Your course data is used to organize your semester.

Last updated: August 31, 2026

Information we collect

When you sign in, we receive your Google account identifier, email address, name, and profile image. We store the profile and onboarding details you provide, along with the classes, deadlines, completion state, calendar blocks, and settings needed to operate Syllabo.

Syllabus files and AI processing

Uploaded PDF, TXT, and Markdown files are processed to extract course information and deadlines. Syllabo does not intentionally write the original binary file to PostgreSQL or permanent object storage. Extracted text is retained in a review draft for no more than seven days and is cleared when that import is confirmed or expires. Saved classes retain the fields you approve and short source evidence used to explain a result, not the pending draft's full extracted text.

When third-party AI is enabled, up to the configured character limit of extracted syllabus text is sent to OpenAI solely to return structured course data. Syllabo sends a non-storage request flag where the protocol supports it, but that flag does not override a provider's own policy. Syllabo itself does not use syllabus content to train models. Automated extraction can be wrong, so you must review the result before saving.

OpenAI's API data controls documentation says API data is not used to train or improve its models unless the customer explicitly opts in. It also says abuse-monitoring logs may contain prompts and responses and are retained for up to 30 days by default. Modified Abuse Monitoring and Zero Data Retention require OpenAI approval; Syllabo does not claim either control unless it has been verified for the production OpenAI project.

Google sign-in and Calendar data

Basic sign-in requests only OpenID, email, and profile access. From Google, Syllabo receives your Google account identifier, email address, name, and profile image so it can create and secure your Syllabo account. Google Calendar event access is requested separately only when you choose to connect Calendar. Syllabo uses that permission only to create or update the deadline events you select; it does not download or display your existing Calendar events and does not request Gmail or Google Drive access.

For a connected Calendar account, Syllabo stores the linked Google email address, encrypted OAuth access and refresh tokens, granted scope, token expiration time, and the Google event identifiers and links returned for events Syllabo created. When you ask Syllabo to sync a deadline, it sends Google the assignment title, class name, optional notes and location, due date or time, and timezone needed to create or update that event. OAuth tokens are encrypted at rest.

How Google user data is shared, transferred, or disclosed

Syllabo does not sell Google user data and does not share, transfer, or disclose it to advertisers, data brokers, information resellers, analytics providers, or AI model providers. In particular, Google account details, OAuth tokens, and Google Calendar data are not sent to PostHog, Google Analytics, or the configured syllabus-processing AI provider.

Google user data is disclosed only to the following service providers as necessary to operate the user-facing Syllabo features you request:

Vercel hosts Syllabo and processes encrypted application traffic while sign-in and Calendar sync requests are handled.
Neon provides the PostgreSQL database where the Google account fields, encrypted OAuth tokens, granted scope, token expiration, and returned Calendar event identifiers described above are stored.
Google receives the event details listed above when you direct Syllabo to create or update an event in your Google Calendar, and receives OAuth token exchange and refresh requests needed to maintain the connection.

These providers process the data only to deliver Syllabo's sign-in, secure storage, and Calendar-sync functionality. We may also disclose information when required by applicable law or when you give us explicit consent for a specific disclosure. We do not otherwise transfer or disclose Google user data to third parties.

Google API data use

Syllabo's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide or improve the sign-in and Calendar features visible in Syllabo; it is not used for advertising, credit decisions, surveillance, or training generalized AI or machine-learning models.

Analytics

When Google Analytics or PostHog is configured, product analytics remains disabled until you choose “Allow analytics.” We send normalized page paths and coarse, explicit product events such as whether parsing or calendar sync succeeded. PostHog autocapture, session replay, surveys, feature flags, and person profiles are disabled. We do not intentionally send syllabus text, course names, assignment titles, file names, email addresses, error messages, or Google Calendar content. Your choice and an anonymous analytics identifier are stored in this browser and can be reset by clearing site data.

Service providers and operational logs

Vercel processes application traffic and hosts the service, Neon provides PostgreSQL storage, Google provides authentication, Calendar APIs, and optional analytics, PostHog provides optional consent-based product analytics, and OpenAI plus any routed upstream model provider process extracted syllabus text only when AI parsing is enabled. Sanitized operational logs can include timestamps, request identifiers, route names, status codes, model names, and error summaries for reliability and security. We intentionally redact authorization data, account email, and syllabus source text from application logs. Hosting and analytics providers retain data according to the configured service plan and retention settings.

Retention and deletion

Your saved account data remains until you delete the account. Go to Settings → Delete Account to permanently remove the Syllabo profile, stored syllabus imports, classes, deadlines, encrypted calendar connection, and sessions from the application database. Disconnecting Calendar removes Syllabo's stored connection; you can also revoke access from your Google Account. Events already created in Google Calendar remain there until you delete them. Backups and security logs, where present, age out according to their configured retention schedules rather than being rewritten immediately. See the account deletion guide.

Security and contact

We use encrypted transport, authenticated access controls, and encrypted OAuth tokens. No online service can guarantee absolute security. For privacy questions or data requests, email hello@answerai.pro.