Semestio

Privacy Policy

Semestio is a student academic hub. This page explains the information used to provide your account, organise your academic work and run features you choose to use.

Information you provide

• Account information: your name, email address, password hash, email-verification status, programme name, setup progress and preferences. Account records also include an identifier, creation and update times, and an administrator flag.
• Academic information: semesters, academic years, modules, deadlines, exams, assessment weightings and recorded grades; notes, exam details, checklist items and resource links; dates, progress and reminder settings.
• Groups and shared content: group names, ownership, membership and roles, invitation tokens, joining times and shared deadline details. Content you share through a group is available within that group, so consider what you include.
• Feedback: your account identifier, submission type, title, description, submission time and review status. Bug reports also include the page or area you enter, the submission page, your browser user-agent information and available viewport dimensions. These details help investigate problems.

Timetable information

When you connect a timetable feed, Semestio stores its URL in encrypted form and fetches it from the server to import and update your timetable. A private feed URL may provide access to your calendar, so treat it as private.

Stored timetable information includes event titles, descriptions, locations, dates and times, event status and identifiers used to match recurring or updated events. We also store manually entered timetable events, sync status and times, safe error messages, and detected timetable changes with expiry times. Feed URL encryption does not mean that all account or timetable data is end-to-end encrypted.

Authentication and security records

Semestio stores a hash of your password for password-based sign-in. Authentication uses JWT sessions containing account information and a session version used to check whether a session remains valid.

Email verification and password resets use hashed, expiring tokens linked to your account. Security rate-limit records use hashed identifiers derived from information such as your email, account identifier or reset request. Password-reset rate limiting also uses a hashed value derived from the client IP address supplied by Cloudflare.

How information is used

Semestio uses this information to provide and secure your account, display and organise your academic records, calculate grade summaries from your entries, sync timetables, support group sharing, deliver configured reminders and review feedback or bug reports.

Account emails and service providers

• Resend sends email-verification messages, requested verification resends, verification after an email change, and password-reset messages. It receives the recipient email address and email content, including the relevant verification or reset link.
• Browser Web Push services deliver notifications when you enable them. Semestio stores your subscription endpoint, delivery keys and account association, along with delivery records used to avoid duplicate reminders. Notifications can contain academic titles, times, class locations and links into Semestio.
• Your timetable feed provider receives server requests to the feed URL you configure so that Semestio can retrieve timetable information.
• Cloudflare Tunnel carries traffic to Semestio in the current production architecture. Application data is stored in PostgreSQL.

Browser storage and analytics

Semestio uses authentication cookies for sessions, browser session storage to carry verification and password-reset tokens through those flows, and local storage to remember dismissal of the installation prompt. The service worker handles push notifications and opening their destination.

Semestio currently has no application analytics or tracking SDK integrated. Functional storage and bug-report diagnostics are still used as described above. This does not mean that infrastructure or service providers keep no operational records.

Your choices and controls

You can update your name, change your email with verification, change your password, and edit your academic information using the available account and academic controls. You can manage your timetable connection and push settings, including optional class and timetable-change notifications. You can also manage notification permission in your browser or device settings.

Account deletion and data export controls are not currently available. You can contact Semestio about privacy and data requests using the contact route below; submitting a request does not automatically delete or export data.

Contact

You can contact Semestio about privacy, data requests or support through the feedback form when signed in with a verified account. Please do not include passwords or private timetable feed links. A public contact address for people who cannot access an account is still to be confirmed.

For information about using the service, see the Terms of Service.