Privacy Policy

Effective Date: September 13, 2026

This Privacy Policy explains how MyClassGrades collects, uses, shares, retains, and protects information when you use our course search, grade-distribution, live-course monitoring, alert, review, study-tip, degree-progress, major roadmap, registration-day planning, grade-comparison, transcript-import, account, and Live Plus features.

1. Information We Collect

We collect information from you, from your device, from sign-in providers, from payment and email providers, and from course-data sources that support the service.

A. Account, Identity, and Eligibility Data

Account details: user ID, email address, selected username or pseudonym, school affiliation, profile details you choose to provide, and account settings.
Sign-in provider data: if you sign in with Google, Microsoft, or another supported provider through Supabase Auth, we receive provider identifiers, email address, verification status, and any profile fields you authorize. We do not receive your Google or Microsoft password. See section 13 for our Google user data disclosure.
Eligibility data: school, university-affiliated email status, and related information used to decide whether you can use community or school-specific features.

B. Course, Alert, Billing, and Community Data

Course activity: searches, filters, viewed courses, compared sections, saved plans, shortlist items, school selections, and similar product activity.
Degree-progress data: majors or programs you select, courses you mark as completed or planned, your starting term, requirement selections and overrides you make, grades you record for your own courses, and related progress calculations.
Grade comparisons: to show a grade comparison on your roadmap, we calculate figures such as your GPA, the average of the classes you took, and the difference between them, using the grades on your account together with the aggregate historical grade distributions we already publish for those classes. These figures are derived for your own view of your own account. We do not show them to other users and do not attach them to your reviews, ratings, or study tips.
Registration-day plans: where a registration-day plan is available for your school, we store the plan generated for you and the choices you make on it: the term and program it was built for, the sections it selected, sections you pinned, removed, or restored, backup selections, which sections you chose to watch, and the seat observations, freshness timestamps, and delivery records used to keep the plan current and to email you when a watched section fills or a backup opens.
Contribution and reward records: counts of the reviews and study tips you have submitted, the reputation tier those counts produce, reward eligibility and claim records, and the anti-abuse records we keep so the same contributions or the same school email cannot be used to claim more than one reward. These records include a protected hash of the school email used to claim a reward so we can recognize repeat claims.
Transcript import: if you choose to import a transcript, we accept PDF files only. We process the PDF transiently on the MyClassGrades backend using server-side extraction and OCR; this is not on-device processing. AI-assisted recognition is an optional, user-controlled feature that is off by default as an account preference, so your first parse is Local-only; if a course cannot be read confidently, the review step offers to retry it with AI-assisted recognition, and you can choose to keep that preference on for later imports. The account preference initializes the interface, but the backend still requires explicit permission in each parse request before using external AI. PDF bytes and the browser-created base64 representation are held transiently in browser runtime memory for the active dialog, request, or rerun. In-memory references are cleared when the dialog closes, the import is reset, or the dialog is removed from the page. An in-flight network and backend request may retain the PDF bytes until that request finishes even if the dialog closes. After the request finishes and is no longer active in the dialog, its request-specific data is eligible for immediate cleanup. Full extracted and OCR text exists only during transient backend request processing and is not returned to the browser. The PDF, base64 representation, and raw transcript text are not written to persistent browser storage, including local storage; account or authentication metadata; analytics or logs. There is no persistent retention of the PDF or raw transcript text. What we retain is confirmed and imported account data: courses, grades, terms, your starting term, and import records such as a batch identifier, a content fingerprint, and counts used to prevent duplicate imports.
Live-course monitoring: tracked schools, terms, sections, alert subscriptions, subscription status, delivery status, delivery attempts, unsubscribe or untrack actions, and related troubleshooting metadata.
Community content: reviews, ratings, study tips, reports, moderation notes, feedback, support requests, and timestamps.
Billing data: Live Plus plan selections, checkout status, Stripe customer or subscription identifiers, transaction metadata, refund or chargeback metadata, and billing support communications. Stripe handles payment-card processing.
Technical data: IP address, device and browser information, operating system, pages viewed, referring pages, request IDs, cookies, local storage, logs, diagnostics, and security or abuse-prevention signals.

2. How We Use Information

Provide, maintain, secure, and improve MyClassGrades.
Create accounts, authenticate users, verify school eligibility, and prevent account abuse.
Show course information, grade distributions, instructor information, reviews, study tips, saved plans, degree-progress estimates, and live-course data.
Extract course records from transcripts you voluntarily submit, prefill your degree progress after you confirm the results, and prevent duplicate imports.
Track sections you choose to monitor and send operational alerts when tracked availability appears to change.
Generate a suggested registration-day plan, keep it current as seats and your recorded progress change, and email you about the sections you chose to watch.
Calculate grade comparisons between the grades on your account and aggregate historical class distributions, and show them to you.
Count qualifying contributions, determine reward eligibility, grant rewards you claim, investigate attempts to obtain rewards through spam, duplicated, automated, or fabricated content or through multiple accounts, and withhold or revoke rewards and reverse related credit where warranted under our Terms.
Operate Live Plus, including checkout, subscriptions, plan changes, billing support, fraud prevention, refunds, and chargebacks.
Moderate reviews and study tips, investigate reports, enforce our Terms, including investigating accounts used to bypass limits or evade a restriction or termination, and protect users and the service.
Measure usage, debug issues, improve performance, develop features, and understand product health.
Send account, security, billing, support, service, and permitted marketing communications. You can opt out of promotional emails, but operational messages may still be sent when needed.
Comply with law, respond to lawful requests, resolve disputes, and enforce agreements.

3. Public Content and Pseudonymity

Reviews, ratings, study tips, and similar submissions may be visible to other users or the public. By default, MyClassGrades displays community submissions without your real name and uses your chosen username or other non-real-name display treatment.

Public pseudonymity is not the same as total anonymity. We may retain internal account identifiers, email records, IP or device signals, moderation records, and other metadata so we can operate the service, prevent abuse, investigate violations, comply with law, and protect users.

4. Live Courses and Alerts

MyClassGrades supports live-course features for the schools identified within the product as supporting live courses. The set of supported schools may change over time as we add, pause, or remove coverage.

If you track a course or section, we process the school, term, section, course identifiers, alert settings, delivery history, and related logs needed to provide the feature. Alerts are informational. Seat availability can change quickly, and official school systems control registration, waitlists, prerequisites, overrides, and enrollment outcomes.

5. Cookies and Analytics

We use cookies, local storage, pixels, scripts, and similar technologies for login, authentication, security, fraud prevention, preferences, billing flows, analytics, diagnostics, and product improvement. Some parts of the service may not work if you block required cookies or storage.

We use PostHog to understand how users use MyClassGrades, measure retention and feature usage, identify errors, and improve the service. This includes session replay, which records interactions such as clicks, navigation, and page content to help us diagnose issues and improve usability. We do not use analytics data to sell personal information to data brokers.

We mask your academic data from session replay. The elements that display your grades, your GPA and grade comparisons, your transcript-import results, and the contents of your roadmap and registration-day plan are marked so their values are excluded from the recording. Masking covers the recorded contents of those elements; it does not hide that you visited a page or interacted with something on it, and it does not apply to analytics we collect outside session replay.

Before you make a choice, we measure basic usage in a cookieless way: we record which pages and features are used, without storing cookies or other identifiers on your device. To count visits, PostHog derives a temporary identifier from your IP address and browser information using a secret that is rotated daily, so it cannot be used to recognize you across days or link your activity to you. Session replay and identified analytics are not used in this mode.

If you decline, or if your browser sends a Global Privacy Control signal, we stop this too: we then collect no analytics at all. If you accept, we enable full analytics including session replay and cookies.

You can change your choice at any time: .

We do not sell personal information for money. We share information when needed to operate the service, comply with law, enforce rules, or complete a transaction you request.

Service providers: Supabase for authentication, database, and related backend services; PostHog for analytics; Stripe for Live Plus billing; Cloudflare and AWS for hosting, delivery, infrastructure, and security; and Resend for email delivery.
AI recognition provider: when AI-assisted recognition is enabled and local parsing is uncertain, only ambiguous, sanitized academic and layout fragments may be sent to the paid Google Gemini service to associate unclear fragments with course records. Gemini does not perform transcript extraction or OCR. These fragments may include course codes, grades, credits, and terms. This does not include the original PDF bytes or images; your name, student ID, other identity or account data; course titles, arbitrary prose, or programs. Under the current paid Gemini API terms , paid-service inputs are not used to train Google's models or improve Google's products. Google's current abuse-monitoring policy permits prompts and responses to be retained for abuse monitoring for up to 55 days, and authorized Google personnel may review flagged content for that enforcement purpose. When parsing returns a reviewable result after sanitized fragments were sent to Gemini, the review interface's “What was shared” panel shows the exact sent fragments and model roles, including when Gemini returns no usable associations. If parsing fails before a review result is available, the interface shows an error and the inspection panel is not available for that failed attempt. You can choose Local-only parsing instead.
Public or other users: content you submit for publication, such as reviews, ratings, study tips, and display names.
Schools and institutional sources: where necessary to link to official resources or process public or authorized course data. We do not represent that we are acting for a school unless a separate written agreement says so.
Legal and safety reasons: courts, regulators, law enforcement, or other parties when required by law or when we believe disclosure is needed to protect rights, safety, users, or the service.
Business transfers: if MyClassGrades is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.
With consent: when you direct us to share information or otherwise give consent.

7. Educational Data

MyClassGrades is an independent service. We are not a registrar, student-information system, official academic advisor, or official registration system for any supported school unless a separate written agreement says otherwise.

We intend grade distributions, course statistics, catalog details, section data, and related academic information shown in MyClassGrades to come from public, aggregate, de-identified, licensed, authorized, or otherwise lawful sources. If you believe displayed information is incorrect or should not be published, contact us.

8. Data Retention

We keep information for as long as reasonably needed to provide MyClassGrades, maintain security, process billing, support moderation, comply with law, resolve disputes, and enforce agreements. Current target retention rules are:

Account and identity records: while your account is active and for up to 24 months after deletion unless a longer period is needed for legal, security, billing, or abuse-prevention reasons.
Live alert subscriptions and delivery logs: while active and for up to 180 days after deactivation or delivery, unless needed longer for troubleshooting, abuse prevention, billing, or legal reasons.
Community content: until removed by you or by MyClassGrades, with limited internal records retained where needed for moderation, safety, legal compliance, or dispute handling.
Transcript imports: we do not persistently retain PDFs or raw transcript text. PDF bytes and their base64 representation remain only in transient browser runtime and in-flight request memory for the active import, and full extracted and OCR text remains only in transient backend request processing. An in-flight request may finish after the dialog closes; its request-specific data becomes eligible for immediate cleanup after the request finishes and is no longer active. Confirmed and imported account data—including courses, grades, terms, your starting term, and import records (batch identifier, content fingerprint, and counts)—is retained as part of your account data until you remove it or delete your account.
Registration-day plans: while the plan is active for its term and afterward for as long as needed for troubleshooting, abuse prevention, and legal reasons. A plan's watches are alert subscriptions, so the seat observations and delivery records tied to them follow the live-alert retention above.
Contribution and reward records: reputation counts, reward eligibility, and claim records, including the protected school-email hash described above, are kept while a reward can be claimed or remains in effect, and afterward as needed to prevent repeat or fraudulent claims and to support billing and dispute handling.
Server, security, and diagnostic logs: typically 30 to 180 days, unless longer retention is needed for security investigations or legal compliance.
Billing and transaction records: for as long as needed for accounting, tax, fraud prevention, chargeback handling, and legal compliance.
Support requests: typically up to 24 months after closure.
Analytics and cookie records: according to our PostHog and cookie settings, or longer if converted into aggregate or de-identified product metrics.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, delete, correct, receive a copy of, restrict, object to, or opt out of certain processing of personal information. You may also have the right to appeal a denied request.

Access and portability: request a copy of certain information we hold about you.
Correction: request correction of inaccurate information.
Deletion: request deletion of certain account, alert, profile, review, or study-tip information, subject to legal, security, billing, moderation, and operational limits.
Opt out: opt out of promotional emails and certain analytics or advertising-related processing where applicable.

To submit a request, email us at [email protected]. We may need to verify your identity before completing a request.

10. Children

MyClassGrades is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we collected personal information from a child under 13 in a way that requires parental consent, we will delete it or take other legally required steps.

11. Security

We use administrative, technical, and organizational safeguards designed to protect information based on its nature and risk. No system is perfectly secure, and we cannot guarantee absolute security.

12. Contact

MyClassGrades
Email: [email protected]
Mailing address: 200 W Cliff Dr Unit 23

13. Google User Data (Google API Services)

This section discloses how MyClassGrades accesses, uses, shares, protects, retains, and deletes Google user data obtained through Google sign-in via Supabase Auth.

Scopes requested: openid, email, and profile — authentication only.
Data received: name, email address, profile photo URL, Google account ID (sub), and email verification status.
We do not access Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google services, and we do not receive your Google password.
Use: account creation and sign-in, school-eligibility verification, and security/abuse prevention only.
Sharing: Supabase processes authentication data on our behalf; we do not sell Google user data and do not share it for advertising or marketing.
Protection: encrypted in transit (TLS), access controls, academic-data masking from session replay.
Retention/deletion: kept while your account is active and up to 24 months after deletion (see section 8); request access/deletion at [email protected]; revoking access in your Google Account settings stops future data sharing.
Limited use: we use Google user data only to provide and improve authentication features, never for ads, sale, unrelated purposes, or AI model training.

My Class Grades home · Terms of Service · Help & Support