How your data is handled

In plain words: what we keep, what we don't, and how it's protected.

What we keep, so it works

Your email	To log you in to this site.
Your site password	Only as a one-way scrambled code (salted PBKDF2). We can't read it back.
A signed-in pass for each McGill site you connect	Like staying logged in on a device. Encrypted (AES-256). Deleted automatically 7 days after it's last used, or instantly when you disconnect.
Your private connector link	Stored encrypted. Replace it any time.
A short activity list	Which actions your AI ran and when. Never the contents. Kept 30 days.
A WebWork pass	WebWork opens through your MyCourses sign-in. Its own pass is stored the same encrypted way, and deleted with your account or when you disconnect MyCourses.
The last page opened, for 3 minutes	Encrypted, only so multi-step actions like search then select can work. Then it expires.

Your McGill password or approval codes. You type those on McGill's own page.
Your grades, transcript, schedule, fees, or personal info. They pass through to your AI when you ask, and aren't stored here.
The files, PDFs or assignments your AI reads or hands in. They pass straight between McGill and your AI and aren't stored here.
Ads, trackers or analytics. None are on this site. Your data isn't sold or shared.

Encrypted connection (HTTPS only) everywhere.
Isolated sign-in. McGill login happens in a private cloud window that is closed afterwards.
You approve changes. Registering, dropping, handing in an assignment or submitting WebWork answers stays a preview until you confirm to your AI. Checking WebWork answers without submitting is allowed.
Locked to McGill. Your sign-in pass is only ever sent to McGill's own sites, and never to anywhere else.
Attempt limits on logins to slow down guessing.

The signed-in pass works like being logged in. Whoever holds it can act as you until you disconnect or it expires. We encrypt it and only use it when your AI asks, but you should know it exists.
When you ask your AI something, the page contents it needs (like your grades) go to the AI company you chose, under their privacy terms.
This is an unofficial tool. McGill's rules about automated access may apply to you. If you're unsure, ask McGill IT first.
Our hosting provider (Cloudflare) sees normal web traffic details, as with any website.

Disconnect a McGill site, replace your link, or delete your whole account from your dashboard. Deleting erases everything listed above.