Privacy policy

What we collect

• Your email address and display name, to run your account.
• The notes, attachments, and corrections you write.
• Which classes you belong to and your role in them.
• A private record of the days you contributed, shown only to you.
• If you connect Google Classroom or Canvas: the account name it reports, your course list, and what those courses publish.

There are no advertising trackers and no analytics scripts. Cookies are used for two things: keeping you signed in, and remembering your time zone so the days on your private record are counted where you are.

Who can see your work

Drafts are private to you. Nobody, including class maintainers, can read a note you have not shared. When you share a note, the members of that class can read it, and your name appears on it. Your record of days is never shown to anyone else. Where you stand in a class is worked out on the server from the class as a whole and shown only to you.

The organizer and AI

When you ask MeltingPot to organize a note or build study material, the text of that note, and any images attached to it, are sent to Google's model API to produce the organized version. We do not use your notes to train models. When no model is configured, a deterministic organizer runs instead and your note leaves the database for nowhere.

Connected classes

Connecting Google Classroom or Canvas is optional. When you do, MeltingPot reads the courses you belong to and what they publish: assignments, due dates, announcements, and links to materials. It reads only. Nothing you do here is sent back to the school, and no grade, submission, or roster is read. Files in Google Drive are never downloaded; a material is a link that opens where the teacher put it.

The token that lets us read is stored encrypted in the database and is only ever used on our server. Disconnecting deletes that token and everything it brought in; notes you started from an assignment stay yours. While our Google integration is in Google's testing status, a connection lapses after seven days and asks you to reconnect. A course a class maintainer links to a Pot is visible to every member of that Pot; a course you keep in your own calendar is visible to you alone.

Where it lives

Data is stored in Supabase, which runs on managed cloud infrastructure. Every table is protected by row level security, so the database itself enforces who can read what, and accounts that maintain classes can turn on two-step sign in.

Deletion

Removing a shared note in a class marks it removed rather than destroying it, so a mistaken removal can be undone by a maintainer. If you want your account or your content permanently deleted, ask through the repository below and we will do it.

Changes and contact

If this policy changes, the date above changes with it. Questions are welcome as issues on the open source repository.