Privacy policy

What we keep

• Your account: your email address and your password, stored only as a scrambled hash (scrypt) that cannot be turned back into the password, and the date you signed up.
• Your plans: each goal, what you told the coach about it, the plan the AI made (phases, tasks, strategy and sources), your study hours, your days off and the tasks you ticked, with when.
• Your sessions: when you sign in, your browser or phone gets a random key. We keep only a hash of it, for 180 days or until you sign out.
• Password resets: when you ask for one, we email you a link that works once, for an hour. We keep only a hash of it.
• When you last used Masar: the day only (not the time, nor what you did), on the website and in the phone app. With daily totals that name nobody (sign-ups, students, new plans, AI requests), it tells us how many students use Masar.

Without an account, the phone app keeps your plans on the phone only, and we keep nothing.

What we don’t do

No ads, no third-party analytics or tracking tools, and no selling or sharing of your data for marketing.

The AI (Anthropic Claude, and Google Gemini as backup)

To research your goal and to build or change your plan, we send Anthropic’s Claude API what the AI needs: your goal, your answers to the coach, your study time and, for a change, your current plan and progress. When Claude can’t answer, the same goes to Google’s Gemini API instead. Your email address is never sent. The phone app asks your permission before it sends anything to the AI, and you can withdraw it in Account.

Anthropic handles this under its commercial terms and doesn’t use it to train its AI. Google handles what reaches Gemini under the Gemini API terms: on Google’s free tier, Google may use it to improve its products, and people at Google may read it. So don’t put anything in a goal or an answer that you wouldn’t want others to read, such as health details or passwords.

The AI may search the web for your goal to find good resources (Claude’s web search, or Google Search when Gemini answers).

Emails

We send an email only when you ask to reset your password. It goes out through our email provider (Brevo or Resend), which receives your address and the message in order to deliver it. No newsletters, no marketing.

If you report a plan, it is emailed to us through the same provider, with your reason and comment, so we can look into it and improve the AI’s instructions. The server doesn’t keep it, and your email address isn’t in it.

Limits that protect the service

So that one person can’t use up the AI for everyone, the server counts requests per account, per phone (a random number the app makes when it is installed, which says nothing about you) and per network. The counters keep only a short hash of these, never the address itself, and they are gone within a day. They are kept in the server’s memory, or at Upstash (a database service in the United States) so that every instance of the server counts together.

Cookies and storage on your device

• Website cookies: masar_session keeps you signed in (the page’s scripts can’t read it), lang remembers your language, theme light or dark, and tz your time zone, so that “today” is your day. No advertising or tracking cookies.
• Phone app: your plans and settings are in the app’s storage, and your sign-in key in the phone’s secure storage (Keychain or Keystore). The daily reminder is scheduled by the phone itself, with no notification server.

Where your data is

The website and the server run on Vercel; accounts and plans are in a MongoDB Atlas database. Both are in the United States. Like any web host, Vercel keeps short-lived technical logs of requests, such as the IP address and the page asked for.

Every connection is encrypted (HTTPS).

How long we keep it

• Your account and plans: until you delete them. When you delete a plan, its content is erased; a small note that it was deleted (its id and the date) stays, so your other devices delete it too, until you delete your account.
• Sessions: 180 days at most, or until you sign out.
• Password reset links: one hour at most, and gone once used.
• Limit counters: one day at most.
• The day you last used Masar: with your account, until you delete it. The daily totals name nobody, so they stay.

Your choices and rights

• See, change or delete your plans in the app at any time.
• Delete your account under Account → Delete account, or without the app on this website’s /delete-account page: the account, its sessions and every plan saved online are erased at once. Deleting it in the app also clears the plans on that phone; plans kept on another phone stay there until you delete them or the app.
• Ask for a copy of your data, or ask anything about this policy, by writing to us (below).

Children

Masar is made for students. If you are under 13, use it only with a parent’s or guardian’s permission.

Changes

When this policy changes, the date at the top changes with it.

Contact

Write to us at masar.app.planner@gmail.com.