Privacy Policy

Introduction

This Privacy Policy explains what TurboTerp collects, where it is kept and what we do with it.

The short version: an account is optional, and it holds just your email address. Your plan and schedule stay in your browser. No analytics, no ads, no tracking cookies, and nothing is sold.

What we collect

An account is optional. Campus, Schedule, Calendar, Today and the Advisor all work without one.

If you sign in, we collect your email address, and nothing else. Any email address works; it doesn't have to be a UMD one. There is no password: you sign in with a link sent to that address.

We use your email address only to sign you in and to tell your account apart from others. We don't send newsletters or marketing email.

We never ask for or store your Testudo password or your UID, and we never see your official UMD records.

What is stored in your browser

TurboTerp saves a few things on your device using your browser's local storage. None of it is sent to us.

• turboterp-advisor-plan: your four-year plan, including the courses, grades and credit you entered.
• turboterp-advisor-consent: your signed Advisor agreement (version, date and typed name).
• turboterp-schedule: your saved schedule.
• turboterp-registration: your registration checklist and the registration appointment time you typed in.
• turboterp-leave-origin: the building you chose as your starting point for leave-by times.
• turboterp-theme: your light or dark choice.

If you are signed in, our sign-in provider's code also keeps a sign-in token there, so you stay signed in on that device.

Clearing your site data in the browser deletes all of it.

Transcripts

If you add a transcript PDF, it is read in your browser, including text recognition (OCR) for scanned pages. The file is never uploaded, and we never see it.

Cookies and tracking

No analytics, no ads and no tracking cookies.

While the site is in preview, entering the access code sets one cookie, tt_access, so that browser stays let in for 180 days. It holds a scrambled copy of the code and nothing about you.

Maps and location

Your location is used only when you tap a button like "Show my location", and it isn't stored.

When you plan a trip, its start and end points (which can be your location) are sent to our server to find buses. They're used for that request only and aren't saved.

How your data is used and shared

Your data is used only to run TurboTerp for you. We do not sell, rent or give away your email address or anything else about you, to advertisers, data brokers or anyone else.

The only others that handle it are the services listed below, and only as far as running the site needs.

Other services involved

• Supabase runs sign-in and the database, in the United States. It stores your email address and sends the email with your sign-in link.
• Brevo sends email for us: sign-in emails, issue reports and the plan emails you ask for. It sees the address it sends to and the message it carries.
• Vercel hosts the website. Like any web host, it may keep short-lived request logs (such as IP address and the page requested) to run and protect the service.
• OpenFreeMap serves the map tiles, so it sees your IP address when a map loads, like any site you load images from.

Links to other sites, such as UMD pages, LibCal and Testudo, take you to services with their own privacy policies.

Reports and donations

Report an issue sends what you type from our server, through Brevo, to us. A report email holds what you wrote, the page you named, your email address only if you typed one, and the time it was sent. Issues filed on GitHub are public.

Email my plan sends your 4-year plan as a PDF, with a short summary of your audit, only to your own address, the one you signed in with. Nothing is sent to any other address.

To stop abuse, we keep a rate-limit record for each report or plan email: a scrambled copy of your IP address (reports) or account id (plan emails) and the time. It is deleted after a day.

Donations go through Venmo, under Venmo's own privacy policy. We never see your card or bank details. We see what Venmo shows the person receiving a payment: your Venmo name, the amount and any note.

Coming next: your plan on every device (planned)

Storing your plan and your signed agreement on our server is planned, not built yet. The plan is to keep them (version, time, account and a scrambled copy of the typed name) on our server, tied to your account, so they follow you between devices.

You will be able to delete it all yourself, after confirming that you mean it. This page will be updated before that starts.

Deleting your data

Everything in your browser is yours to delete: clear the site's data in your browser settings.

To delete your account and the email address stored with it, ask us through the Report an issue page, linked below. Send the request from the address the account uses, so we know it is yours.

Data security

The site is served over an encrypted connection, and account data is kept with a provider that encrypts it in transit and at rest. Keys and passwords for these services are kept out of the public code. No system is perfectly secure, so we keep as little about you as we can.

Children

TurboTerp is made for college students. It is not meant for children under 13, and we don't knowingly collect their data.

Changes to this policy

We may update this policy. The date at the top changes when we do. If we start collecting something new or using your data in a new way, this page is updated before that starts.

Contact us

Questions, or a request to delete your data? Reach us through the Report an issue page, linked below.