Legal
Privacy Policy
1. Who We Are
CourseCompass ("the App") is a student-built academic advising tool created by James Moore. This deployment serves Busch School of Business. The App is not an official Busch School of Business product. For official advising, contact your school's academic advising office.
2. What We Collect
We collect the following information when you register and use the App:
- Your school email address (a verified cua.edu address) (required for registration; used to restrict access to enrolled students of your school)
- Your academic profile: degree program, catalog year, specialization, and courses you have completed or plan to take
- Chat messages you send to the AI advisor and the responses it generates
- Your email verification status and account timestamps
- The date and time you accepted this Privacy Policy, recorded at registration and stored as a consent timestamp
- The date and time you acknowledged the AI-guidance disclaimer, recorded separately at registration as its own consent timestamp
We do not collect payment information, Social Security numbers, financial aid records, or official academic transcripts. We do not run advertising. We do not embed third-party tracking pixels or analytics scripts.
3. Session Cookies
The App uses one strictly necessary session cookie to keep you logged in while you use it. This cookie is set by the Laravel web framework. It does not track you across other websites and is deleted when your session ends or expires. No consent banner is required for strictly necessary cookies under applicable law.
4. How We Use Your Data
We do not sell student data. We do not use your course history, academic progress, or interaction patterns for advertising, marketing, or third-party analytics. Our revenue comes entirely from licensing fees paid by universities. Your data belongs to you and your institution.
- To authenticate you and restrict access to verified students of your school
- To generate personalized course planning advice using your academic profile
- To pass relevant context to the AI model (Anthropic Claude) during your chat session
- To improve the accuracy of degree requirement logic over time
We do not sell your data. We do not share your data with third parties except as described in Section 5.
5. Third-Party Services
Your chat messages and academic profile context are sent to Anthropic's Claude API to generate responses. Anthropic processes this data under its own Privacy Policy. The App is hosted on Amazon Web Services (AWS EC2). AWS stores the underlying database and application files under its Privacy Notice. No other third parties receive your personal data.
6. Data Retention
Your account data is retained for one academic year from the date of your last login. After that period, inactive accounts and their associated data are permanently deleted.
You may delete your account at any time by selecting "Delete Account" from the chat sidebar, or by navigating to /account/delete. You will be asked to confirm your password. Deletion is immediate and permanent: your academic profile, course history records, and login credentials are removed in a single transaction with no recovery option. Your consent timestamp is deleted along with all other personal data.
7. Your Rights
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate information in your profile
- Delete your account and all associated data at any time
- Request a copy of your data by contacting us at the address below
8. Security
All traffic is encrypted via HTTPS. Passwords are hashed using bcrypt. API keys are stored as environment variables and are never committed to version control. Sessions are set to expire after 120 minutes of inactivity. Security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy) are applied at the server level.
9. FERPA Notice and Consent
This App is not operated by your school's registrar and does not access official FERPA-protected education records. The academic information you enter is entirely self-reported and voluntary. If you have questions about your official academic records, contact your University Registrar.
Before creating an account, you are required to check two separate consent boxes: one acknowledging that your academic profile and chat history will be stored to provide personalized advising, shared with the AI API to generate responses, and retained for one academic year unless you delete your account; and a second acknowledging that AI-generated guidance is informational only and not official academic advice. The exact disclosure text for each is presented at registration and cannot be bypassed. The date and time of each consent is recorded separately and stored with your account record for audit purposes.
10. Contact
Questions about this policy may be directed to:
James Moore · The Catholic University of America
Email: moorejp@cua.edu
11. Changes to This Policy
If this policy changes materially, we will update the effective date at the top of this page. Continued use of the App after a policy change constitutes acceptance of the updated terms.