Privacy Policy

Last updated October 20, 2026

The Student's Secretary ("we", "us") copies your D2L (Brightspace) assignments and due dates into your Google Calendar. This policy explains what we collect, why, who we share it with, and how to get it deleted. The short version: we collect only what the sync needs, we never ask for your school password, and we never sell your data.

What we collect

If you join the waitlist

Your email address, school, and year in school.

If you sign in with Google

Your basic Google profile: your email address, name, and profile picture link, which Google shares when you sign in. We use your email to identify your account.
Google Calendar access: permission to create one new calendar, called "D2L", and to manage the events in it. We store the access token Google gives us (encrypted) so the daily sync can run while you're away, plus the ID of that one calendar.
Your D2L calendar feed link: the private link you paste in. We use it to read your assignments, due dates, and course names from D2L.
Tests and quizzes you add by hand: the course, title, date, time, and length.
Your settings: your school, your calendar detail choices (title style and reminders), and sync status (when your calendar last synced and whether it worked).

What we don't collect

Your TCU or D2L username or password. We never ask for them.
Your grades, messages, or anything in D2L beyond the calendar feed.
Your other Google calendars or their events. The permission we ask for only works on the calendar our app creates, so we can't see the rest of your calendar.
Your Gmail, contacts, Drive files, or anything else in your Google account.

We don't use advertising or analytics trackers. The only cookies we set are the ones that keep you signed in.

How we use your information

To sync your D2L due dates and your hand-added tests into your "D2L" Google calendar, once a day and whenever you press Sync now.
To show you your sync status and let you fix problems.
To email you about the service, such as when early access opens or when you need to reconnect Google.

We don't sell your information, and we don't use it for advertising.

Google user data

The Student's Secretary's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google Calendar access only to create your "D2L" calendar and to add, update, and remove the events in it that come from your D2L feed and the tests you add.
We don't transfer Google user data to anyone, except as needed to run this feature, to comply with the law, or as part of a merger or sale, with notice to you.
We don't use Google user data for advertising, and we don't sell it.
No person reads your Google data, unless you ask us to for support, it's needed for security or to comply with the law.
We don't use Google user data to train AI or machine-learning models.

Who we share it with

We use a few service providers to run the app. They process data only on our behalf:

Supabase, which hosts our database and handles sign-in.
Vercel, which hosts the website and runs the daily sync.
Google, which receives the events we write to your calendar.

We may also share information if the law requires it, or with a buyer if the service is ever sold (the buyer would have to follow this policy).

How we protect it

Your Google access token is encrypted before it's stored. Our database blocks public access, so only our server can read your account. Everything travels over HTTPS. No system is perfectly secure, but we work to keep your data safe.

How long we keep it

We keep your information while your account is active. If you ask us to delete your account, we delete your sync account, feed link, Google token, settings, and hand-added tests within 30 days. Waitlist entries are kept until launch or until you ask us to remove them.

Your choices

Stop the sync: remove our access any time at myaccount.google.com/connections. The "D2L" calendar stays in your Google account until you delete it.
Delete your data: email us at hello@thestudentsecretary.com from the address you signed in with, and we'll delete your account.
Access or correct your data: email us and we'll help.

Students and age

The Student's Secretary is meant for college students. It isn't for children under 13, and we don't knowingly collect their information. If you think a child has signed up, email us and we'll delete it.

Changes

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you by email or on the site before it takes effect.

Contact

Questions or requests: hello@thestudentsecretary.com.

The Student's Secretary isn't affiliated with TCU, D2L, or Google.