Privacy
Last reviewed alongside the current build. No ad tracking, no analytics pixels. Accounts are optional — see below.
Raw files never leave your browser as files
A dropped PDF or DOCX is read and its text extracted locally, in your browser (client-side, via `pdfjs-dist`/`mammoth`) — SyllaCal’s servers never receive the original file. Only the extracted plain text (or, for a scanned syllabus with no text layer, the raw bytes as a fallback) is sent to the parsing endpoint over HTTPS.
What the server actually caches, and for how long
Extracted syllabus text is hashed (SHA-256) and the parsed result cached in server memory — not a database — keyed by that hash, for up to 30 days, capped at 2,000 entries. This is real, and it is the mechanism that lets a classmate who uploads the same syllabus get an instant result instead of a fresh model call. It means a parsed course (including whatever the syllabus itself contains — an instructor’s name and office-hours email, if listed) can persist in server memory for that window, not “discarded immediately.” The cache is content-addressed (by the syllabus text, never by a name or a student identity) and process-local: it resets on every deploy or restart, and nothing is written to disk.
By default: no database, no account, no student profile
SyllaCal needs no signup and no login to use in full — parsing, verifying, conflict detection, and the workload view all work with zero persistent record tying any of it to you. Your semester — courses, dates, notes — lives only in your browser: by default in sessionStorage, cleared the moment you close the tab. Flipping “Keep this semester on this device” moves it to localStorage instead, so it survives a closed tab on that browser, on that device, until you clear it or turn the setting back off. Nothing is synced to a server for storage unless you choose to create an account (see the next section) — the command bar’s “Clear all data” wipes your local semester immediately, regardless.
If you create an account: encrypted sync, not a copy of your data
An account exists for exactly one reason — syncing a semester across your own devices — and is entirely optional; nothing else in the app requires it. Your password itself never reaches SyllaCal’s servers: your browser derives two independent keys from it (PBKDF2, then an HKDF split) — one proves your identity to the server and is itself hashed with Argon2id before storage, so even that value can’t be used to decrypt anything; the other encrypts your semester with AES-GCM before it ever leaves your device, and is never transmitted at all. What lands server-side is your email, that hashed identity proof, and an opaque encrypted blob SyllaCal holds no key to read. One direct consequence: there is no password reset. Losing your password means losing access to whatever was synced, because a working reset would require SyllaCal to be able to read what it’s supposedly protecting.
Payments and export passes
Checkout is handled entirely by Stripe — SyllaCal never sees or stores your card details. A completed purchase mints a signed, expiring token (valid up to 120 days) that your browser holds and presents to unlock exporting; the token proves what tier you bought, not who you are. It is deliberately kept independent of the account system above — even a signed-in student’s export token isn’t tied to their account, so losing it (clearing browser storage) means losing that pass with no way to recover it.
Rate limiting
Parsing and export requests are rate-limited per IP address, in-memory only, to keep the service usable for everyone. No IP address, request log, or usage history is retained past that in-memory window.
An honest limitation
Because export passes are deliberately kept independent of the account system — a choice made to keep trying and exporting FERPA-safe by construction even for a student who never signs up — an export pass is a bearer token, not an identity-checked license. If a token is shared, it works for whoever has it until it expires. What SyllaCal does guard against is a checkout success link being reused to mint unlimited fresh tokens for a whole class; it does not (and structurally cannot, short of tying every export to an account, which would make signing up mandatory) stop one person handing their own token to one friend.
Ownership & Questions
SyllaCal is owned and operated by Flex Dialer, LLC. If something here doesn’t match what you observe the app doing, that’s a bug in this page or the app — not a hidden practice — and worth filing as one.