Syllabee reads course outlines so you don't have to. That means it handles documents you were given in confidence, so here is exactly what happens to them.
Effective 28 September 2026. Version 1.1.
Syllabee is built so your semester lives on your phone first. The server exists to back it up, to read your syllabus once, and to pass a schedule to your classmates when you choose to share one.
The rest of this page is the specific version. Where something is imperfect, it says so rather than leaving it out.
This policy covers the Syllabee mobile app, the syllabee.co website, and the Syllabee server that performs extraction, sync, sharing, and calendar feeds. It is written by Berkan Bozoglu ("Syllabee", "we"), the operator of all three.
Syllabee is not affiliated with, endorsed by, or operated in partnership with Concordia University or any other school. Your instructors and your registrar have no visibility into your Syllabee account.
Optional. You provide one only if you want your semester backed up across devices, or when you share a class so your classmates know who published it. We send a six-digit code to verify it.
Linking an email keeps your existing account and data. It does not create a second one.
No contacts, no photo library beyond the specific images you pick for an upload, no location, no device advertising identifier, no browsing history, no data from other apps, and no student number or school login. Syllabee does not connect to your school's learning management system.
When you upload a course outline, the file is sent to the Syllabee server, converted if necessary, read once, and stored in a private storage bucket that is not reachable from the public internet. Nobody else's account can read it.
Our request logs are configured to never record the contents of a document, the text of an announcement you paste in, or the extracted schedule. Failures are logged as their shape, meaning how many fields were wrong and which fields, not as the text that failed.
We know course outlines routinely contain an instructor's direct email address and meeting links with the passcode baked into the URL. That is precisely why the file stays private and why sharing a class strips both.
Reading your syllabus is done by a large language model operated by Anthropic PBC, which Syllabee calls through its commercial API. Your document's text is sent to Anthropic solely to produce the schedule, and comes back as structured data that you then review and confirm.
Under Anthropic's commercial terms, content sent through the API is not used to train their models. Anthropic's own handling is described at anthropic.com/legal/privacy.
Nothing extracted enters your schedule until you have seen it and confirmed it. Syllabee does not invent dates: if the outline says a date is to be announced, the app carries it as unknown rather than filling in a guess.
This one is worth reading properly, because it is the only thing on this page that outlives your account.
Every uploaded file is fingerprinted, and the resulting schedule is stored against that fingerprint. When another student uploads the identical file, which is what happens across a section of the same course, Syllabee serves the stored result instead of reading the document a second time. That is what makes joining a class instant and free.
The cache entry holds a fingerprint and a schedule. It carries no user ID and no link to any person. The only record connecting an account to a fingerprint is the upload record in your account, and deleting your account deletes that record. Once it is gone, the cache entry cannot be traced back to you.
So: a cache entry is not deleted when you delete your account, and we are telling you that rather than claiming a clean sweep we don't perform. If you believe a specific document should not be in the cache at all, write to us and we will remove that entry.
Marks you enter are backed up to the server alongside the course they belong to, because losing a semester of grades with a lost phone is the worst thing this app could do to you. Database rules restrict those rows to your own account.
Grades are excluded from everything that leaves your account. The code that builds a shared class snapshot is a strict allow-list, and its tests fail if a grade field ever appears in the output, including buried inside another object. Calendar feeds carry no grades either.
Sharing is opt-in, per course, and produces a code that only someone holding the link can use.
What travels to your classmates: the course code, the school name you typed, the term, and the schedule you reviewed and confirmed, meaning dates, titles, locations, and instructor name.
What never travels: your grades, your weights and grading rules, the file you uploaded, the raw pre-review model output, the instructor's email address, your device and notification identifiers, and your personal notes. Members see how many people have joined, never who they are.
If a classmate proposes a date for a to-be-announced item, the class sees the proposal and the number of confirmations. It never sees who proposed it: that field is not readable by members at any level.
You can revoke a class link at any time. If you delete your account, a class you created survives without an owner and frozen at its last version, so the classmates who depend on it don't lose their schedule; your membership records and any proposals you made are deleted.
Syllabee can give you a subscription link that Apple Calendar or Google Calendar polls for updates. Calendar apps have no way to sign in, so the link itself is the password. Anyone who has it can read that calendar's dates and titles, never your grades. Treat it like a password, and use the revoke-and-replace button in the app if it ever gets out.
Our own logs mask the link before anything writes them to disk. One honest caveat: our hosting provider's edge logs record the full request path, which includes the link, and that layer sits outside our code. This is inherent to how calendar subscriptions work. It is why the links are single-purpose, carry no grades, and can be replaced instantly.
Reminders are scheduled on your device, so the content of a reminder never leaves your phone.
The one exception is a class update: when someone you follow republishes a schedule, we send a push through Apple or Google. That message contains the course code and generic wording only, never a deadline title, a date, or a quotation from the outline, because push messages transit Apple's and Google's servers.
Syllabee measures its own funnel using a plain table in our own database. There is no Google Analytics, no Firebase Analytics, no Meta pixel, no PostHog, no attribution SDK, and no advertising SDK anywhere in the app.
What is recorded is the name of a step and when it happened: an upload started, a schedule confirmed, a calendar written, a paywall viewed. Payloads carry counts and coarse categories. An automated test sweeps every event we emit for forbidden fields (titles, grades, source text, file names, class codes) and fails the build if one appears.
These rows are keyed to your account ID, so the correct word is pseudonymous, not anonymous. Deleting your account deletes them.
When the app or our server hits an error, a technical report goes to Sentry: what failed and where in our code, the app and operating-system versions, the device model, and your account ID. It never includes your courses, files, grades, or anything you typed, and we don't send your IP address. Reports pass through a filter that removes codes, links, and email addresses before they leave, and an automated test fails the build if one gets through. Sentry is an error-reporting service, not an analytics or advertising tool.
Payments are processed by Apple. Syllabee never sees your card, your Apple ID, or your billing address.
Subscription state is managed through RevenueCat, Inc., which receives your Syllabee account ID and the purchase receipt from Apple in order to tell our server whether your account is entitled. It receives nothing about your courses, your schedule, or your grades. RevenueCat's practices: revenuecat.com/privacy.
Your account, schedule, and files are stored in Canada, in the Canada Central region of our database and storage provider, Supabase, Inc. That region is in Canada, outside Québec.
Processing happens outside Canada in three places: the extraction request to Anthropic, our application server hosted on Railway, in the eastern United States (Virginia), and error reports sent to Sentry, in the United States. Subscription state sits with RevenueCat in the United States. Data held outside Québec or outside Canada is subject to the laws of the territory where it sits, including lawful access by its authorities.
Our complete list of service providers:
We do not sell personal information, and we do not disclose it to anyone else except where the law requires it.
Open Settings → Account → Delete account and confirm twice. There is one deletion path and it runs immediately: it removes your schedule mirror, your uploaded files, your usage counts, your push tokens, your class memberships, your date proposals, your calendar feed links, your profile, and then the account itself. Feed links stop working the moment it runs.
Deleting your account clears the server. The database on your own device is deliberately left alone, so your semester keeps working offline instead of vanishing mid-term. To remove that copy too, delete the Syllabee app from your phone.
Under Québec's Law 25, Canada's PIPEDA, and comparable laws elsewhere, you can ask us to give you a copy of the personal information we hold about you, correct it if it's wrong, delete it, receive it in a structured and commonly used technological format, or explain what we do with it. Most of this is faster from inside the app; for anything else, write to the address below and we will answer within 30 days.
If our answer doesn't satisfy you, you can complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.
The person responsible for the protection of personal information at Syllabee is Berkan Bozoglu, reachable at the address below.
Syllabee is built for post-secondary and senior high-school students and is not directed at children under 14. We don't knowingly collect information from anyone under 14; if you believe a child under 14 has an account, write to us and we'll remove it.
Traffic is encrypted in transit. Storage buckets are private. Database access is governed by row-level rules that scope your rows to your account, and the tables holding uploads, usage counts, and feed links are unreachable by any user credential at all: only our server can touch them. Snapshot and feed builders are allow-lists with tests that fail when a sensitive field slips in.
No system is perfect, and we won't pretend otherwise. If you find a vulnerability, write to us before disclosing it publicly and we'll work with you.
If a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected, and we keep a register of such incidents.
If we change something that matters, such as a new provider, a new category of data, or a different retention period, we'll update the effective date and tell you in the app at least 30 days before it takes effect. Older versions are available on request.
Email support@syllabee.co. Postal mail: 93 Av De Lucerne, Suite 8, Pointe-Claire, QC, H9R 2V1.