Privacy Policy
Effective October 22, 2026
At a glance
- No account, no data. Your schedule file is read in your browser and your calendar file is made on your device. Neither is sent to a server.
- With an account, Slotted keeps only what it needs to save your schedules and calendar link.
- No ads and no tracking. Slotted only counts visits and calendars made, anonymously. Your information is never sold, shared for marketing, or used to train AI.
- You're in control. Delete your account at any time and everything goes with it.
1. Who runs Slotted
Slotted (slotted.taraskoval.ca) is a free, independent tool made and run by Taras Koval, a student in London, Ontario, Canada. It turns a Western University DraftMySchedule page into calendar events. Slotted isn't affiliated with or endorsed by Western University. In this policy, "Slotted", "I" and "me" refer to Taras Koval, and "you" means anyone who uses Slotted.
2. What Slotted collects
If you use Slotted without an account
Nothing is collected. Your saved schedule page is read by the website in your browser, and your calendar file is created on your device. Neither leaves your device.
If you create an account
| Information | Why it's needed |
|---|---|
| Email address, and your name if you give one | To sign you in and send account emails, such as password resets |
| Password, stored only as an Argon2 hash | To check your password when you sign in. The hash can't be turned back into your password. |
| Saved schedules: each class's course code and title, section, class number, instructor, delivery type, days, times and rooms, plus your settings (terms, reminder, calendar app, colour, lab and tutorial choices, light or dark mode) | So you can open, update and keep using your schedule |
| Your private calendar link, and when your calendar app last checked it | So your calendar app can stay up to date |
| A sign-in cookie | To keep you signed in for up to 30 days. It's the only cookie Slotted sets. |
| A one-time password reset code, stored only as a hash | To let you choose a new password. It expires after 60 minutes. |
If you report a problem
Your message is emailed to Slotted's inbox, along with your browser and device type (for example "Safari on iPhone"), whether you were signed in, and anything you choose to add: your email address and the class list from your schedule. The schedule file itself is never sent; Slotted reads it in your browser and sends only the classes it found, as plain text. Reports aren't stored on Slotted's server.
Usage statistics
To see how many people Slotted helps, it keeps two kinds of anonymous totals:
- Visit statistics, through Cloudflare Web Analytics: which pages are viewed, the website you came from, and your country, browser and device type. It uses no cookies, doesn't build a profile of you, and doesn't track you across other websites.
- A daily count of calendars made: how many calendar files were downloaded and calendar links created each day. Only the daily totals are stored, with nothing about who made them.
Technical information
To protect against abuse, Slotted's server briefly uses your IP address to limit how often the same address can try things like signing in. These counts are kept in memory only and reset within an hour. Slotted's hosting and security providers also handle IP addresses as part of delivering the site (see Service providers).
The website also saves a few small settings in your own browser: your light or dark mode choice, and short-lived notes that only last while a tab is open. These never leave your browser.
3. The browser extension
The optional Slotted for DraftMySchedule extension adds a Send to Slotted button to DraftMySchedule. It only runs on DraftMySchedule's My Current Schedule page and on Slotted itself.
- When you click the button, it copies that one page (your class list, which includes your name) and hands it to the Slotted tab it opens.
- The copy stays in your browser. It's held in the extension's temporary storage and deleted as soon as Slotted takes it, or after 5 minutes if it's never used.
- It's never sent to a server. The extension doesn't read any other page, track your browsing, or collect anything else.
4. Signing in with Google
If you choose "Continue with Google", Slotted asks Google only for your name, email address and an account ID number, and uses them only to create your Slotted account and recognise you when you sign in again. Slotted never sees your Google password and doesn't ask for access to your calendar, contacts, files or anything else.
Slotted's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Slotted's access at any time from your Google Account under Security → Your connections to third-party apps.
5. How information is used
Information is used only to provide Slotted: to sign you in, save your schedules, serve your calendar link, send account emails, answer problem reports, keep the service secure, and count visits and calendars made so Slotted can be improved. Slotted does not:
- show ads, or use cookies or tracking tools to follow you;
- sell, rent or trade your information;
- share it with anyone except the service providers below, who only process it to run Slotted;
- use it to train AI models.
Information may be disclosed only if required by law.
6. Service providers
Slotted relies on a few services to run. Each only receives what it needs for its job.
| Provider | What it does | What it handles |
|---|---|---|
| GitHub Pages | Hosts the website | Standard web request data, such as IP address |
| Cloudflare | Domain, security, the secure connection to Slotted's server, and visit statistics (Web Analytics) | Requests to Slotted's server, including IP address; the visit details listed in section 2 |
| Resend | Sends account emails and problem reports | Email address and the message content |
| Optional Google sign-in; the inbox that receives reports; web fonts | Sign-in details if you use Google; reports you send; IP address when fonts load |
Some of these providers are based outside Canada, so information they handle may be processed in other countries, including the United States.
7. Storage and security
Account information is stored on a server operated by Taras Koval in London, Ontario, Canada. The server isn't directly exposed to the internet; it's reached only through an encrypted Cloudflare connection, and the site is served over HTTPS only. Passwords are hashed with Argon2, calendar links use long random codes, sign-in and reset attempts are rate-limited, and the database is backed up daily. No system is perfectly secure, but Slotted is built to collect as little as possible so there's little to protect.
8. How long it's kept
| Information | Kept until |
|---|---|
| Account, saved schedules and calendar links | You delete them or your account. Removed from backups within 14 days. |
| Sign-in cookie | You sign out, or 30 days pass |
| Password reset codes | Used, or 60 minutes pass |
| Rate-limit counts | Up to one hour, in memory only |
| Extension's copied page | Slotted takes it, or 5 minutes pass |
| Daily totals of calendars made | Kept indefinitely; they contain no personal information |
| Visit statistics | Kept by Cloudflare under its own retention period |
| Problem reports | Kept in Slotted's inbox only as long as needed to fix the problem and reply |
9. Your choices and rights
- See or change your information: sign in to view your saved schedules, rename or update them, or change your settings.
- Delete everything: sign in, open Account at the top of the page, and choose Delete my account. Your account, schedules and calendar links are removed immediately, and from backups within 14 days.
- Turn off a calendar link: you can turn it off or replace it at any time; the old link stops working right away.
- Ask a question or request a copy of your information: email slotted@taraskoval.ca. You'll get a reply within 30 days.
If you're not satisfied with the response, you can contact the Office of the Privacy Commissioner of Canada.
10. Children
Slotted is made for university students and isn't intended for children under 13. Slotted doesn't knowingly collect information from children under 13. If you believe a child has created an account, email slotted@taraskoval.ca and it will be deleted.
11. Changes to this policy
If this policy changes, the new version will be posted on this page with a new effective date. The current version always applies.
12. Contact
Questions about this policy or your information: slotted@taraskoval.ca.