Privacy Policy

1. Who we are

Class Forge ("we", "us", "the Service") is operated as an independent project based in Pennsylvania. You can reach us at classforge.app@gmail.com.

Note: Upon formal entity formation (planned: Class Forge LLC, a Pennsylvania limited liability company), this section will be updated with the registered business name and state of formation. For now, this Service is operated by an individual sole proprietor.

2. The short version

• We collect the minimum data needed to make the app work: your email (for sign-in), your course catalog, and your saved schedules.
• We do not sell your data. Ever.
• We use Supabase to store your data and Google Gemini to power the AI Advisor. Both are described in detail below.
• You can delete your data at any time by emailing us.
• We don't currently show ads. If that changes, this policy will be updated and you'll see a notice in the app.

3. What we collect

3.1 Account information

When you sign up, we collect:

• Your email address (required, used for sign-in and account recovery)
• If you sign in with Google: your Google ID and the name on your Google account
• A hashed password (only if you sign up with email/password instead of Google)

3.2 Schedule data

When you use the app, we store:

• The course catalog you upload
• Your degree requirements and tracker
• Your completed courses, grades, and forecasted future courses
• Your saved schedules
• Your app preferences (theme, settings)

This data is stored in our Supabase database under your user account and is only accessible to you when you sign in. Other users cannot see your data.

3.3 AI Advisor conversations

When you use the AI Advisor, your messages are sent to Google's Gemini API to generate a response. The conversation is held in your browser and clears when you refresh the page - we do not store chat history on our servers.

Important: Class Forge currently uses Google's Gemini free tier. Per Google's terms, prompts and responses on the free tier may be used by Google to improve their AI models. Do not paste sensitive personal information (student ID numbers, full legal names, social security numbers, medical or financial details) into the AI Advisor.

If we move to Google's paid tier in the future, that data-use clause goes away. We will update this policy if and when that change happens.

3.4 Reviews you submit

If you submit a review on the Feedback tab, the text of your review and the display name you choose are stored and made publicly visible to other Class Forge users. We do not display your email address.

3.5 Contact form submissions

If you use the contact form, we store the name, email, topic, and message you submitted in our database so we can read and reply.

3.6 Technical data

Our hosting provider (Vercel) automatically logs basic technical information about each request: IP address, browser type, page accessed, and timestamp. These logs are retained for a short period (typically 30 days) for debugging and security purposes. We do not maintain analytics or behavioral tracking beyond this.

4. How we use your data

• To run the app. We use your data to display your schedules, calculate your GPA, generate forecasts, and remember your settings.
• To respond to you. If you contact us, we use your email to reply.
• To debug and improve. Server logs help us find bugs.
• For legal compliance. If required by law, we may need to retain or disclose data.

We do not use your data to:

• Sell to third parties
• Share with advertisers
• Build advertising profiles
• Train our own AI models (we don't have any)

5. Third-party services we use

5.1 Supabase (database and authentication)

Supabase Inc. hosts our database and handles authentication. They are bound by their own privacy policy: supabase.com/privacy.

5.2 Google (Gemini API and OAuth sign-in)

Google LLC provides the AI Advisor's underlying language model and (optionally) Google Sign-In. See Google's privacy policy: policies.google.com/privacy.

5.3 Vercel (web hosting)

Vercel Inc. hosts the website. See Vercel's privacy policy: vercel.com/legal/privacy-policy.

5.4 Stripe (payment processing - when paywall launches)

When the paid AI Advisor launches, Stripe Inc. will process payments. We never see your full credit card number - Stripe handles all of it. See Stripe's privacy policy: stripe.com/privacy.

6. Cookies and tracking

Class Forge uses a small number of cookies that are strictly necessary to keep you signed in. We do not use analytics, advertising, or social-media tracking cookies.

If we add advertising in the future, this section will be updated to disclose any third-party ad networks (e.g., Google AdSense) and the cookies they use. We will also add a cookie consent banner at that time.

7. Your rights

You have the right to:

• Access your data. Email us and we'll send you a copy of everything stored under your account.
• Correct your data. Most data is editable directly in the app. For anything else, email us.
• Delete your data. Email us with subject "Delete my account" and we'll delete your account and all associated data within 30 days.
• Export your data. Same process - email us and we'll send a JSON export.
• Opt out of AI Advisor data sharing. The Advisor tab has a toggle labeled "Share my data with the AI". Turning it off prevents your schedule data from being included in API calls to Google.

California residents have additional rights under the CCPA (right to know, right to delete, right to opt out of sale - though we don't sell data). Email us to exercise these rights.

EU/UK residents have rights under GDPR (data portability, right to erasure, right to object, etc.). Email us. Note that the AI Advisor free tier is regionally restricted by Google and may not be available in the EU/UK.

8. Children's privacy

Class Forge is intended for college students, who are typically 18 or older. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with information, contact us and we will delete it.

If you are between 13 and 17 and using Class Forge (e.g., as a dual-enrollment high school student), please use the app with a parent or guardian's awareness.

9. FERPA

The Family Educational Rights and Privacy Act (FERPA) protects student educational records held by educational institutions that receive U.S. federal funding. Class Forge is not an educational institution and is not directly subject to FERPA.

However, the data you upload (your degree audit, transcript, course catalog) may contain information that originated in a FERPA-protected context. By uploading this data, you confirm that you have the right to do so. We treat your data as confidential and only use it as described in this policy.

If Class Forge ever enters into a contract with a college or university to receive student data directly, we will sign a FERPA-compliant Data Sharing Agreement and update this policy accordingly.

10. Data retention

• Account data is retained as long as your account is active.
• Reviews remain visible until you delete them or close your account.
• Contact form submissions are retained for up to 2 years for support history, then deleted.
• Server logs are retained for ~30 days.
• AI Advisor chats are not retained on our servers at all (see Section 3.3).

11. Security

We use industry-standard security measures: encrypted connections (HTTPS), encrypted storage at rest, password hashing, and database row-level security policies that prevent users from accessing each other's data.

That said, no system is perfectly secure. If a breach occurs that affects your data, we will notify you via the email address on your account within 72 hours of becoming aware of it.

12. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top and, for significant changes, post a notice in the app. Continued use after a change constitutes acceptance of the updated policy.

13. Contact for privacy questions

Email classforge.app@gmail.com with subject "Privacy Request" for any of the rights listed above, or any questions about this policy.