Privacy Policy

1. Information we collect

• Account data. Your email address and password when you create an account (passwords are handled by our authentication provider and never stored in plain text), and anything you add to your profile, such as your name, major and class standing.
• Plans and schedules. The degree plans and class schedules you build: courses, semesters, credits, grades you enter or import, the programs you select and any notes. If you aren’t signed in, this stays in your browser only; when you sign in, it moves to your account.
• Unofficial transcripts. If you import a transcript, our server reads the PDF to pull out your courses, grades, credits and declared programs, and sends the result back to your plan. We do not keep the file.
• Messages you send us. When you use the Support form or report a missing or wrong requirement, we store what you write, the page you were on, and either your account email or, if you’re signed out, the reply email you choose to give.
• Error reports. When something breaks, technical details of the error (the page, your browser, the error message) are sent to our error-monitoring service. It is set up not to collect your IP address, cookies or what you typed.
• Cookies and browser storage. We use cookies to keep you signed in, and your browser’s local storage for unsaved drafts, guest plans and schedules, and your theme. We don’t use advertising or third-party analytics trackers.

2. How we use it

• To sign you in and keep your account secure.
• To save your plans and schedules and show your degree progress.
• To publish a read-only link to a plan or schedule when you choose to share one.
• To answer support messages and fix the requirement data you report.
• To find and fix bugs.
• To understand usage in aggregate — for example, how many students are planning a given major. Our internal dashboard shows counts only, never an individual’s plan.

3. Who else handles your information

We do not sell, trade or rent your personal information. We use these service providers to run TerrapinTunnel, and they process data only to provide their service to us:

• Supabase — our database and sign-in provider. Your account, plans, schedules and messages are stored there.
• Vercel — hosts the website and runs our server code, including transcript import.
• Sentry — receives the error reports described above.
• Discord or Slack — Support messages and requirement reports are posted to a private team channel so we see them quickly, including your message and your email address.
• Our email provider — sends sign-up confirmation and password-reset emails.

Members of the TerrapinTunnel team can read Support messages in order to answer them. If you share a plan or schedule, anyone with the link can see its name and courses until you stop sharing it. We may disclose information if the law requires it.

4. Data security

Your data is protected by access rules in the database so that only you can read your account’s plans and schedules, and all traffic is encrypted in transit. No method of transmission or storage is completely secure, so we can’t guarantee absolute security.

5. Keeping and deleting your data

We keep your data while your account exists. You can delete your account at any time from Profile → Security → Delete account. Deletion is immediate and permanent: your profile, plans, schedules, share links, and any Support messages or requirement reports you sent while signed in are removed, and shared links stop working.

Messages sent while signed out aren’t tied to an account; to have one removed, ask us through the Support form. Anything kept only in your browser is removed when you clear your browser’s site data.

6. Changes to this policy

When we change this policy, we’ll update the date at the top of this page.

7. Contact us

Questions about this policy or your data? Use the Support link at the bottom of any page. TerrapinTunnel is an independent project and is not affiliated with the University of Maryland.