Privacy Policy

When you use UTMAX while signed out, your planning data stays in your browser:

• Saved schedules and course/section picks
• Registration progress (locked and skipped sections)
• Ranking preferences (A-rate, GPA, time-of-day, etc.)
• Theme and UI settings
• Recent course and unique-number searches
• Overlay panel position and size (extension only)

The browser extension uses Chrome storage to sync this data between the main app tab and the floating overlay on UT pages, because embedded iframes cannot share the same browser storage as the top-level site.

IEXDevs may collect de-identified operational and product measurements to understand reliability and usage. These measurements can include:

• Coarse location derived from network information, not precise GPS location
• Approximate connection quality or internet speed
• API request counts and hourly usage, requested features, product version, and sanitized error categories
• High-level schedule patterns and average degree-completion percentage
• Frequently used or requested courses, majors, minors, or certificates

Names, account IDs, raw schedules, Degree Audit records, messages, and other direct identifiers are excluded before this information is used as an aggregate. De-identified results may appear in public reports and restricted internal developer dashboards, designed so an individual user cannot reasonably be identified.

The UTMAX extension:

• Injects a user-controlled floating panel on registrar.utexas.edu and utdirect.utexas.edu pages
• Loads the registration assistant from our server (/embed) inside that panel
• Syncs schedule data through extension storage as described above
• On your request, uses your current UT session to fetch allowed UT Direct course-schedule pages and returns that page data to UTMAX inside your browser

The extension does not:

• Collect or store your browsing history
• Read or modify passwords, Duo prompts, or submitted registration form values
• Log keystrokes, clicks, scroll position, or mouse activity
• Access your UT Austin login credentials

When you use the app, it may contact our servers and service providers to:

• Load the shared UT course catalog (Supabase)
• Check extension version compatibility
• Authenticate an optional account and sync account data
• Publish a calendar feed only when you choose to create one

Ordinary signed-out catalog browsing does not upload your saved schedules. Schedule data leaves the device when you enable signed-in sync, publish a calendar feed, or submit the contact form as described below.

A published calendar feed contains the selected schedule's course and meeting details. Anyone with its unguessable link can read it until you remove the feed, so treat that link as private.

We use a limited set of processors to run UTMAX:

• Cloudflare hosts the site and may process security and request logs.
• Supabase stores catalog, account, authentication, sync, and published-feed data.
• Your selected login provider processes sign-in and returns profile information.
• Google, if you connect Google Calendar, provides read-only access to the calendars you choose.
• Cloudflare Turnstile checks contact submissions for abuse.
• Brevo delivers contact messages by email.
• UT Austin systems receive extension requests for course data you ask to load.

We do not sell or rent your data, use it for targeted advertising, or share schedule data with third parties for marketing.

UTMAX is intended for college students. We do not knowingly collect information from children under 13.

EasyAccess is the unified IEXDevs login system and is currently available only in UTMAX. Signing in is optional. If you sign in, we store an account record and linked-login details reported by your chosen provider, which may include your name, email, username or handle, avatar, profile URL, locale, provider identifier, and provider profile metadata. Wallet sign-in uses your public wallet address.

EasyAccess stores account data when you create an account or log in. In UTMAX, signed-in accounts sync your saved schedules, planning preferences, builder draft, and recent searches through Supabase so that the same library is available across linked logins and devices. Re-fetchable catalog sections are excluded from the synced account blob.

EasyAccess is intended to propagate compatible data across IEXDevs services wherever it supports a related feature. Other products do not receive UTMAX data until EasyAccess is implemented there and the applicable product interface and privacy policy identify the data involved.

A signed, HTTP-only session cookie keeps you signed in for up to 30 days. It is used for authentication, not advertising.

If you choose "Connect Google Calendar," UTMAX asks Google for read-only access to your calendars and events. We never ask for this during ordinary sign-in, and we cannot create, change, or delete anything in your calendar. We request only these three narrow, read-only scopes (least privilege):

• https://www.googleapis.com/auth/calendar.calendarlist.readonly
  Lets you choose from the calendars in your calendar list, including calendars shared with you that appear there.
• https://www.googleapis.com/auth/calendar.events.readonly
  Reads events and their details (titles, start/end times, locations, and descriptions when accessible) only from the calendars you pick.
• https://www.googleapis.com/auth/calendar.calendars.readonly
  Reads calendar properties such as titles, descriptions, default time zones, and other calendar metadata.

How it works in the app: after connecting, you see a calendar picker (checkbox list / dropdown) of your Google calendars. Only the calendars you tick are shown. Their events populate next to your class schedule, clicking an event shows its details, and every event time is converted and displayed in Texas time — America/Chicago (Central Time, daylight-saving aware).

What we store: only your feed choices (calendar ID, display name, color, and which schedules to show on) are saved with your account. Event titles, times, locations, and descriptions are not saved to our servers — they are fetched on demand when you use the app (a rolling window of the past 7 days through the next 180 days), kept only in memory for that session, and re-fetched on your next visit.

How Google user data is protected:

• Encryption in transit and at rest. All Google API calls run server-side over HTTPS (TLS); tokens and calendar URLs are never logged. The stored Google refresh token is encrypted with AES-256-GCM (random 12-byte IV per value, HKDF-SHA256 derived per-purpose key bound to calendar use, keyed from a 32+ character server secret). Rotating that secret simply makes old tokens undecryptable, so you are asked to reconnect.
• Access controls. Auth tables are locked down with Row-Level Security (no public policies — service-role only), with a local SQLite fallback file when configured. Calendar endpoints require a signed-in session, same-origin requests, and per-IP rate limits. The refresh token lives only on your linked Google login row server-side: it is never included in session payloads and never sent to your browser. Short-lived access tokens exist only in server memory (about one hour, refreshed from the encrypted token) and are never persisted.
• Minimal scope and separation. Calendar access is requested only through the explicit "Connect Google Calendar" flow (offline access + consent so Google issues a refresh token); ordinary Google sign-in never asks for it. UTMAX never uses calendar data for advertising, never sells or transfers it to others, and never uses it to train AI models.

UTMAX's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to display the external events you chose next to your schedule.

Legacy note: calendars added long ago via a pasted secret iCal link still load if already saved. Anyone with that link can read that calendar, and UTMAX stores it with your account if you do — remove the feed to delete it.

The extension package contains the overlay shell only. When you open the panel, it loads the UTMAX web application from utmax.tech inside a sandboxed iframe. This lets us ship app updates without republishing the extension for every change. Remote code is served only from utmax.tech domains declared in the extension manifest.

If you choose to use the contact form, we collect your message, optional name, email or social handle, and any error details you enter. The form also attaches diagnostics including a random browser ID, page and referrer, submission time, browser and device details, language, time zone, display sizes, color scheme, connectivity, app version, IP address, and country header when available.

To help reproduce planning issues, the attachment can include saved and planned course counts, active-builder status, authentication state, and schedule names, IDs, course codes, and calendar feed IDs. Review your message before sending; submitting the form is always optional.

Clear device data by removing the extension, clearing site data for utmax.tech, or using the in-app reset controls. You can unlink individual login methods in the account hub and remove any calendar feed you publish.

Google user data — what we keep, how long, and when it is deleted:

• Stored while connected: the encrypted Google refresh token, the granted read-only scopes, and your feed choices (calendar ID, display name, color, schedule scope). Event contents (titles, times, locations, descriptions) are never stored server-side — they are session-only and discarded when the session ends.
• Deleted immediately when you: click "Disconnect Google Calendar" in UTMAX (we revoke the token with Google on a best-effort basis and delete the stored credential at once); unlink your Google login (also deletes the token); remove a Google feed (its saved choice is deleted, with a short undo window on that device only); or have Google reject the token as expired/revoked (we drop the stored credential so you are simply asked to reconnect).
• Revoking outside UTMAX: removing UTMAX under your Google Account third-party access settings stops future access; the next refresh then fails and we delete the stored credential.
• Account deletion: deleting your UTMAX account deletes the stored Google credential and feed choices with it.

How to request deletion: use the in-app Disconnect control for instant removal, or email help@utmax.tech / use the privacy form below to request deletion of server-stored account data (including any Google credential or feed choice) or a contact submission. We retain account and sync data only while the account is active, published schedule feeds until you remove them (180-day expiry), and support messages only as long as needed to address the request and maintain reasonable records.

We may update this policy from time to time. The "Last updated" date at the top will change when we do. Continued use of UTMAX after changes means you accept the updated policy.