Privacy

Schedule and Plan work without an account. Your plans, blocks, four-year plans and settings are saved in your browser, on your device, and nothing about them is sent to us unless you sign in. Loading courses, seats and ratings doesn't tell us who you are.

When you paste your unofficial transcript into Plan, it's read in your browser and never sent to us. Only the courses you import are kept: each one's code (if it has one) and title as the transcript prints it, whether it was a UMD course, AP, an exam or transfer credit, its semester, credits and GenEds, and its grade if you keep grades. Your name, UID, birth date, the schools you transferred from and the rest of the page aren't kept anywhere.

You sign in with your UMD Google account (umd.edu or terpmail.umd.edu). Google gives us your name, your UMD email address and an ID for your Google account, and we keep all three. Your directory ID (the part of your email before the @) identifies your account. We don't collect or show your profile picture: your initials stand in for it. We never get your mail, your files or your password.

Signing in sets a cookie that keeps you signed in, for up to 30 days after you last use Terpsicle. Two more help sign-in itself: one lasts 10 minutes while Google answers, and one remembers which UMD address you used, so Google can suggest it next time. That one lasts 400 days, longer than you stay signed in, and signing out clears it. We set no other cookies, and none for ads or tracking.

If Google says your organization blocked Terpsicle, UMD's Google settings stopped it.

Signed in, what you make syncs to your account, so it's on your other devices: your plans and blocks, four-year plans with any grades you imported, your settings, and the tasks you add in Todo. Nobody else can see them. There's no switch to sync less: to keep something off our server, use Terpsicle signed out.

We store them encrypted, with a key made for your account alone (AES-256-GCM) and kept apart from the data. A copy of our database without that key can't be read, and deleting your account destroys the key.

It isn't end-to-end encryption: our server can open your data. It does so to send it back to you, and for three features: Chat reads your plans and settings to find your class rooms, your calendar feed reads your plans, settings and tasks to list your classes and deadlines, and Due tomorrow reads tomorrow's tasks to name them in its push. We don't open it for anything else, and the code shows it.

Some things aren't encrypted, so features can use them without opening the rest: the sections in your main plan (Chat's rooms come from them), which terms you have plans in and when you saved, your tasks' due dates and courses (but not what they say), and the deadlines from ELMS or a calendar file.

Chat. Class chats show your real name, with your initials, to the other students in the room. Which rooms you're in comes from your main plan. Your messages are stored so the room keeps its history. A term's rooms become read-only 10 days after classes end, and are deleted 60 days after that.

Reviews. Reviews live on PlanetTerp. Schedule shows PlanetTerp's public ratings, reviews and grade data, with credit and a link, from a copy our server updates each night. We don't send PlanetTerp anything about you. The Reviews tab opens planetterp.com, where PlanetTerp's own privacy policy applies.

Share links. A share link carries a copy of your plan inside the link itself. We don't store it, and anyone with the link can see that plan.

Notifications. When you watch a full section, we let you know when a seat opens, by push, email or both. Mentions and replies in Chat, and Todo's Due tomorrow, come by push. The chat digest, a once-a-day list of what you haven't read in Chat, is the only chat email. To send them, we keep your seat watches, your email address, your browser's push subscription, your notification settings and what's in the bell. Push messages pass through your browser maker's push service. Settings lets you turn each one on or off.

Todo. To show your deadlines, we keep your ELMS calendar link on our server and check it about every 20 minutes while you use Todo, and less often when you don't. It's encrypted with one server key that every ELMS link shares, not your account's own key. We store the assignments and events it lists (titles, courses and due dates), which ones you've marked done, and any courses you hide. We don't get your grades, submissions or ELMS password, and we never sign in to ELMS or Gradescope for you. Disconnect any time and we delete the link and everything from it at once. If you add a calendar file instead, it's read in your browser, and only the deadlines in it are sent to us. Tasks you add yourself never go to ELMS.

Your calendar feed. If you subscribe to it, your calendar app fetches your classes and Todo deadlines from a private link, without signing in. Anyone with the link can see those dates, so keep it to yourself. We don't store the link itself, only what lets us show it to you again, a one-way hash to recognize it, and when a calendar last fetched it. "Make a new link" in Settings stops the old one at once.

To keep Chat free of threats, hate and spam, an automated model (Meta's Llama models, run by Cloudflare) checks each message. If it isn't sure, it holds the message for our moderator, who reads it without seeing who wrote it. Reports go to the moderator too, and nobody sees who sent them. To catch one message posted across many courses, we keep a fingerprint of each message (which can't be turned back into its words) with its course and time, for an hour.

To sort similar feedback together, we send its words (never the screenshot or what you were doing) to a model run by Cloudflare.

These models run on Cloudflare, where Terpsicle runs, not at an AI company. Cloudflare says it doesn't train models on what we send, and we don't either.

We use PostHog to count which parts of the app people use. It's anonymous: it isn't linked to your name or account, and PostHog never receives your IP address. It sets no cookies, but it keeps a random ID in your browser's local storage, so it can tell one visitor from another without knowing who they are. It sees actions like opening a tab or adding a course, never what you type, and never what you write in chats. A share link's plan never reaches it: PostHog only learns that a shared plan was opened. We don't record sessions, so nobody can play back what you did on a page.

"Send feedback" sends us what you write. Two boxes, on unless you turn them off, add more:

• Include what I was doing adds the app's version, your browser, screen size, theme and whether you were online, the page you were on, your open plan and settings, and the last 50 or so things you did in Terpsicle: pages you opened, buttons you used, errors the app hit and requests that failed. That list stays in the page's memory and is sent only with your feedback.
• Include a screenshot adds a picture of the page. Names, pictures, messages, reviews and your block labels are blacked out before the picture exists, and you can black out or crop more before sending.

Feedback never includes your ELMS calendar link, sign-in or notification tokens, a share link's plan, other people's messages, or grades you pasted into Plan. It isn't linked to your account unless you're signed in and turn on "You can reply by email"; then we keep who sent it so we can email you once when it's fixed. Right after sending, Undo takes it back completely.

Only these services, and only to run Terpsicle for you. We never sell your data.

• Cloudflare: hosts Terpsicle: its servers, database and storage, the AI models above, and the emails we send. Like any host, it sees your IP address when you visit. Our own code never keeps it: to limit abuse, we count requests with a one-way hash of it.
• Google: signs you in, and tells us your name, your UMD email address and an ID for your Google account.
• PostHog: counts anonymous use of the app, as above.
• Push services: your browser maker's (for example, Apple's, Google's, Mozilla's or Microsoft's) deliver push notifications, encrypted for your device.
• ELMS: if you connect it, our server fetches your calendar from ELMS (umd.instructure.com) with your link, to read your deadlines.
• PlanetTerp: our server reads its public data each night. It gets nothing about you.

Cloudflare's backups let us put the database back as it was at any moment of the last 30 days, so something you delete can live on in them that long. Chat's messages have the same 30 days.

Under Your data in Settings, you can download your data as one file: your plans, four-year plans with their grades, and settings, and, signed in, your profile, the tasks you added in Todo and the courses you hid there, your seat watches, notification settings, your class chats and the messages you wrote in them, and any reviews you wrote in Terpsicle. Deadlines from ELMS aren't in it, since Todo gets them from ELMS again.

You can delete your account there too. Deleting signs you out everywhere, then waits 7 days in case you change your mind: signing in keeps the account. After that, we delete your profile, your synced plans, four-year plans and settings, your Todo tasks and ELMS link with its deadlines, your seat watches, your notifications, their settings and the record of what we sent you, your chat messages and your calendar feed link. Your calendar feed stops working right away. Plans saved in your browser stay until you remove them.

All of that leaves our live database at once, and your account's key is deleted. Backups take longer: Cloudflare can put our database and Chat's messages back as they were at any moment of the last 30 days, so a copy of everything, encrypted or not, stays in those backups until it rolls off, within 30 days. That includes your ELMS link. Feedback you sent stays, with no name on it.

Terpsicle is open source, so you don't have to take this page's word for it: everything it describes is in Terpsicle's code on GitHub. When what we keep changes, this page changes with it, and so does the date at the top. The terms of use cover the rest.

Questions about your data, or a request to delete it: