CourseTrack

Privacy Policy

Updated November 14, 2026 · Version 2026-11-14.2

Last updated November 14, 2026

United States availability

CourseTrack is offered for users in the United States. Do not create a new account or purchase a new subscription if you are outside the United States. Country-based availability controls may use your network location and may be affected by VPNs or inaccurate location information. Contact info@midpointcorp.com if you need help accessing, exporting or deleting an existing account, or managing a subscription.

Our hosting provider uses the country inferred from your IP address to enforce website availability; this does not require GPS permission. Limiting the service audience to the United States does not mean that all service-provider processing occurs only in the United States. The provider and retention disclosures in this policy continue to apply, including to records collected before this availability change. This restriction does not remove privacy rights that apply by law.

CourseTrack is made by Midpoint Software Group Co. ("we," "us"). This policy explains what the CourseTrack iPhone app, Android app, and website collect, why, who helps us handle it, and how to delete it. We wrote it in plain language on purpose.

The short version: We collect the account and school information you give us so the app can do its job. We use service providers for document processing, subscriptions, and diagnostics. We don't sell your data, show ads, or track you across other companies' apps and websites for advertising.

Information we collect

Account information. Your email address, account identifier, and a securely hashed password if you use password sign-in. Where passkeys are available, our authentication provider stores the public-key credential and related sign-in metadata; CourseTrack does not receive the fingerprint or face scan your device may use to unlock a passkey. If you use a referral code, we record which code you used.

Policy acknowledgments. We store the policy version, confirmation time, and your statement that you meet the age and parent-permission requirements with your account. This is not identity or parental-consent verification.

Coursework you enter. Your terms, courses, instructors, meeting times, assignments, due dates, scores, grade categories and weights, credits, target grades, and grades you or your school report (including posted final grades).

Documents you upload. When you import a syllabus or transcript, the selected file or photo is sent to Anthropic to pull out course information. CourseTrack does not save the original upload in your account; only the details you review and save are stored there. Anthropic may retain the submitted content under its API retention policy, described below.

Ask assistant messages. When you use the Ask assistant, your messages and the course details needed to answer them are sent to our AI provider to create a reply.

Calendar feed links. If you connect a school calendar feed (for example from Canvas, Blackboard, or Moodle), we store the feed link so we can import due dates. These links often work like a password to your calendar, so we treat them as private, only use them to import your due dates, and delete them when you remove the feed or delete your account.

Time zones and reminders. We store your selected school and display time zones, confirmation time, and reminder preferences. The app can suggest a time zone from your device settings; this does not require GPS or precise location access. School time zones help interpret class times and deadlines, while display time zones control how times appear. If you enable reminder emails, they go to your account address.

Service emails and support. We use your email address for account confirmation, password recovery, welcome messages, and service communications. We keep delivery status and information you provide when asking for support.

Optional connected assistants. If you create an integration access key and connect an external assistant, it can use the permitted CourseTrack tools to read or change your coursework. We store a hash of the key and usage information. Only share a key with a service you trust; revoke it in CourseTrack to stop future access. Data already received by the connected service is handled under that service's own policies.

Browser and device storage. We use local storage and similar device storage for sign-in sessions, preferences, and onboarding state. Website fonts are requested from Google Fonts, which receives ordinary connection information such as your IP address.

Subscription status. If you subscribe to CourseTrack Pro, we receive your plan, status, and renewal or end date. We do not receive your card number.

Crash and diagnostic data. If the app crashes or hits an error, a report is sent that can include the error details, device model, operating system version, app version, and your account ID.

Feature reliability events. We record selected onboarding, plan selection, purchase, restore, and import events to understand failures and improve the service. These events include your account identifier when signed in, event name, platform, and a limited diagnostic code. The event record does not include uploaded documents, conversation content, calendar feed links, or payment card details.

Basic technical data. Our hosting and database providers log standard technical data such as IP address and request time to run and protect the service, including rate limits that block abuse.

App updates. CourseTrack checks Expo's EAS Update service for app updates. These requests include the operating system, the app's project ID, and a random installation token used to recognize repeat update requests.

AI features are optional. Before an AI request, the app or web app asks you to confirm sharing the described information with Anthropic. Acknowledging this Privacy Policy does not itself authorize an AI upload. You can cancel and continue using non-AI features.

What we don't do

We don't sell or rent your personal information.
We don't show ads or use advertising IDs or ad networks.
We don't track you across other apps or websites for advertising. RevenueCat provides subscription analytics, and Sentry provides crash and error diagnostics.
We don't ask for your contacts, location, or microphone. We only see a photo or file you choose to upload.

Notifications

Class and assignment alerts on your phone are scheduled locally by the app rather than sent through a CourseTrack push-notification server. Your underlying coursework and reminder preferences still sync with your account. Notification previews may appear on your lock screen depending on your device settings. You can manage notification permission in device settings.

How we use your information

To run the app: store your courses, calculate grades, and show your deadlines.
To sign you in and keep your account secure.
To import due dates from calendar feeds you connect.
To process documents you upload and answer Ask assistant questions.
To send reminder emails you turned on.
To check whether you have CourseTrack Pro and apply referral or ambassador credits.
To find and fix crashes and bugs.
To answer you when you contact support.

Companies that help us run CourseTrack

We use a small number of service providers. These providers process information for the functions described below, subject to their applicable terms and privacy policies:

Supabase — database, sign-in, and storage for your account and coursework.
Netlify — hosting for the website and the server functions that process uploads, AI requests, and calendar imports.
Anthropic — the AI model that reads syllabi and transcripts and powers the Ask assistant. Under Anthropic's commercial API terms, content we send is not used to train their models.
Sentry — crash and error reports (see above).
Expo - delivers app updates and processes the update-request information described above. See Expo's explanation of end-user data.
RevenueCat - validates purchases, enables paid features, and provides subscription analytics. It receives your CourseTrack account ID and your purchase and subscription records from Apple or Google, so these records are linked to your account.
Apple and Google — handle payment for in-app subscriptions. Their own privacy policies apply to your payment details.
Stripe — handled payments for older subscriptions bought on our website. New subscriptions are sold only in the apps.
Resend — delivers welcome emails using your email address, message content, and delivery information. Authentication and optional reminder messages also use our configured email delivery services.
Our reminder email delivery provider — sends reminder emails you turn on, using your email address and the assignment details in the email.
Cloudflare — bot protection on sign-up to keep automated abuse out.

We may also share information if the law requires it, or to protect the safety of our users or the service.

Referral and ambassador program

If you sign up with a referral code, we keep a record of the code, your account, and your email so the ambassador gets credit and each person only gets one free trial. If you apply to be an ambassador, we keep your name, email, school, optional social handle, and what you told us in the application.

How long we keep information

Account and coursework: stored while your account is active and removed from active account systems when account deletion completes, subject to the limited residual records and provider processing described below.
Uploaded documents and AI requests: CourseTrack does not store the original uploaded file after processing. Anthropic's standard API policy deletes inputs and outputs within 30 days, with exceptions such as longer retention for usage-policy enforcement or legal requirements. This also applies to messages and course information sent to the Ask assistant. See Anthropic's current retention policy.
Crash reports and server logs: retention depends on provider settings and the need to investigate faults, prevent abuse, or meet legal requirements. We do not promise a single fixed retention period for every provider or log.
Referral and ambassador records: we retain program history and replace direct identifying details during account deletion. An email-derived identifier remains to detect repeated referral claims. It is pseudonymous, not anonymous: we can compare it with an email supplied in a later claim.
Residual administrative and transaction records: limited signup/deletion audit records may retain your email and account identifier after account deletion. Billing providers retain transaction records under their own policies. Retention depends on security, fraud prevention, dispute handling, accounting, and legal needs; backups and provider processing can also delay removal.

How to delete your account

You can delete your account and data any time:

In the app: go to More → Account → Delete Account and confirm.
On the web: see our delete account page for the steps.
By email: write to info@midpointcorp.com from your account email address and ask us to delete your account.

When account deletion completes, we remove your courses, assignments, grades, calendar feeds, reminder settings, integration keys, and sign-in from active account systems. Limited residual records described above may remain. We also send RevenueCat a request to delete your customer record. Provider processing or failures can delay that removal; contact info@midpointcorp.com if you need help confirming it. Apple and Google retain their own transaction records under their policies. Deleting your account doesn't cancel an App Store or Google Play subscription - cancel that in your Apple ID or Google Play subscription settings.

Your rights

Depending on where you live, you may have the right to see, correct, export, or delete the personal information we hold about you, and to object to some uses of it. Send a request to info@midpointcorp.com, preferably from your account email, and identify the request and your location so we can determine the applicable process. We may need to verify your identity before disclosing or deleting data. Available rights, exceptions, response periods, and any appeal process depend on applicable law. If you disagree with our response, reply and request a review. We do not sell personal information or use it for cross-company targeted advertising.

Where information is processed

CourseTrack is operated from the United States. Our service providers may process information in the United States and other countries where they operate. Applicable privacy rights depend on your location and the circumstances of processing; this policy does not waive rights that cannot be waived.

Security

Data is sent over encrypted connections, and database access controls restrict ordinary users to their own records. Authorized service operations and personnel may access data as needed to operate, support, and protect CourseTrack. Passwords are hashed and never stored in readable form. No system is perfect, but we take security seriously.

Students and children

CourseTrack is intended for students age 13 and older and is not offered for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information, contact us so we can investigate, stop further collection where appropriate, and arrange deletion, including relevant provider records. A minimum-age statement alone does not replace any parental-consent obligations that apply by law.

School records (FERPA)

CourseTrack is offered directly to students, not through schools. The information in your account is information you chose to enter or import. We do not act for a school unless we enter a separate written arrangement. Your school remains responsible for its own records and legal obligations; this policy does not determine the legal status of records maintained by your school.

Changes to this policy

If we change this policy in a way that matters, we'll update the date at the top and, where it makes sense, let you know in the app.

Contact

Midpoint Software Group Co.
info@midpointcorp.com

Privacy requests, shared records and updates

The organization identified for CourseTrack is Midpoint Software Group Co.. Send privacy questions or requests to info@midpointcorp.com. We may verify your identity, account relationship and authority over requested records. A request does not require purchasing a subscription.

Depending on the law that applies to you, you may request access, correction, deletion or a portable copy; object to or restrict certain processing; withdraw consent where processing relies on consent; or appeal a decision on a privacy request. Contact the same address and identify an appeal if you want a decision reviewed. You may also complain to the appropriate regulator. We respond within applicable legal deadlines and explain lawful limitations. We do not retaliate for exercising applicable privacy rights.

Deleting a sign-in account is not necessarily deletion of shared business, project, household, farm, school or care records. The service-specific retention and deletion descriptions above explain the applicable workflow. Records may remain where another authorized organization or user must retain them, where law requires retention, or in limited backups and security records. Copies already exported, printed or shared cannot be recalled by deleting the account. We do not use this explanation to extend a more specific deletion promise made elsewhere in this policy.

An adult account may contain authorized information about a child or another person receiving care. An age restriction for account holders does not mean those records never contain children's information. Parents, guardians and authorized representatives should contact us about access, correction or removal within their authority. Do not submit unnecessary sensitive information.

A Privacy Policy is a description of processing, not blanket consent to every use of information. Where consent is required, it must be obtained for the relevant action. We identify material policy changes and provide additional notice or obtain consent when required; continued use alone does not authorize a new incompatible use of previously collected information. Withdrawing consent does not undo processing already lawfully completed.

Service providers process information for the functions described in this policy and may have independent legal obligations. Unless a service-specific statement says otherwise and is supported by the applicable arrangement, do not assume immediate deletion, zero provider retention, end-to-end encryption or storage in a single country. This clarification does not authorize broader collection or override a specific existing privacy commitment.