Privacy Policy

Syllabus AI (“the app”), operated at syllabuscenter.com, turns syllabus PDFs into a semester plan and puts it on your calendar. This policy describes exactly what it collects, who it sends data to, and how to get rid of all of it. It is written to be read, not to be survived.

What the app stores

• Your Google profile — your Google account id, email address, name, and profile picture URL, received when you sign in. These identify your account.
• A Google refresh token, only if you grant calendar access. It is what lets the app write to your calendar later without asking you to sign in again. It is stored server-side, never sent to your browser, and never logged.
• What was extracted from your syllabi — course names, instructors, meeting times, assignments, exams, due dates, grading weights, and the policy excerpts the extractor quoted.
• Your settings — timezone (reported by your browser so calendar events land at the right local time), which categories you chose to sync, and the section you selected for a multi-section course.
• Identifiers for what it created — the ids of the Google Calendar events and Notion pages the app made, so a re-sync updates them instead of creating duplicates.
• A calendar feed token, if you create a subscription link. See below.

What the app does not store

The syllabus files themselves. An uploaded PDF is read in memory, its text extracted, and the file discarded. It is never written to disk or to a database.

The app also does not store Google access tokens (only the refresh token), does not read any Google Calendar other than the one it created, does not read your email or files, and does not use advertising or cross-site tracking cookies. The only cookie it sets is the signed session cookie that keeps you logged in.

Google user data

Signing in requests four OAuth scopes: openid, email, and profile to identify you, and https://www.googleapis.com/auth/calendar to manage your calendar.

The calendar scope is used for one purpose: creating and maintaining a dedicated secondary calendar named “Syllabus AI” in your account, and the deadlines, study sessions and class meetings inside it. The app writes only to that calendar. It never modifies your primary calendar or any other calendar, and it never deletes a calendar unless you explicitly ask it to while deleting your account.

Syllabus AI’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, and never used to train any model.

Who else sees your data

• OpenAI — the text of an uploaded syllabus is sent to OpenAI’s API to be turned into structured courses and deadlines. Questions you type into the chat are sent along with your extracted plan (course names, dates, weights) so the answer can be specific. Your Google profile, tokens, and email address are not sent.
• Google — the events the app creates on your behalf, as described above.
• Notion — only if you connect it. The app then creates pages and databases in the Notion page you select, containing your course information and deadlines.
• Hosting — the app runs on Railway, which stores its data on that infrastructure.

No one else. Your data is not sold, rented, or shared with advertisers, data brokers, or your school.

The calendar feed link

If you create a subscription link for Apple Calendar or Outlook, it contains a long random token. Anyone who has that URL can read your schedule without signing in — that is what makes it work in a calendar app. Treat it like a password. You can reset it from the dashboard at any time, which immediately breaks the old link.

Deleting your data

The dashboard has an Account panel with a Delete account action. It removes your account, courses, extracted deadlines, plan, settings, and the links to anything the app created — immediately and permanently. There is no soft delete and no recovery.

Two deliberate exceptions: the app never deletes pages in your Notion workspace, because those are your notes; and it removes the “Syllabus AI” Google calendar only if you tick that box while deleting. You can also download everything the app holds about you as JSON from the same panel, or disconnect Google or Notion individually without deleting your account. Revoking access from your Google account permissions also stops all calendar access at once.

Retention

Data is kept until you delete it. There is no fixed expiry — a semester plan is meant to last a semester. If the service is shut down, accounts and their data are deleted.

Security

Traffic is served over HTTPS. Session cookies are signed, HTTP-only, and rejected if tampered with. Tokens are stored server-side and are stripped from application logs. Every request is scoped to the signed-in account, so one user cannot read or modify another’s data. No system is perfect, and this one is maintained by one person — if you find a problem, please report it to the address below.

Children

The app is intended for college and graduate students and is not directed at children under 13.

Changes

If this policy changes in a way that affects what is collected or who it is shared with, the date at the top will change and the change will be noted in the project’s public repository.

Contact

Questions, deletion requests, or security reports: jaappaz7@gmail.com.