Privacy Policy

• Your name, email, and profile image from Google OAuth sign-in.
• The scheduling preferences you save on your profile page.
• Your completed and in-progress courses, taken from your own degree audit, including grades, GPA, and unit counts. We store this only once you choose to sync a confirmed audit to your account.
• Your course list and grades - not your GPA - each time we work out what you still need, whether or not you are signed in. SDSU only counts a course you passed with a C- or better, so the grade decides the answer. We also send the name of each requirement line in your audit and whether it says that line is complete, so a requirement your own audit has finished is not listed as still needed. We compute the answer and keep nothing: it is not written to our database and not sent to any subprocessor below.
• Which pages you open, and a short list of named actions - see PostHog under Subprocessors for exactly what that does and does not include.
• A testimonial, if you choose to write one. It is optional, it is stored with your account, it is shown on this site only with the consent you gave when you wrote it, and it is deleted when your account is.
• Whether we have asked you for one, and whether you said no. We keep those two dates so the question is asked once and never again, on any device. It is deleted when your account is.
• Questions you type into the ask box, and the answers we gave, so we can show them to you again when you come back to the page. They are deleted with your account, and their wording is cleared after 90 days regardless.
• Anonymous feedback and no-result searches, stored to improve the site. When you tap Yes or No under "Did this help?", we save that answer, the page it was on, and the note if you type one. When a search finds nothing, we save the words in the search box and the filters that were on. No account information is attached to any of it: no name, email, account ID, session ID or IP address. We remove anything that looks like an email address, a RedID or a phone number before saving. If your browser sends "Do Not Track", we do not save your no-result searches. We delete all of it after 180 days. Because nothing ties it to you, we cannot look up or delete one person's entries on request.

We do not collect your SDSU credentials, and we do no authenticated scraping of any kind. Reading your Degree Evaluation happens in your browser, not on our server: by default, we never send the raw uploaded PDF or pasted audit text to our server, and we never store it there. Only the structured, student-reviewed record is synced, and only when you choose to sync it.

The one exception is a choice you make yourself: on the confirm screen, an unticked box lets you ask us to also keep a copy of the raw text you pasted or uploaded, so that when we improve how we read evaluations we can read your saved copy again without asking you to paste it again. We then show you what changed and ask before we change your record. That copy is never shown anywhere - not on any page, not in an API response, and never sent to Anthropic - and you can delete it at any time from the /audit page. If you do not check the box, nothing changes from the paragraph above. Nobody who confirmed their record before this choice existed has a copy stored; checking the box is always something you do, never a default we chose for you.

CourseGrid is not a school official and does not act on SDSU's behalf. FERPA does not cover a student's own decision to share their own academic record with a third-party tool of their choosing.

• Google - authentication.
• Stripe - payment processing.
• Vercel - application hosting.
• Neon - database hosting.
• PostHog - product analytics. This tracks which pages you open, and a short list of named actions such as exporting a schedule, a search that returns nothing, or a Yes or No under "Did this help?" (the page and the answer only, never a note). If you are signed in, these are linked to your account's internal ID - never your name or email. We do not send your search terms or filters. We do not store your IP address. Screen recording is turned off in our code, so nothing on your audit page is ever captured. If your browser sends "Do Not Track", we send nothing at all.
• Anthropic - the AI recommendation layer, which only runs if you have paid for it. Here is what reaches Anthropic: your catalog year, program name, the requirement categories you still need with their unit counts, a summary of the classes on offer, and four preferences (what time of day you want, which days you can be on campus, whether you want in-person or online classes, and when you want to graduate). For one of the two model calls only, we also include a shortened and cleaned-up excerpt of your work-schedule and free-text notes. We never send your grades or your GPA to Anthropic. If you use the ask box, the question you type is sent to Anthropic too, exactly as you wrote it, along with the same facts about your degree and this term that we use to answer it. Do not type anything into it you would not want leaving our servers. Anthropic deletes API inputs and outputs within 30 days of receiving or generating them, and does not use them to train its models without express permission. That is Anthropic's published commercial policy, which is separate from the terms that cover its consumer chat products.

Deleting your account from /account is a soft delete: your session ends immediately, and your record can be recovered for 7 days by signing back in with the same Google account. After 7 days, a purge job permanently deletes your profile, courses, saved plans, and AI run history. We keep your purchase record in a de-identified form (a one-way hash of your email) for tax and support purposes only, and your account is no longer linked to it.

Separately from deleting your account, we clear the wording of your ask-box questions 90 days after you ask them. The answer stays, and so does what the question cost us to answer - that is our billing record. The words you typed are removed. This happens on its own, whether or not you ever delete your account.

If you chose to keep a copy of your pasted or uploaded Degree Evaluation text (see "What we do not collect" above), it is not on a 90-day timer the way ask-box questions are. The reason to keep it is so a parser fix arbitrarily far in the future can still correct your record, so there is no clock that would quietly take that away from you. Instead, you control it directly: delete it yourself at any time from the /audit page, or it is removed along with everything else when your account is purged.

When we read that saved copy again and the result differs from your record, we keep the new reading - your courses, grades and requirement names, not the text itself - until you choose to use it or to keep your current record. If you do nothing, we delete that new reading after 90 days, and may make a fresh one from your saved copy. Choosing to keep your current record changes nothing on your record. Deleting your saved copy, confirming a new evaluation, or deleting your account also deletes any new reading waiting for you.

Class and section data comes from SDSU's public Class Search and may be outdated or incorrect. CourseGrid never performs an enrollment, waitlist, or any other authenticated action on your behalf.

Do not paste sensitive personal information into the notes fields on your profile page, including accommodation or medical details. Keep your notes to scheduling context.

Everything we hold about you is visible and editable in the app while you are signed in. Your scheduling preferences, and every course on your record with its grade and units, are on /profile - you can correct, add, or remove any individual course there. Your saved plans are on /plans. Account deletion is on /account.

If you would rather we do it for you, or you want a copy of your record, email support@coursegrid.io from the @sdsu.edu address on the account. We answer within 30 days.

We post any change to this page and update the "Last updated" date above. If we make a material change to what we collect, or to who we send it to, we announce it in the app before it takes effect. We do not apply a change retroactively to data already collected under an earlier version.

CourseGrid is operated by an independent student developer in San Diego, California. For a privacy question, a data request, or anything on this page, email support@coursegrid.io.