Security and data

At a glance

• Each student can only reach their own records and files. We test this across accounts.
• Uploaded files are private and open through links that expire on their own.
• Your data goes to OpenAI only when you scan a syllabus or ask the course assistant, and it’s never used to train AI models.
• Delete your account and your files, records, and sign-in are removed right away.

How your data is protected

• Encrypted in transit: ModStudent is served over HTTPS, and connections to Canvas must use HTTPS too.
• Your records are walled off: our database uses row-level security on every table, so each student can only read and change their own rows, even if someone tried to request another student’s data directly.
• Private files: documents and profile photos live in private storage, in a folder only you can reach. They open through signed links that expire on their own: within a minute for documents and within an hour for your profile photo.
• Secrets stay on the server: keys like our OpenAI key are only used by server code and are never sent to your browser.
• Passwords: sign-in is handled by Supabase Auth. Your password is checked by Supabase and is never stored by us in plain text.
• Shared computers: signed-in pages are never saved for offline use, so one student’s planner won’t show up for the next person on a shared device. Header Sign out ends every device session (not only this browser).
• Session revocation: Settings → Account security → Sign out of other devices keeps this browser signed in and ends sessions on phones and other computers. Change password from the same panel while signed in.
• Fair-use limits: each student has hourly and daily limits on AI scans, and an hourly limit on feedback messages.
• Isolation testing: an automated cross-account check signs in as two test students and confirms neither can read, change, delete, or download the other’s data and files.

What you control

• Download: Settings → Your data → download a full backup (JSON) or calendar (.ics). Open uploaded files from Resources.
• Edit or remove: change or delete planner items, files, and settings anytime in the app.
• Delete your account: Settings → Your data → Delete account (type DELETE). Files, records you own, and sign-in are removed right away.
• Reminders: turn email and push reminders off in Settings → Reminders.
• Optional AI and imports: nothing is sent to OpenAI until you scan a syllabus or ask the course assistant. Canvas tokens are used for one import request and never stored. More detail: AI, Canvas, and the Privacy Policy.

AI Features & Syllabus Scanning

When anything is sent

Only when you choose to scan a syllabus. We send OpenAI the file or text you provide, along with today’s date, your time zone, and your current term’s name and dates so it can work out the right year and due dates.

And when you ask the course assistant a question. We send your question, the last few messages of that conversation, today’s date, your time zone, and a text summary of the courses you chose to ask about: course names, instructors, grade weights, assignments, due dates, grades, exams, class times, saved campus contacts, and the text notes in those courses’ Resources folders. It also includes your estimated GPA, active scholarships (amount, GPA minimum, renewal date), your minimum GPA and aid deadline if you added them, open financial-aid items and scholarship applications, and study sessions planned for the next 14 days. Uploaded files, links, budget details, and personal tasks are never included, and we don’t save the conversation.

How OpenAI handles it

We use OpenAI’s API with its response storage option turned off. According to OpenAI’s API data policy (opens in a new tab), data sent through the API isn’t used to train OpenAI’s models by default, and OpenAI may keep API inputs for a limited time (up to 30 days) to monitor for abuse before deleting them.

What we do with it

• ModStudent never uses your syllabi to train AI models.
• If the AI reader is unavailable, a simpler reader runs on our own server and nothing is sent to OpenAI.
• You review and confirm every extracted date before anything is saved. Scanning doesn’t save the syllabus file itself to your account.
• Scans and assistant questions are limited per student to prevent abuse.

Canvas import

When you import from Canvas, the access token you paste is used for that one preview request to your school’s Canvas site and is never stored. We bring in only the course names and upcoming assignment titles, due dates, and points you choose to keep. For extra peace of mind, you can delete the token in Canvas once your import is done.

Data retention

• Your account and planner: kept until you delete them or your account.
• Uploaded files and profile photo: kept until you remove them or delete your account.
• Messages you send us: kept to help us improve, then deleted after 2 years. If you delete your account sooner, they stay without any link to you.
• Product events: short records like “syllabus imported” or an error report, never including your IP address or syllabus contents. Deleted after 13 months. If you delete your account sooner, they stay without any link to you.
• AI scan counts: deleted after 2 days, or right away with your account.
• Backups: encrypted backups, kept up to 30 days, then deleted.
• Server logs: kept by our hosting providers and removed on their own schedules.

Deleting your account

Go to Settings → Your data → Delete account and type DELETE. We remove your uploaded files, every record you own, and your sign-in immediately. Want a copy first? Download your full backup (JSON) and calendar (.ics) from the same place.

Third-party services

Privacy and security help

Privacy questions or requests: privacy@modstudent.com. Security vulnerabilities: security@modstudent.com (see reporting guidelines below). General support: use Help in the app or email support from our Contact details on About.

Reporting a vulnerability

Found a security issue? Please email security@modstudent.com with what you found, the steps to reproduce it, and what impact you think it has. We aim to reply within 3 business days.

While you investigate, please:

• Only use accounts you own. Never access, change, or delete other students’ data.
• Don’t run tests that could slow down or disrupt ModStudent, like denial-of-service, load testing, or spam.
• Don’t use social engineering or phishing against students or our team.
• Give us a reasonable chance to fix the issue before sharing it publicly.

Good-faith security research that follows these guidelines is welcome, and we’ll work with you to understand and fix what you find. Our contact details are also published at /.well-known/security.txt.