Privacy policy
Last updated 10 September 2026.
This is the full version. The short version: your syllabi and course data are yours, we do not sell anything, we use a handful of well-known providers to make the app work, and you can download or delete everything yourself in two clicks.
This policy explains what we collect and why, in the terms Canadian privacy law expects. If anything here is unclear, ask, and we will make it clearer.
1. Who we are
SyllaBuddy is an independent study tool operated from Ontario, Canada. It is not affiliated with, endorsed by, or connected to any university or college. University names and logos used on the site belong to those institutions and are used only to describe where the tool works.
For anything to do with privacy, including access, correction and deletion requests, contact hello@syllabuddy.ca. That address reaches the person responsible for privacy at SyllaBuddy, and we aim to answer within 30 days, which is the timeframe Canadian federal privacy law sets.
2. What we collect, and why
We collect only what the service needs to work. Nothing here is sold, rented, or used for advertising.
| What | Why | Where it comes from |
|---|---|---|
| Name, email address, password (stored only as a salted hash) | To create your account and let you sign in | You, at signup |
| School, term label, term start and end dates, time zone | To turn phrases like “due in Week 3” into real dates, and to make “today” correct where you live | You, during setup |
| Your section or cohort, and any notes you give about a course | So the reader keeps your section's dates and drops other sections' | You, optional |
| Course data: assessments, dates, weights, class times, key dates, policies, summaries | This is the product | Extracted from the documents you upload |
| What you tick off, check-ins, mood entries, journal entries, XP and streak | The daily list, progress and gamification | You, as you use it |
| Memory notes about you (short factual lines) | So Buddy remembers context between conversations. Every one is listed and deletable under You | Written by an AI model from your conversations |
| Chat and voice messages | To answer you. Voice audio is transcribed in real time and not stored by us | You |
| IP address, for the no-account demo only | To enforce the daily limit on free reads and prevent abuse | Your browser |
| A source tag if you arrive from a tagged link (e.g. ?src=reddit) | To know which post or link brought people in. It is a plain word, not a profile | The link you clicked |
| Email delivery and open data | To know whether emails are arriving | Brevo, our email provider |
3. The documents you upload
When you upload a syllabus, timetable or similar PDF, the file is sent to our AI provider to be read, and we keep the structured result: the list of assessments, dates, weights, class times and policies. We do not keep the file itself after the read completes.
If you use the no-account demo at /try, the extracted result is held against a cookie for up to 14 days so that signing up can keep it, then it becomes an ordinary part of your account. If you never sign up, that record is not linked to any person, and you can ask us to delete it by writing to hello@syllabuddy.ca.
4. Who processes your data for us
We use a small number of service providers. They are bound by their own agreements to process data only as instructed and not to use it for their own purposes. Notably, our AI providers state that data submitted through their APIs is not used to train their models.
Several of these are located outside Canada, principally in the United States. This means your information may be stored or processed there and could be accessible to foreign courts, law enforcement or national security authorities under the laws of those countries. Using SyllaBuddy means accepting that.
| Provider | What it does | Where |
|---|---|---|
| Anthropic | Reads your uploaded documents (Claude) | United States |
| OpenAI | Chat replies, weekly briefings, voice transcription and speech | United States |
| Neon | The database holding your account and course data | United States (AWS us-east-1) |
| Vercel | Hosting and delivery of the website | United States, with a global edge network |
| Brevo | Sends the briefing, reminder and password reset emails | European Union |
| Cloudflare | Domain, DNS, and forwarding for our own inbound mail | Global network |
5. Who can see your data
You can, in the app. Nobody else can see your courses, marks, memory or conversations except in the two cases below.
First, if you create a share link for a course, anyone who has that link can see that course's assessments, dates, weights, key dates and class times, along with your first name and school. Share links are not indexed by search engines, but they are not secret either: treat the link like the information behind it. There is no way to un-share a link that has already been sent, other than deleting the course.
Second, the operator of SyllaBuddy can access account records through an administrative page in order to run and support the service, investigate problems, and comply with the law. That access is limited to what the job needs.
We will disclose information if we are legally required to. If we are ever compelled to hand over data about you, we will tell you unless we are prohibited from doing so.
6. Cookies and similar technologies
We do not use advertising cookies, third-party analytics, tracking pixels, or cross-site trackers. There is no Google Analytics, no Meta pixel, and nothing that follows you to other websites.
The cookies we do set are all first-party:
- sb_session — keeps you signed in. Strictly necessary.
- sb_ref — remembers who invited you, so they get credit. Expires in 60 days.
- sb_src and sb_land — remember which tagged link brought you, so we know what worked. A single word, not a profile. Expires in 60 days.
- sb_add and sb_demo — hold a shared course or a demo result so that signing up keeps it. Cleared as soon as they are used.
- Your browser's local storage also remembers small preferences, such as your chosen voice and whether classes are shown on the calendar. That never leaves your device.
7. How long we keep things
Account and course data is kept while your account exists. Delete a course and everything that came from it goes with it. Delete your account and all of it goes, immediately and without a backup we can restore from.
Uploaded files are not retained past the read. Demo results expire after 14 days if never claimed. Email delivery records are kept by our email provider under their own retention schedule. Usage records showing which model calls were made and what they cost are kept for cost accounting.
8. Your rights
Under Canadian privacy law you can ask us to do all of the following, and we will not charge you or make it difficult:
- See what we hold. Under You → Your data, “Download my data” gives you everything as a JSON file, immediately.
- Correct anything wrong. Most of it is editable in the app; write to us for the rest.
- Delete everything. Under You → Your data, “Delete my account” does it in one step and cannot be undone.
- Withdraw consent, including turning off every email. Every email we send carries a one-click unsubscribe, and the settings live under You.
- Ask how your information has been used or disclosed, and to whom.
- Complain. If you are unhappy with how we have handled your information, tell us first at hello@syllabuddy.ca. You can also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy regulator. Quebec residents have additional rights under Law 25, including the right to have data ported to another organisation.
9. Security
Passwords are stored only as salted hashes and never in a form we can read. Traffic runs over HTTPS. Sessions are random tokens in a cookie that is HTTP-only and marked secure in production. Calendar feed links and inbound email addresses are random per user and can be reset by you at any time.
No system is perfectly secure, and this one is built and run by one person. If we ever discover a breach that creates a real risk of significant harm, we will report it to the Privacy Commissioner and tell affected people, as the law requires. If you find a security problem, please write to hello@syllabuddy.ca before disclosing it publicly.
10. Age
SyllaBuddy is built for post-secondary students and is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has created an account, write to us and we will delete it.
11. AI, and what it means here
The reading, the chat, the weekly briefing and the voice all use large language models operated by the providers listed above. Your content is sent to them to produce a result and is returned to you. These models can be wrong, and the app flags dates it worked out from a rule rather than read outright.
No automated decision is made about you that has a legal or similarly significant effect. Nothing here decides your grades, your standing, or anything a school or employer acts on.
12. Changes to this policy
If this policy changes in a way that materially affects you, we will say so in the app and by email before the change takes effect. The date at the top always reflects the current version.