Privacy Policy
Last updated: 9 September 2026
1. Who is responsible for your data
School PM is operated by Mordechai Wolfson, an individual based in Israel, who is the data controller for the purposes of this policy.
The way to reach a person about anything on this page — including a request to see, correct or delete your data — is schoolpm.app@gmail.com. It is a monitored address and it is the same one shown in the footer of every page.
2. What this app is
School PM is a planning tool for students. You keep boards of tasks, courses, dependencies and dates in it, and it can optionally keep a calendar in your own Google account in step with that schedule. Accounts are approved by hand; there is no self-service signup that grants immediate access.
3. What we hold
Your account
- Your username and email address.
- A one-way hash of your password. The password itself is never stored and cannot be recovered from the hash — a reset replaces it rather than revealing it.
- Timestamps: when the account was created, approved, and last signed in.
- Failed sign-in counts and any lockout expiry, used only to slow down password guessing.
- The dates that describe your paid access, and a short free-text note the administrator keeps for their own records (for example, that a payment arrived).
Your content
Everything you put on a board: task and course names, descriptions, notes, recommendations, dates, time estimates, grades, credits, dependencies and saved baselines. This lives in a database created for your account and used by no other account.
Data from Google, if you connect it
Described scope by scope in section 4. Nothing is read from Google unless you complete the connection yourself.
Messages you choose to send
If you use the feedback form, the message is stored together with your username and email so the administrator can reply. The form says so; it is not anonymous.
Technical data
- A session cookie,
school_pm_session, which is how the app knows it is you. It is signed, HTTP-only, and holds your account id and nothing else — no name, no email. - A language cookie,
school_pm_locale, holding eitherenorhe. - Small display preferences kept in your browser's local storage — which sort order you last used, whether a panel was collapsed. These never leave your device.
- If, and only if, you switch on phone or desktop notifications: the push subscription your browser issues, so a notification can be delivered to that device.
There is no analytics, no advertising network, no tracking pixel and no third-party script of any kind on this site.
4. Google user data, scope by scope
Connecting Google Calendar is optional and the app works without it. When you connect you are asked for the three calendar permissions below, and no others. They are deliberately narrow: the app can write only to a calendar it creates itself, and everything it does to any other calendar is reading. It never asks for the broad calendar permission, which would also let it share and permanently delete every calendar you can reach.
The fourth row is listed for completeness because the app does use it, but it is never asked of you — it belongs to School PM's own sending account, not to yours.
| Permission requested | What the app does with it |
|---|---|
.../auth/calendar.app.created | Create a single calendar in your Google account, named School PM, and create, read, update and delete events on that one calendar. These events are the work sessions you schedule here, so they appear on your phone. This is the whole of the app's write access, and it reaches nothing it did not create itself. Synchronisation runs in both directions on this calendar: moving an event in Google Calendar moves the task here, and changing it here updates the event. |
.../auth/calendar.calendarlist.readonly | Read the list of calendars in your account — their names, not their contents. It is what fills the picker where you choose which calendars to show beside your work, and what finds the School PM calendar again on a later visit. |
.../auth/calendar.events.readonly | Read events from the calendars you explicitly choose to overlay, so they can be drawn alongside your own work. Nothing is created, changed or deleted on those calendars — this permission cannot do any of those things. |
.../auth/gmail.sendNot requested from you, and not from any user account. | This one is never asked of you. It is granted once, by an administrator, on a Google account that belongs to School PM itself rather than to any person — the address every email from the app arrives from. Your own connection cannot grant it and is never asked to. It allows sending mail and nothing else: it cannot read, search or delete anything in any mailbox, including its own. It is what sends password-reset links, due-date digests, notices and the weekly backup described in section 6. |
Limited Use
School PM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms: data obtained from Google is used only to provide and improve the features described above. It is not sold, not transferred to anyone except as needed to provide those features, not used for advertising, and not read by any human — with the single exception that a person may look at it if you specifically ask for support and it is necessary to answer you, or where the law requires it.
What the app never touches
Your Gmail, Drive, Contacts, Photos and every other Google service are outside the permissions above and are never accessed. The app does not ask for your Google password and never sees it — Google handles the sign-in and hands back a token instead.
5. Where it is stored, and how it is protected
- Separate databases.Each approved account is given its own database rather than a row in a shared table. There is no query anywhere in the app that could return one person's boards to another, because the connection that would be needed is never opened.
- Where. Databases are hosted by Turso in AWS ap-south-1 (Mumbai, India). The application itself runs on Vercel's network. Both are outside Israel and outside the EEA; by using the app you accept that your data is stored and processed there.
- In transit. Every connection is HTTPS. The site sends HSTS, so browsers refuse to talk to it unencrypted.
- Passwords. Stored as a PBKDF2-SHA256 hash with a random per-account salt, never in readable form. Nobody, including the administrator, can read your password or recover it — a reset replaces it.
- At rest.The database credentials that point at your database, and your Anthropic API key if you supply one, are encrypted with a key held only in the server environment. Your Google tokens and your board content are stored in your own database and are protected by that database's access credentials rather than by a second layer of encryption — see the note below.
- Not exposed. Secrets stored alongside your settings — Google tokens, the push keypair, your Anthropic key — are on a server-only list and are stripped from every API response and from the export file.
Stated plainly:your Google refresh token is held in your account's own database in readable form. Anyone with the credentials to that database could read it. It is never sent to a browser and never included in an export. We would rather say this than imply a protection that is not there.
6. Who else your data reaches
These are every third party involved, and the only ones. None of them is paid to profile you and none receives your data for their own purposes.
| Who | Why, and what they get |
|---|---|
| Vercel | Hosts the application. Handles every request, so it processes whatever is in that request, and keeps short-lived operational logs. |
| Turso | Hosts the databases. Holds your account record and your board content at rest. |
| Two separate things. If you connect Calendar, Google receives the reads and writes described in section 4. Separately, Google is the mail provider for School PM's own sending account, so every email the app sends passes through Gmail on its way to you. | |
| Anthropic | Only if you use the Assistant. See the next section — this one deserves its own. |
| Your browser's push service | Only if you switch on notifications. Apple, Google or Mozilla, depending on your browser, deliver the notification to your device. |
The Assistant, and what it sends
The Assistant is off until you paste your own Anthropic API key into Settings. There is no shared key and no fallback: if you have not supplied one, no request is ever made.
When you do use it, the content of the board you are working on — task and course names, statuses, dates, estimates and grades — is sent to Anthropic's API so the model can answer about it, together with the messages you type. Because the request is made with your key, that traffic sits under your own agreement with Anthropic and their handling of it is governed by their terms, not ours.
If you would rather no coursework left the app, do not add a key. Every other feature works without one.
The weekly backup email
Once a week, unless you turn it off in Settings, the app emails you a complete export of each of your boards as an attachment. It goes from School PM's own sending account to the address on your account, and to no other address.
The attachment is encrypted with your account password — the one you sign in with. Nobody who reaches that mailbox, or yours, can read it without that password, and neither can we: the key is derived from the stored hash of your password, and the plaintext file exists only for the moment it takes to seal it. You open it at /decrypt, which runs entirely in your browser and never uploads the file.
One consequence worth knowing: if you change your password, backups sent before the change stay sealed against the old one.
7. How long it is kept
| What | How long |
|---|---|
| Your account and board content | Until you delete the account, or ask the administrator to. There is no automatic expiry: an account whose paid access has lapsed becomes read-only, it is not erased. |
| Google tokens | Until you disconnect, delete the account, or withdraw the permission from your Google account page. |
| Events on your School PM calendar | They are yours and stay in your Google account until you delete them there. Disconnecting does not remove them. |
| Reminder records | A small log of which reminders have already been sent, so you are not told twice. Kept with the board and destroyed with it. |
| Feedback you sent | Kept after account deletion but stripped of your name and email address, because the message is the administrator's record of a bug or request and no longer identifies you. |
| Messages from the administrator to you | Deleted with the account. |
| Hosting logs | Held by Vercel under their retention schedule, which is short and not controlled by us. |
8. What you can do
Disconnect Google
Settings → Google Calendar → Disconnect. This hands the permission back to Google, so the grant is withdrawn rather than merely forgotten. Your School PM calendar and its events stay in your Google account.
You can also revoke it from Google's own page at myaccount.google.com/permissions, which works even if you cannot sign in here.
Take a copy
Settings → Backup & restore → Export everything gives you a JSON file with every board, task, course, dependency and baseline in it. Exporting is deliberately still available on a read-only account: you can always get your work out.
Delete everything
Settings → Delete this account. It asks for your password and a typed confirmation, then: hands the Google permission back, destroys the database holding your boards, deletes your account record and any messages sent to you, anonymises any feedback you sent, and signs you out everywhere.
It is immediate and there is no undo, no grace period and no archive. Export first if you want a copy.
Turn off the extras
Reminder emails, phone notifications and the weekly backup email can each be switched off in Settings → Notifications without affecting anything else.
Ask a person
Write to schoolpm.app@gmail.comto see what is held about you, correct it, or have it deleted. If you are in a place whose law gives you rights over your data — Israel's Privacy Protection Law, or the GDPR if you are in the EEA — this is the address to use to exercise them.
9. Cookies
Only the two cookies in section 3, both strictly necessary: one to keep you signed in, one to remember your language. There are no analytics cookies, no advertising cookies and no third-party cookies, which is why this site has no cookie banner asking you to accept any.
10. Selling data
Your data is not sold, rented, licensed or shared for anyone else's marketing, and it is not used to train any machine-learning model by us. This is not a policy that could quietly change: the app has no advertising integration and no data-broker relationship to change it into.
11. Children
The app is built for students in higher and upper-secondary education and is not directed at children under 16. Accounts are approved individually by the administrator. If you believe someone under 16 has an account, write to schoolpm.app@gmail.com and it will be removed.
12. Changes to this policy
The date at the top changes whenever this document does. If a change materially affects how your data is handled — a new third party, a new category of data, a new purpose — you will be told inside the app before it takes effect, not merely by this page changing quietly.
13. Governing law
This policy is governed by the laws of the State of Israel, and the courts of Israel have jurisdiction over any dispute arising from it. This does not remove any right you have under the law of the country you live in.
See also the Terms of Service.