Privacy Policy

Syllmate reads the study material your Google account already gives you access to — your Google Classroom courses, their coursework, class materials, announcements and topics, and the metadata of Drive files shared with you — and shows it back to you in one searchable list.

We read it read-only. We do not modify, move, delete or copy anything in your Google account. We do not use your material to train any model, we do not show you advertising, and we do not share your library with any other student. Disconnecting revokes the Google access and deletes everything we stored, immediately.

We request the narrowest permissions that make the product work. Each one is listed here with the feature it powers and why no narrower scope exists.

• classroom.courses.readonly

  Lists the Classroom courses you are enrolled in so your material can be grouped by subject.

  Why not narrower: A student-scoped list is only available through this read-only scope. We never read rosters, and never read a course you are not enrolled in.

• classroom.coursework.me.readonly

  Reads your own assignments, so the real due date appears in the deadlines view and their attachments appear in search.

  Why not narrower: This is the student-scoped variant. Its teacher-scoped sibling would expose other students' submissions and grades, so we do not request it.

• classroom.courseworkmaterials.readonly

  Reads reference material your teacher uploaded to a class, and indexes its attachments.

  Why not narrower: The read-only form of the only scope that exposes this collection. The write variant would be unnecessary and against policy.

• classroom.announcements.readonly

  Reads announcements, which often contain the actual links to notes and the exam-relevant dates.

  Why not narrower: Read-only form of the only scope that exposes announcements to students.

• classroom.topics.readonly

  Reads the unit labels your teacher set, so each item can be tagged with the unit it belongs to.

  Why not narrower: Contains no additional personal data about you.

• drive.metadata.readonly

  Lists files shared with you, so material a teacher shared directly (often forwarded from a class group) appears in the same library.

  Why not narrower: We request file metadata only — name, type, link, and the time it was shared. We do not read or store file contents, and we never modify, move or delete a file. The narrower drive.file scope is insufficient because it only grants access to files you explicitly open through the app.

We also request your name and email address so we can create your account and show you your own library. We do not request your phone number, your college, your roll number, or access to your email.

• •Your Google user ID, email address and display name.
• •An encrypted OAuth refresh token, so we can keep your library in sync in the background. It is encrypted at rest with a key held separately from the database and is never exposed to your browser.
• •Metadata about your material: course names, titles, descriptions, topics, due dates, links, file types and timestamps.
• •Your app settings, such as which subjects you have filed and what you have already read.

We do not store the contents of your files. Material from Classroom and Drive is linked, never copied. The only file bytes we ever hold are ones you explicitly hand us — an attachment you forwarded or shared — and only if you ask us to keep a copy. Those are stored in a private bucket and served through short-lived signed links.

• •We never sell, rent or trade your data.
• •We never use your material to train a model, ours or anyone else's.
• •We never share your library, or any part of it, with another student.
• •We never show you advertising, and we do not use third-party trackers or ad pixels.
• •We never read your email, your contacts, or anyone else's grades.
• •We never write to, modify, or delete anything in your Google account.

These providers process data on our behalf, under contract, only as needed to run the service:

• Supabase — Postgres database, authentication and server-side functions. Data stored in the region you select when creating the project.
• Cloudflare — Hosting, CDN, DNS, object storage for attachments you choose to keep, and inbound email routing.
• Google — The source of your Classroom, Drive and account data, and OAuth token exchange.
• Resend / Postmark — Transactional email such as the daily digest, if you turn it on.

We keep your data for as long as your account exists. If you disconnect, we revoke the Google access token immediately and delete your library within 24 hours. If you delete your account, we delete your data immediately and irreversibly, except where we are legally required to retain something.

• •All traffic is encrypted in transit with TLS.
• •OAuth refresh tokens are encrypted at rest with AES-256-GCM. The encryption key is held separately from the database and is never shipped to the browser.
• •Every table has row-level security enabled. A query made with the public key can only ever return your own rows.
• •The privileged key that can read all data exists only in server-side functions and is never included in the app bundle.
• •Attachment files live in a private bucket and are served through short-lived signed links.

You can access, correct and export your data at any time from inside the app, and you can disconnect Google or delete your account with one click. To exercise any right, email privacy@syllmate.app. We respond within 30 days.

Note that material in your library may include your teacher's copyrighted course content. We do not redistribute it and we do not permit you to redistribute it through Syllmate.

Syllmate is intended for university and college students. We do not knowingly collect personal information from children under 13. If you are under 13, do not create an account. If you believe a child has provided us personal information, contact us and we will delete it. Some college accounts belong to students under 18; those users are treated as adults under this policy and their college's Workspace administrator may also restrict third-party app access.

If we change how we use your data in a material way, we will update this page and tell you in the app before the change takes effect. If we ever add a scope or a sub-processor, this page changes first and the change requires a fresh Google consent from you.

Questions, complaints or requests: privacy@syllmate.app.

Last updated: 20 October 2026.