What's kept, who sees it, and how it goes away.

• Instructors: your email address, your time zone (for dates in downloads), and the sign-up sheets you create.
• Class lists: each student's name and email address — nothing else. When an instructor uploads a Canvas export, every other column (grades, activity, IDs) is discarded on the spot and never saved.
• Rankings: each student's order of days, any day they said they can't do, and any note they wrote for their instructor.
• The schedule, once the instructor makes it.
• Earlier versions of each sheet, kept so an instructor can undo mistakes.

• Each instructor sees only their own sheets. No other instructor can open them, and the site has no screen that shows one instructor's sheets to anyone else — including the person who runs the site.
• Students see their own ranking, and their own day once the schedule is published. If the instructor turns it on, signed-in students in the same class can also see everyone's names and days — but never anyone's notes, can't-do days, or who hasn't ranked.
• The person who runs this site sees only site-wide totals (how many sheets and students, how many emails were sent today). Like anyone operating a database, they could technically read it directly in the hosting provider's console; they don't, and the site itself offers no way to.

There are no passwords. You get a one-time code by email; students without an email on the class list choose a PIN instead, which is stored scrambled. A single cookie keeps you signed in on that browser for up to 90 days (or 20 minutes of inactivity, if you tick “shared computer”). There's no tracking, no advertising, and no analytics. Fonts load from Google Fonts.

So students can find their own name, after someone with the sign-up's link types three letters, up to five matching names from that class list appear. Email addresses are never shown.

Sign-in codes are emailed by WorkOS, a sign-in service, from workos.dev, on this site's behalf. WorkOS keeps a record of each address it sends a code to only until that person signs in (the site then deletes it), and for a day at most. An instructor can also have WorkOS email their class an invitation to sign in. WorkOS keeps a record of each invitation (the address it went to), and has no way to delete one, so the site cancels each once it's used. When those can't reach a student, their instructor can send them a sign-in link from the instructor's own email instead: the site writes the message, and it goes out through the instructor's own email account, not through this site.

Instructors can also get a backup of a sheet by email (for example, when they close sign-ups); a backup holds the class list, rankings and notes, and goes only to that instructor's own address.

While sign-ups are open, an instructor gets a few short emails about how they're going: when half the class has ranked, when nine in ten have, if a week passes with nobody ranking, and two days before the deadline. Each says how many have ranked and names up to 12 students who haven't yet (never their rankings or notes), and goes only to that instructor's own address. Any reminder to those students is sent by the instructor, from their own email. One switch on the sheet's Settings turns these emails off.

An instructor can bring a course's class list over from Canvas, signed in to Canvas the usual way. The site never sees a Canvas or school password, and never changes anything in Canvas.

• Canvas's student file (downloaded from Canvas, then chosen here): it comes to this site as soon as the instructor chooses it. Only names and email addresses are kept; everything else in it, such as grades, activity and Canvas's grades file beside it, is thrown away as the file is read, and never saved.
• Scheduler Helper (a Chrome extension, if the instructor adds it): when the instructor presses “Import class list” here, it asks their school's Canvas for their list of courses, then for the students in the course they pick, and hands this page each student's name and email address. The first time, Chrome asks the instructor to let it read their school's Canvas site; until then it can read no website at all. It reads nothing else, does nothing when not asked, and sends nothing anywhere but this page. It keeps nothing: it has no storage at all, so not the class list, not the course, not anyone's Canvas sign-in. Once the list is in, it offers to delete itself. More about it.
• Whichever way, this site keeps only the names and email addresses, as the sheet's class list. Not which Canvas course they came from, its number, or which school's Canvas: the instructor's own browser remembers the sheet's Canvas course, so updating the list later is one press, and nothing about it is kept here.
• A sheet's first class list goes straight onto the sheet, where the instructor can fix or remove anyone. A list that would change one the sheet already has waits for them to look it over (the names and emails here, the course's name only in the instructor's own browser session), and is deleted within a day if they don't. Once added, it's part of the sheet's class list, kept as described here.

• A sheet stays until its instructor deletes it. A deleted sheet can be brought back for 30 days, then it's gone for good.
• Sign-in codes expire after 30 minutes, and the one-click link in a student's code email works once, within a day. Records used to limit how many emails are sent hold scrambled addresses, not real ones, and are erased after two days.
• Earlier versions of a sheet are capped per sheet; older ones are removed automatically.

The site runs on Vercel, the data is stored in a Supabase (Postgres) database, and sign-in codes are emailed by WorkOS (backups and other emails to instructors go through Gmail). Everything travels encrypted (HTTPS).

A class's short link (for a slide or the board) is made by spoo.me, a free, open-source link shortener with no ads: it knows the class's link, which only opens the sign-in page, and nothing about who is in the class. The full link works without it.

The site keeps only what it needs: names, email addresses, rankings and notes. If your school has rules about student information in outside tools (in the US, for example, FERPA), check with your school before using it.

Students: ask your instructor. Anything about the site itself: schedulerlottery@gmail.com.