Privacy Policy
Last updated: 9 October 2026
1. Who is responsible for your data
School PM is operated by Mordechai Wolfson, an individual based in Israel, who is the data controller for the purposes of this policy.
The way to reach a person about anything on this page — including a request to see, correct or delete your data — is schoolpm.app@gmail.com. It is a monitored address and it is the same one shown in the footer of every page.
2. What this app is
School PMis a planning tool for students. You keep boards of tasks, courses, dependencies and dates in it, and it can optionally keep a calendar in your own Google account in step with that schedule. The planner is free. An optional AI assistant, which reads your board and any files you give it, is a paid add-on. Depending on the administrator's settings, a new account is let in at once or approved by hand.
3. What we hold
Your account
- Your username and email address.
- A one-way hash of your password. The password itself is never stored and cannot be recovered from the hash — a reset replaces it rather than revealing it.
- Timestamps: when the account was created, approved, and last signed in.
- Failed sign-in counts and any lockout expiry, used only to slow down password guessing.
- If you have an assistant plan: which plan, its start and end dates, your credit balance, and a short free-text note the administrator keeps for their own records (for example, that a payment arrived).
Your content
Everything you put on a board: task and course names, descriptions, notes, recommendations, dates, time estimates, grades, credits, dependencies and saved baselines. This lives in a database created for your account and used by no other account.
Data from Google, if you connect it
Described scope by scope in section 4. Nothing is read from Google unless you complete the connection yourself.
Assistant usage, if you use it
- For every assistant reply: when it happened, which model answered, how many tokens it used, what it cost and how many credits were charged. Never what you asked or what it answered.
- For every file you attach: its name, type, size and how many tokens it holds, and the identifier Anthropic gave it. The file itself is held by Anthropic, not here — see section 6.
- Your conversations with the assistant are not stored on our servers. They are kept in your browser, so a chat survives a page reload, until you start a new chat or clear the browser's storage.
- When you connect your own Claude: for each app you allow, its name, when you connected it and when it last refreshed its access; for each personal access token, the name you gave it and its last four characters. Every token, code and refresh token is stored only as a one-way hash, with when it expires.
Messages you choose to send
If you use the feedback form, the message is stored together with your username and email so the administrator can reply. The form says so; it is not anonymous.
Technical data
- A session cookie,
school_pm_session, which is how the app knows it is you. It is signed, HTTP-only, and holds your account id and nothing else — no name, no email. - A language cookie,
school_pm_locale, holding eitherenorhe. - Small display preferences kept in your browser's local storage — which sort order you last used, whether a panel was collapsed, which assistant model you picked — and your assistant conversations. These never leave your device except as part of a message you send.
- If, and only if, you switch on phone or desktop notifications: the push subscription your browser issues, so a notification can be delivered to that device.
There is no analytics, no advertising network, no tracking pixel and no third-party script of any kind on this site.
4. Google user data, scope by scope
Connecting Google Calendar is optional and the app works without it. When you connect you are asked for the three calendar permissions below, and no others. They are deliberately narrow: the app can write only to a calendar it creates itself, and everything it does to any other calendar is reading. It never asks for the broad calendar permission, which would also let it share and permanently delete every calendar you can reach.
| Permission requested | What the app does with it |
|---|---|
.../auth/calendar.app.created | Create a single calendar in your Google account, named School PM, and create, read, update and delete events on that one calendar. These events are the work sessions you schedule here, so they appear on your phone. This is the whole of the app's write access, and it reaches nothing it did not create itself. Synchronisation runs in both directions on this calendar: moving an event in Google Calendar moves the task here, and changing it here updates the event. |
.../auth/calendar.calendarlist.readonly | Read the list of calendars in your account — their names, not their contents. It is what fills the picker where you choose which calendars to show beside your work, and what finds the School PM calendar again on a later visit. |
.../auth/calendar.events.readonly | Read events from the calendars shown beside your work — your main calendar by default, and any others you choose in Settings — so they can be drawn alongside your own work. They are only displayed; they are never copied into the app as tasks. Nothing is created, changed or deleted on those calendars — this permission cannot do any of those things. |
How email is sent
Email from the app — password-reset links, due-date digests, notices and the weekly backup described in section 6 — is sent from a Gmail account that belongs to School PM itself, not from yours or anybody else's. That account has a separate Google connection of its own which can send mail and do nothing else. It is set up once by the administrator and is never asked of you: connecting your calendar gives the app no access to your Gmail.
Limited Use
School PM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms: data obtained from Google is used only to provide and improve the features described above. It is not sold, not transferred to anyone except as needed to provide those features, not used for advertising, and not read by any human — with the single exception that a person may look at it if you specifically ask for support and it is necessary to answer you, or where the law requires it.
What the app never touches
Your Gmail, Drive, Contacts, Photos and every other Google service are outside the permissions above and are never accessed. The app does not ask for your Google password and never sees it — Google handles the sign-in and hands back a token instead.
5. Where it is stored, and how it is protected
- Separate databases.Each approved account is given its own database rather than a row in a shared table. There is no query anywhere in the app that could return one person's boards to another, because the connection that would be needed is never opened.
- Where. Databases are hosted by Turso in AWS ap-south-1 (Mumbai, India). The application itself runs on Vercel's network. Both are outside Israel and outside the EEA; by using the app you accept that your data is stored and processed there.
- In transit. Every connection is HTTPS. The site sends HSTS, so browsers refuse to talk to it unencrypted.
- Passwords. Stored as a PBKDF2-SHA256 hash with a random per-account salt, never in readable form. Nobody, including the administrator, can read your password or recover it — a reset replaces it.
- At rest.The database credentials that point at your database, and your Anthropic API key if you supply one, are encrypted with a key held only in the server environment. Your Google tokens and your board content are stored in your own database and are protected by that database's access credentials rather than by a second layer of encryption — see the note below.
- Not exposed. Secrets stored alongside your settings — Google tokens, the push keypair, your Anthropic key — are on a server-only list and are stripped from every API response and from the export file.
Stated plainly:your Google refresh token is held in your account's own database in readable form. Anyone with the credentials to that database could read it. It is never sent to a browser and never included in an export. We would rather say this than imply a protection that is not there.
6. Who else your data reaches
These are every third party involved, and the only ones. None of them is paid to profile you and none receives your data for their own purposes.
| Who | Why, and what they get |
|---|---|
| Vercel | Hosts the application. Handles every request, so it processes whatever is in that request, and keeps short-lived operational logs. |
| Turso | Hosts the databases. Holds your account record and your board content at rest. |
| Two separate things. If you connect Calendar, Google receives the reads and writes described in section 4. Separately, Google is the mail provider for School PM's own sending account, so every email the app sends passes through Gmail on its way to you. | |
| Anthropic | Only if you use the Assistant. See the next section — this one deserves its own. |
| Your browser's push service | Only if you switch on notifications. Apple, Google or Mozilla, depending on your browser, deliver the notification to your device. |
The Assistant, and what it sends
The Assistant is a paid add-on. Without an assistant plan it is locked, and nothing is ever sent to Anthropic on your behalf.
When you use it, the content of the board you are working on — task and course names, statuses, dates, estimates, grades and dependencies — is sent to Anthropic's API so the model (Claude) can answer about it, together with the messages you type and any files you attach.
Whose account the request goes through.Normally School PM's own: the request is made with the operator's Anthropic API key, under School PM's agreement with Anthropic. Under Anthropic's commercial terms data sent through the API is not used to train their models. If you save your own Anthropic API key in Settings, your requests are made with your key instead, sit under your own agreement with Anthropic, and are billed by them to you.
Files.A file you attach is uploaded to Anthropic's Files API, with the same key, so Claude can read it on every message of the chat without it being uploaded again. Word and Excel files are converted to text in your browser first; very large files are split into parts. A file is deleted at Anthropic when you remove it from the chat, when you start a new chat, or when you delete your account — and in any case it expires there 90 days after it was uploaded.
Connecting your own Claude. If you add School PM as a connector in Claude (on the web, desktop or phone) or in Claude Code and allow it, or connect another MCP client with a personal access token, that app reads and changes your boards on your instructions. What it reads is then sent to the AI provider you chose, under your own agreement with them — School PM does not see your conversation. Disconnecting it in Settings, changing your password or deleting your account cuts it off.
If you would rather no coursework left the app, do not use the assistant or connect an MCP client. Every other feature works without them.
The weekly backup email
Once a week, unless you turn it off in Settings, the app emails you a complete export of each of your boards as an attachment. It goes from School PM's own sending account to the address on your account, and to no other address.
The attachment is encrypted with your account password — the one you sign in with. Nobody who reaches that mailbox, or yours, can read it without that password, and neither can we: the key is derived from the stored hash of your password, and the plaintext file exists only for the moment it takes to seal it. You open it at /decrypt, which runs entirely in your browser and never uploads the file.
One consequence worth knowing: if you change your password, backups sent before the change stay sealed against the old one.
7. How long it is kept
| What | How long |
|---|---|
| Your account and board content | Until you delete the account, or ask the administrator to. There is no automatic expiry, and an assistant plan ending never deletes anything. |
| Files you gave the assistant | At Anthropic until you remove them from the chat, start a new chat or delete the account — and never more than 90 days after upload. |
| Assistant usage records | Kept as the operator's accounting records. When you delete your account they are detached from it: your account id and any note are removed, and only the dates, models, token counts, costs and payments remain. |
| Assistant conversations | Only in your browser, until you start a new chat or clear its storage. |
| Google tokens | Until you disconnect, delete the account, or withdraw the permission from your Google account page. |
| Events on your School PM calendar | They are yours and stay in your Google account until you delete them there. Disconnecting does not remove them. |
| Reminder records | A small log of which reminders have already been sent, so you are not told twice. Kept with the board and destroyed with it. |
| Feedback you sent | Kept after account deletion but stripped of your name and email address, because the message is the administrator's record of a bug or request and no longer identifies you. |
| Messages from the administrator to you | Deleted with the account. |
| Hosting logs | Held by Vercel under their retention schedule, which is short and not controlled by us. |
8. What you can do
Disconnect Google
Settings → Google Calendar → Disconnect. This hands the permission back to Google, so the grant is withdrawn rather than merely forgotten. Your School PM calendar and its events stay in your Google account.
You can also revoke it from Google's own page at myaccount.google.com/permissions, which works even if you cannot sign in here.
Take a copy
Settings → Backup & restore → Export everything gives you a JSON file with every board, task, course, dependency and baseline in it.
Delete everything
Settings → Delete this account. It asks for your password and a typed confirmation, then: hands the Google permission back, destroys the database holding your boards, deletes the files you gave the assistant, deletes your account record and any messages sent to you, anonymises any feedback you sent and your assistant usage records, and signs you out everywhere.
It is immediate and there is no undo, no grace period and no archive. Export first if you want a copy.
Turn off the extras
Reminder emails, phone notifications and the weekly backup email can each be switched off in Settings → Notifications without affecting anything else.
Ask a person
Write to schoolpm.app@gmail.comto see what is held about you, correct it, or have it deleted. If you are in a place whose law gives you rights over your data — Israel's Privacy Protection Law, or the GDPR if you are in the EEA — this is the address to use to exercise them.
9. Cookies
Only the two cookies in section 3, both strictly necessary: one to keep you signed in, one to remember your language. There are no analytics cookies, no advertising cookies and no third-party cookies, which is why this site has no cookie banner asking you to accept any.
10. Selling data
Your data is not sold, rented, licensed or shared for anyone else's marketing, and it is not used to train any machine-learning model by us. This is not a policy that could quietly change: the app has no advertising integration and no data-broker relationship to change it into.
11. Children
The app is built for students in higher and upper-secondary education and is not directed at children under 16. Accounts are approved individually by the administrator. If you believe someone under 16 has an account, write to schoolpm.app@gmail.com and it will be removed.
12. Changes to this policy
The date at the top changes whenever this document does. If a change materially affects how your data is handled — a new third party, a new category of data, a new purpose — you will be told inside the app before it takes effect, not merely by this page changing quietly.
13. Governing law
This policy is governed by the laws of the State of Israel, and the courts of Israel have jurisdiction over any dispute arising from it. This does not remove any right you have under the law of the country you live in.
See also the Terms of Service.