Privacy notice

The short version

• No account is needed to explore. Browsing is fully open.
• Your school, the courses you mark as taken, and any plan you build stay in your own browser. They're never uploaded to us.
• Signing in is optional and only needed to post. It uses a one-time link sent to your school email, with no password.
• If you sign in, we store your email, a small profile (school, class year, an optional handle), and anything you post. You appear to others by class year, never your real name.
• We email you about once a month with what we shipped. You can turn that off in your settings or from any of those emails.
• We use privacy-conservative analytics with no raw search text, no course titles, and no session recording.
• Everything is served only over encrypted (HTTPS/TLS) connections.
• We never sell your data and we don't run third-party advertising trackers.
• You can erase everything we've stored on your device at any time by clearing this site's browser storage.

What we store on your device

Your school choice, the courses you mark as taken, your graph layout preference, and any plan you build are saved in your browser's local storage. This information stays on your device. We do not require an account, and we do not upload your school, your courses, or your plan to our servers. Because it lives in your browser, it is protected by your device and browser security, and you stay in full control of it. Clearing your browser storage for this site removes it completely.

One exception: when you use “Share this path,” your plan is encoded into the link itself. Anyone you send that link to can see the plan, and like any URL it may be retained in browser history, server request logs, and similar infrastructure along the way. Only share a plan link if you're comfortable with that.

When you sign in

Signing in is optional and only needed to post. It works with a one-time link sent to your school email address. There is no password to create or store.

When you sign in, we keep the following on our servers:

• Your email address, used to sign you in, to confirm your school so posting stays student-only, for any seat alert you set yourself, and for a CourseTrees update about once a month that you can turn off in your settings or with the unsubscribe link in the email. We never sell it and we never give it to an advertiser.
• A small profile: your school, your class year, an optional handle, and whether your school email is verified. You appear to other students by class year, never by your real name.
• Anything you choose to post: reviews, ratings, votes, board posts, and study-group membership. These are tied to your account so you can manage them, and shown to others without your identity.

This account data lives in our database (hosted on Supabase) behind row-level access controls and is sent only over encrypted connections. You can delete your account and everything personal tied to it at any time, yourself. See deleting your account.

Cookies and similar technologies

We keep cookies to a minimum and use them only for two purposes:

• Essential / security cookies: used to keep the site working correctly and securely (for example, basic security and, where enabled, access controls). These contain no marketing data and are not used to profile you.
• Analytics cookies: a small, coarse signal that helps us understand which features are used so we can improve the site, as described below.

These cookies and your stored preferences hold no sensitive personal information: no names, no contact details, no financial data. They are transmitted only over encrypted HTTPS/TLS connections and are protected in line with the security measures described below. We do not use cookies for cross-site advertising.

Analytics

We use privacy-conservative product analytics to understand how the site is used. We record the page path (with course, plan, and other student-specific values stripped out of the URL first) plus a small set of coarse, non-identifying product events. For example, that a course was opened, or that a search happened. We deliberately do not send your raw search text or course titles, and we do not run session recording or blanket page-content capture.

When you use Cam

Cam, the CourseTrees Pro assistant, is powered by a third-party inference provider (Groq). When you send a message, we pass your conversation with the assistant and a handful of matching public catalog rows to that provider to generate the answer. Four things about you go with it, and they are the whole list. Your school, the current term, the major you told us, and your class year. We never send your name, your email, or the courses you have taken. Cam does read your completed courses when you ask about your own progress, and that reading happens on our servers, so the list never reaches the provider. We do not use your questions to train anything, and we do not permit the provider to. If you never open the assistant, nothing you do on the site is sent to any AI provider.

Our analytics record that a question was asked, at which school, and whether it could be answered. They do not record the text of your question.

How your data is protected

There is not much data here to protect, but here is how we protect what there is:

• Encryption in transit. All traffic between your browser and CourseTrees is encrypted using industry-standard HTTPS/TLS.
• Data minimization. We don't collect personal data we don't need. There's no profile, no contact info, and no tracking of you across other sites.
• Little is stored centrally. Your school, courses taken, and plans never leave your browser. If you sign in, only your email, a minimal profile, and what you post are stored on our servers, nothing more.
• Protected infrastructure. The catalog database enforces row-level access controls and is reachable only through a read-only public key, and the site is served from a reputable, security-hardened hosting provider.
• No sale of data. We never sell, rent, or trade your data, and we don't share it with advertisers.

No method of transmission or storage is ever 100% guaranteed. These are the standard safeguards and we use them, but we are not going to promise you more than that.

Course data

The catalog data we display is factual information gathered from public university catalogs. It is not personal data about you. The grade distributions we show are aggregate and de-identified, and we suppress any group with fewer than 5 students so no individual can be re-identified. Our data ethics page explains this in full, including how FERPA, GDPR, and CCPA/CPRA apply to us and how to request an opt-out or takedown. See also the ethics and data sourcing section for how catalog data is collected.

Data retention

Your preferences remain on your device until you clear them. Analytics signals are coarse and non-identifying and are retained only as long as needed to understand product usage. If you never sign in, we hold no account for you. If you do, your profile and posts are kept until you delete your account, which you can do yourself at any time. See below.

Children's privacy

CourseTrees is intended for university students and the general public. It is not directed at children under 13, and we do not knowingly collect personal information from them.

Your choices and rights

You can clear the data stored on your device at any time by clearing your browser storage for this site. You may also use your browser's “do not track” and cookie controls. You can stop the monthly CourseTrees update from your settings or from the unsubscribe link in any of those emails, and stopping it does not affect sign-in email or the seat alerts you set. Wherever you live, you can contact us to ask what we hold and to request that we address any privacy concern. For any question, request, or correction, email coursetrees@gmail.com.

Changes to this notice

We may update this notice as the site evolves. When we do, we'll revise the “last updated” date above. Material changes will be reflected here.

Contact

Questions about privacy? Email coursetrees@gmail.com.