Privacy at MakeItSo

When you create an account and use MakeItSo, we store:

• Account: your name, your email address, a one-way hash of your password (never the password itself), when your email was verified, and a session counter that lets you sign out on every device.
• Profile: the majors and minors, graduation year, first term, class standing and career interests you choose, whether you finished onboarding, and when you turned AI features on and confirmed you are 18 or older.
• Your plan: the courses you add (term, course, credits and a status such as planned or completed), your WebTree list, the deadlines and summer activities you enter, and plan suggestions you asked for. We never store grades.
• Security records: one-time email codes and password-reset links (stored only as a hash), and short-lived counters that limit sign-in and sign-up attempts. Those counters hold your IP address or a hash of your email address.
• From the earlier version of MakeItSo: if you used the hackathon version, the plan you saved there, and the profile fields it kept on your account (a short bio, your year, career interests, a picture address and a credit total), are kept (read-only) so they can be carried over. So are the career goals you entered there and the AI answers it generated for you (course plans, career plans and course recommendations). All of these are in your download and deleted with your account. That version also saved cold-email drafts under your name only, not linked to your account, so we cannot find them reliably: ask us (see Contact) and we will delete them.

Signing in sets three cookies from the sign-in library: the session cookie, which keeps you signed in for up to 14 days, a security token that protects the sign-in form, and the page to return to after signing in. Your light or dark theme choice is saved in your own browser. There are no advertising or analytics trackers, and our fonts are served by MakeItSo itself.

Email: once email verification is turned on, verification and password-reset emails are sent through Resend, an email delivery service, which receives your email address and the message (including its one-time code or reset link). MakeItSo sends no other email.

MakeItSo is not an approved Davidson tool for Internal or Restricted college data. Please do not paste Degree Works reports, Moodle content or other college records into it.

Course, catalog, rating and event information comes from public sources (Davidson's public course schedule and catalog, RateMyProfessors, and public campus feeds), and every item is labelled with its source.

MakeItSo's AI features (course summaries, plan suggestions, career plans and cold-email drafts) use Claude, a model made by Anthropic. They are off until you turn them on in your profile, which asks you to confirm that you are 18 or older, and they need an @davidson.edu account. For now, while email verification is being set up, the address does not have to be verified yet, except for cold-email drafts, which need a verified one. You can turn them off again at any time.

When you use an AI feature, MakeItSo sends Anthropic only what that feature needs:

• course codes and public catalog information;
• the courses in your plan and which requirements they fill, your majors and minors, graduation year and career interests;
• the goal or question you type into that feature.

It never sends your name, your email address, your account id or any grades. Cold-email drafts use a placeholder that your browser fills in with your name after the draft comes back. Anthropic handles these requests under its commercial API terms and privacy policy. AI answers are marked "AI · verify with your advisor".

The alumni directory lists only people confirmed as Davidson alumni from public sources, such as Davidson College publications and news, and employer or organization websites. Each fact shown (class year, major, role, organization) has at least one source other than LinkedIn; a LinkedIn profile address is typed in by hand and never fetched by MakeItSo. We keep only name, class year, majors, role, organization, the date that role was checked, the LinkedIn address, related career paths, whether a cold email is appropriate, and the sources. No location, biography or contact details.

The directory is visible only to signed-in students with a verified @davidson.edu address. Every entry says where it came from and when it was checked. If you are listed and want to be removed or corrected, contact us (below) and we will remove or fix the entry.

Account, profile, plan

Until you delete your account.

Your AI results

Saved for you for 30 days, then deleted. Shared course summaries contain no personal information.

Email codes and reset links

Work for 15 minutes (a reset link once). The record (only a hash of the code and link) is deleted automatically 24 hours after it was sent.

Unverified sign-ups

Once email verification is available: if a sign-up was emailed a code and is still not verified 24 hours later, a new sign-up with the same address can replace it, and the old account's data is deleted. A sign-up that was never sent a code is never replaced.

Rate-limit counters

Only for their time window: 15 minutes to one day. A streak of failed sign-ins is forgotten 24 hours after the last failure.

Campus feed items

Public events and news are kept for 60 days.

Our hosting provider keeps short-lived technical request logs to run the service.

• Download my data on your profile gives you a JSON file of everything MakeItSo stores about you (up to 5 times a day), except the earlier version's cold-email drafts described above.
• Delete account asks for your password, then immediately deletes your account and everything tied to it: profile, plan, AI results, codes and counters, and the earlier version's plan, career goals and AI answers (for its cold-email drafts, ask us). This cannot be undone.
• Turn off AI features and sign out everywhere are on your profile too.

Questions, removal or correction requests: reach the people who run MakeItSo through the MakeItSo project on GitHub. Please do not post your password, email address or other private details in a public issue: ask for a private way to get in touch instead.