Security

A syllabus or a brief is opened on your device and turned into text there. Only that text is sent to be read, to Anthropic’s Claude, and only to be read: it returns names and dates, and nothing about the document is kept afterwards. When the reader cannot be reached, a rules-based one runs on your device and nothing is sent at all.

Your plan is stored under your own login and shown only to you. Your browser keeps a working copy so the planner opens instantly and works offline. A save that conflicts with one from another device is merged, not clobbered.

One cookie keeps you logged in. It holds a signed token and nothing about you. Passwords are stored hashed, never as typed. While you are signing in, a short-lived cookie carries the step you are on (the second step, a passkey’s challenge, a round trip to Google) and expires within minutes.

Turn on two-step sign-in in Settings and a password alone is no longer enough: signing in also asks for a code from an authenticator app. Its secret is sealed at rest, a code works once, and ten recovery codes, stored only as keyed hashes, each work once if the phone is lost. Guessing is limited per account, whichever addresses it comes from.

A passkey signs you in with your face, fingerprint or screen lock instead. It is checked against the site’s own address, so it cannot be phished, and a key that seems to have been copied is refused. Google, and where switched on Apple and Microsoft, can sign you in too: their signed answer is verified against their published keys, and an address is matched to an existing account only when the provider vouches for it.

Settings lists every device signed in to your account, and any one of them can be signed out on its own; “Log out everywhere” ends them all.

Subscribing in your calendar hands out a private address. The token in it is the whole credential, which is the only thing a calendar app can carry, so it is 24 random bytes, it is never indexed, a wrong one answers a flat 404, and a new address kills the old one everywhere. Turning it off is one row in Settings.

When you add a Canvas, Moodle, Blackboard or Google calendar, Madison fetches it for you, because a browser cannot. The fetch is https only, the address is checked against private network ranges before every redirect hop, it stops after 12 seconds or 4 megabytes, and nothing is stored.

A push from Madison has no payload. The device wakes, asks Madison what to say using your own login, and says that. Nothing about your week passes through a push service, not even encrypted. The only cryptography involved is the signature that proves to the push service who is knocking.

A shared term is a read-only page: the weeks, what is due, what is done, and nothing else. No account, no notes, no way into Madison from it, and it is marked not to be indexed. It stops existing the moment the link is turned off or replaced.

A server error or a page crash is reported with the message, the top of the stack and the path it happened on. Never your name, your address or anything from your plan. Scheduled jobs are recorded, whoever runs Madison is alerted when one keeps failing, and the status page shows ninety days of checks and every incident written up.

No advertising, no analytics scripts, no third-party trackers. The only outside services are the ones that run a part of Madison, each seeing only what its part needs; they are listed in the privacy policy.

Export a JSON backup of any term or a calendar file whenever you like, paid or not. Delete the account from Settings and the account, every plan saved to it and every link you made go at once. Things deleted inside the planner wait thirty days in the trash, in case, then go.

Write to hello@madisonplanner.app with what you found and how to see it. A person reads it and will reply.