App Privacy Policy

Effective November 5, 2026

This policy covers Unify: the iPhone app, the Unify web app at api.unifyapp.dev, and the Unify Companion Chrome extension. The public website and waitlist are covered by the website privacy policy.

Who to contact

Unify is an independent academic-planning project run by its founder. It is not affiliated with Canvas, Instructure, Gradescope or the University of Maryland. For questions, a copy of your data, corrections or deletion, email founder@unifyapp.dev from your account’s address.

What Unify collects

• Your account: your email address and password. The password goes to our authentication provider (Supabase), which stores only a hash of it.
• Feed links you add: your private ELMS calendar feed link and course announcement feed links. They are stored encrypted (AES-256-GCM) and are never shown back, logged or put in notifications.
• What those feeds contain: Unify’s server downloads each saved feed about once an hour. It keeps the course names, assignment and exam titles, dates, announcement text and links in them.
• Documents you upload: the text read from a syllabus or course document and the dates found in it. Unify keeps the text, not the original PDF, Word or PowerPoint file. For an HTML file it keeps a cleaned copy of the page, to show where each date came from. Each upload also gets a short receipt with only its result counts, kept for 8 days, so an interrupted upload can be confirmed.
• Links you save but Unify doesn’t open: Gradescope course links.
• Your edits: course names you change, tasks you add or complete, dates you confirm, and reviews you accept or dismiss.
• Operations: named event counts with no content (such as “calendar connected”), when you were last active, and request-rate counters used to limit abuse. Server logs record errors without feed links or coursework.
• Notifications, if you turn them on: your iPhone’s push token, stored encrypted and used only to deliver Unify alerts.

What Unify does not do

Unify never asks for your Canvas/ELMS or Gradescope password. It does not log in to Canvas or Gradescope, call the Canvas API, or read Canvas or Gradescope pages, in the app, on our server or in the Chrome extension. The only Canvas addresses it contacts are the calendar and announcement feed links you give it. It does not sell data or show ads. It does not send your coursework to AI model providers or other analysis services.

The Unify Companion Chrome extension

• The side panel lets you sign in to your Unify account and set up the same sources as the iPhone app. Everything you add there is sent to Unify over HTTPS and appears on your iPhone.
• It keeps your Unify sign-in session in Chrome’s storage for this extension, so you stay signed in after Chrome restarts. Web pages and other extensions cannot read it. Anyone who can use your computer account could.
• It keeps a list of your last 30 actions in that storage, such as a file name, a course code or a link you saved, and how each one ended. Half-typed entries are held in memory only and cleared when Chrome closes.
• When a different person signs in to the extension, the previous person’s list and unsent entries are cleared. Signing out clears them too.
• It can contact only Unify and its sign-in service. It has no access to the pages you visit, your tabs or your browsing history.
• Signing out in the extension ends that browser’s session only. Uninstalling it deletes its stored data.

Data from the extension is used only to provide Unify’s features to you. It is not transferred to others except the service providers below. It is not used for advertising or for creditworthiness or lending decisions.

On your iPhone

The app keeps a copy of your last loaded data on the device so it works offline. Signing out erases that copy.

Where it is stored and who processes it

• Supabase: account sign-in and the database, hosted on Amazon Web Services in the United States (us-east-1). Its sign-in logs, which include your email address and IP address, are kept for 7 days.
• Amazon Web Services (Lightsail): the Unify server that reads your feeds and documents, in the United States.
• Resend: account emails, such as sign-up confirmation. Resend keeps a copy of each email it sends, including your address, for 30 days.
• Expo and Apple: push notification delivery, only if you enable notifications. Apple distributes the app through the App Store and TestFlight.

Only the founder operates these services and can access the data. We may disclose information when required by applicable law.

Retention, backups and deletion

Your coursework and sources stay until you remove them or delete your account. Data is removed on these schedules:

• Notifications and event counts: after 90 days.
• Change history and evidence that no longer applies: after 180 days.
• Import and upload receipts: after 8 days.
• Rate-limit counters: after 2 days.

To delete everything, open the iPhone app, go to Settings, and choose Delete my account and data. This signs you out everywhere, deletes your sign-in, and deletes every course, source, document, receipt and setting linked to your account. You can also email us to request deletion.

Deleting your account does not change existing backups. Your data leaves them on these schedules:

• Founder backups: before database maintenance, the founder makes a backup of the database and keeps it on the founder’s computer, readable only by the founder’s account. Each one is deleted within 30 days of being made.
• Supabase backups: Supabase backs up the database daily and keeps each backup for 7 days. We can’t delete a single Supabase backup early.

So 30 days after you delete your account, no backup and no provider copy described above still holds your data. Email us to have your data removed from the founder’s backups sooner.

Audience and changes

Unify is for university students aged 18 or older. By creating an account you confirm that you are 18 or older. We will update this policy before Unify starts collecting anything new, and the date above shows the current version.