Privacy

• Your ERS password is never stored on our servers

  There is no database column for it. Not encrypted, not hashed, not anywhere. It is used once to read your schedule page and then it is gone.

• Your grades and your attendance are visible only to you

  There is no administrative override, no faculty view, no section ranking, and no anonymised aggregate. It is built so that showing them to anyone else is not possible, rather than merely switched off.

• Your academic numbers are never sent to an AI provider

  Your grades, your GWA, your cut counts and your subject list stay on our side. Nothing OneTUP does with a model needs them.

• You can export everything, any time

  In a machine-readable format, on demand, without asking anyone.

• Deleting your account really deletes it

  It cascades to every row you own and completes within thirty days.

• No advertising, no data sale, no analytics broker

  There is nothing here that makes money from knowing about you. What usage measurement exists is self-hosted and aggregate.

To import your schedule, OneTUP signs in to ERS as you, once, and reads your schedule page. Your student number, ERS password and birthdate are sent over an encrypted connection, used to sign in, used to read the schedule, and then discarded. Your schedule is saved. Your password is not.

Nothing in your ERS account is changed, submitted, or read beyond the schedule page.

The email address you sign up with. The schedule you import or paste. The attendance you tap in, the grades you enter, and the deadlines you add. The announcements you share with your section. The area you commute from and the routes you use. Anything you upload to build a reviewer from.

Every table that holds anything of yours has row-level security turned on in the database itself, so the rule that only you can read your rows is enforced one layer below the application rather than by the application remembering to check.

Anything you post to your section — an announcement, a suspension, a moved quiz — is visible to everyone in that section. That is the point of it.

A campus place, a printing price or a commute route you contribute becomes part of the public campus data that anyone can read, including people with no account. Your schedule, your grades, your attendance and your deadlines never do.

The campus map works signed out. It reads public campus data and asks you for nothing. There is no sign-up wall in front of it and nothing about you is recorded for using it.

The street tiles underneath it are loaded from OpenStreetMap, so your browser makes a request to their servers the same way it does to any site you visit. If that bothers you, the list of places below the map is served from here and works on its own.

A model drafts flashcards and practice questions from material you upload, and helps phrase points you have already written yourself. Everything it produces is marked as generated and shown next to the source it came from.

It never invents your grades, your prerequisites, or a jeepney route. Those are computed from your own rows or read from real sources, with the source shown. Provider keys stay on the server and are never handed to a browser.

Export everything whenever you want. Delete your account whenever you want, and the deletion is real — it removes every row you own and finishes within thirty days rather than hiding your account behind a flag.

This page describes how the product is actually built, and it changes when the product does. If you find something on this page that does not match what the code does, that is a bug worth reporting — the repository is the place.