Trust centre

A few companies run parts of Madison on our behalf. Each sees only what its part needs, under a data processing agreement of its own. Those marked “only when switched on” see nothing unless this copy of Madison uses them and you use that feature.

We will update this list before adding anyone new, and a school with a signed agreement is told thirty days ahead.

What you give Madison is not used to train AI models — not by us, and not by Anthropic, whose commercial terms for Claude do not allow it.

Something is sent to Claude only when you ask for one of these, and only then:

• Reading a syllabus or brief: the text of the document, after your device has turned the file into text. The file itself never leaves your device. Claude returns names and dates, each with the sentence it came from and how sure it is, and you choose what to keep.
• Ask Madison: your question, and the term you are looking at written out as plain lines — courses, what is due, grades you entered. Never your email address or anything from another term.
• Planning the week: the week’s items, your fixed hours, your preferences and notes.
• Focus study guides: the notes, slides or pages you hand it for that guide.

Nothing sent to Claude is stored by Madison afterwards; how long Anthropic keeps API data is set by its own retention policy, linked above. Where this copy of Madison has no key for Claude, a rules-based reader runs on your device and nothing is sent at all.

• Your account and plans: for as long as you have the account. Deleting it from Settings removes it and everything saved to it at once.
• Things you delete inside the planner: thirty days in the trash, then gone. Studio pictures you remove: thirty days, then the files go too.
• Daily backups: five days, on your device only, never on our servers.
• Password reset links: forty-five minutes. Sign-in sessions: thirty days, and you can end any of them sooner from Settings.
• Rate-limit counters (hashed, never an address in the clear): a day. Job records and status checks: ninety days.
• Text sent to Claude, files you import: not kept by Madison at all.
• The database host’s own backups: they expire on its schedule, within days.

COPPA. Madison is for people 13 and over. It does not knowingly hold an account for anyone younger, offers no under-13 accounts, and removes one if we learn of it. A school should not invite students under 13.

FERPA. When a US school buys seats, Madison acts as a “school official” with a legitimate educational interest, under the school’s direction, and uses what it holds only to run the planner. Each student’s plan stays theirs: the school sees who has a seat, never what anybody plans. The data processing agreement says this in terms a school can sign.

The Student Privacy Pledge. We intend to apply to sign the Student Privacy Pledge, and already work to its commitments: no selling student data, no advertising, no profiles except for the student’s own use, deletion when asked. We are not a signatory, and will not say so until we are.

Schools, clubs and companies can start from our DPA template: read it, print it, or download it to edit and sign. Write to hello@madisonplanner.app and we will countersign.

Passwords are hashed; signing in can take a second step from an authenticator app or a passkey; every device signed in is listed and can be signed out alone; calendar tokens are sealed at rest. The whole list, mechanism by mechanism, is on the security page, and whether everything is working right now is on the status page.

Madison aims for WCAG 2.2 AA and is honest about where it falls short: the accessibility statement lists what is known.

Found a security problem? Write to hello@madisonplanner.app with “security” in the subject. A person reads it, we will reply within three working days, and we will not take action against anyone reporting in good faith.