, and the hosting provider) are based in or process data in the United States. If you use the app from outside the US, your data is transferred there. For transfers out of the EEA or UK, the processors rely on the European Commission’s Standard Contractual Clauses.

Deleting your data

The dashboard has an Account panel with a Delete account action. It removes your account, courses, extracted deadlines, plan, settings, and the links to anything the app created — immediately and permanently. There is no soft delete and no recovery.

Two deliberate exceptions: the app never deletes pages in your Notion workspace, because those are your notes; and it removes the “Syllabus Center” Google calendar only if you tick that box while deleting. You can also download everything the app holds about you as JSON from the same panel, or disconnect Google or Notion individually without deleting your account. Revoking access from your Google account permissions also stops all calendar access at once.

Retention

Data is kept until you delete it. There is no fixed expiry — a semester plan is meant to last a semester. If the service is shut down, accounts and their data are deleted.

Security

Traffic is served over HTTPS. Session cookies are signed, HTTP-only, and rejected if tampered with. Tokens are stored server-side and are stripped from application logs. Every request is scoped to the signed-in account, so one user cannot read or modify another’s data. No system is perfect, and this one is maintained by one person — if you find a problem, please report it to the address below.

If there is a breach affecting your personal information, you will be notified by email without undue delay, along with what happened, what was exposed, and what to do about it. Regulators will be notified where the law requires it.

Children

The app is intended for college and graduate students and is not directed at children under 13.

Changes

If this policy changes in a way that affects what is collected or who it is shared with, the date at the top will change and the change will be noted in the project’s public repository.

Contact

Questions, deletion requests, or security reports: jaappaz7@gmail.com.