Privacy notice

The short version

• No account is needed to explore. Browsing is fully open.
• Your school, the courses you mark as taken, and any plan you build stay in your own browser. They're never uploaded to us.
• Signing in is optional and only needed to post. It uses a one-time link sent to your school email, with no password.
• If you sign in, we store your email, a small profile (school, class year, an optional handle), and anything you post. You appear to others by class year, never your real name.
• We use privacy-conservative analytics with no raw search text, no course titles, and no session recording.
• Everything is served only over encrypted (HTTPS/TLS) connections.
• We never sell your data and we don't run third-party advertising trackers.
• You can erase everything we've stored on your device at any time by clearing this site's browser storage.

What we store on your device

Your school choice, the courses you mark as taken, your graph layout preference, and any plan you build are saved in your browser's local storage. This information stays on your device. We do not require an account, and we do not upload your school, your courses, or your plan to our servers. Because it lives in your browser, it is protected by your device and browser security, and you stay in full control of it. Clearing your browser storage for this site removes it completely.

One exception: when you use “Share this path,” your plan is encoded into the link itself. Anyone you send that link to can see the plan, and like any URL it may be retained in browser history, server request logs, and similar infrastructure along the way. Only share a plan link if you're comfortable with that.

When you sign in

Signing in is optional and only needed to post. It works with a one-time link sent to your school email address. There is no password to create or store.

When you sign in, we keep the following on our servers:

• Your email address, used to send the sign-in link and to confirm your school so posting stays student-only. We do not use it for marketing and we never sell it.
• A small profile: your school, your class year, an optional handle, and whether your school email is verified. You appear to other students by class year, never by your real name.
• Anything you choose to post: reviews, ratings, votes, board posts, and study-group membership. These are tied to your account so you can manage them, and shown to others without your identity.

This account data lives in our database (hosted on Supabase) behind row-level access controls and is sent only over encrypted connections. You can ask us to delete your account and everything tied to it at any time by emailing coursetrees@gmail.com.

Cookies and similar technologies

We keep cookies to a minimum and use them only for two purposes:

• Essential / security cookies: used to keep the site working correctly and securely (for example, basic security and, where enabled, access controls). These contain no marketing data and are not used to profile you.
• Analytics cookies: a small, coarse signal that helps us understand which features are used so we can improve the site, as described below.

These cookies and your stored preferences hold no sensitive personal information: no names, no contact details, no financial data. They are transmitted only over encrypted HTTPS/TLS connections and are protected in line with the security measures described below. We do not use cookies for cross-site advertising.

Analytics

We use privacy-conservative product analytics to understand how the site is used. We record the page path (with course, plan, and other student-specific values stripped out of the URL first) plus a small set of coarse, non-identifying product events. For example, that a course was opened, or that a search happened. We deliberately do not send your raw search text or course titles, and we do not run session recording or blanket page-content capture.

How your data is protected

We take the security of the little data we handle seriously:

• Encryption in transit. All traffic between your browser and CourseTrees is encrypted using industry-standard HTTPS/TLS.
• Data minimization. We simply don't collect personal data we don't need. There's no profile, no contact info, and no tracking of you across other sites.
• Little is stored centrally. Your school, courses taken, and plans never leave your browser. If you sign in, only your email, a minimal profile, and what you post are stored on our servers, nothing more.
• Protected infrastructure. The catalog database enforces row-level access controls and is reachable only through a read-only public key, and the site is served from a reputable, security-hardened hosting provider.
• No sale of data. We never sell, rent, or trade your data, and we don't share it with advertisers.

No method of transmission or storage is ever 100% guaranteed, but we work to protect your information using these reasonable, widely-accepted safeguards.

Course data

The catalog data we display is factual information gathered from public university catalogs. It is not personal data about you. The grade distributions we show are aggregate and de-identified, and we suppress any group with fewer than 5 students so no individual can be re-identified. Our data ethics page explains this in full, including how FERPA, GDPR, and CCPA/CPRA apply to us and how to request an opt-out or takedown. See also the ethics and data sourcing section for how catalog data is collected.

Data retention

Your preferences remain on your device until you clear them. Analytics signals are coarse and non-identifying and are retained only as long as needed to understand product usage. If you never sign in, we hold no account for you. If you do, your profile and posts are kept until you ask us to delete them, which you can do at any time by emailing us.

Children's privacy

CourseTrees is intended for university students and the general public. It is not directed at children under 13, and we do not knowingly collect personal information from them.

Your choices and rights

You can clear the data stored on your device at any time by clearing your browser storage for this site. You may also use your browser's “do not track” and cookie controls. Wherever you live, you can contact us to ask what we hold and to request that we address any privacy concern. For any question, request, or correction, email coursetrees@gmail.com.

Changes to this notice

We may update this notice as the site evolves. When we do, we'll revise the “last updated” date above. Material changes will be reflected here.

Contact

Questions about privacy? Email coursetrees@gmail.com.