Privacy
What we keep, and what we don't
Last updated October 22, 2026
CourseComments is a student project for BYU-Idaho students to share honest reviews of classes. We collect as little as we can, and we never sell or share your data for advertising. Here's exactly what happens to it.
The short version
- We don't store your email address. We keep a scrambled code made from it, just enough to recognize you next time.
- Your reviews never show your name or email. Other students and admins see the review, not who wrote it.
- There are no passwords, no ads, and no tracking cookies. The only cookie keeps you signed in. We count visits with a cookieless tool that can't tell who you are.
- You can delete any of your reviews at any time from My reviews.
Signing in
You sign in with your @byui.edu email address. We email you a 6-digit code, and entering it proves the address is yours. That's how we know reviews come from real BYU-Idaho students.
We use your address once, to send the code. What we save is a keyed hash of it: a scrambled string made with a secret key that only our server has. It can't be turned back into your address, and it can't be matched against a list of addresses without that key. When you sign in again, we scramble the address you type the same way and look for a match.
The code email is delivered by Resend, an email delivery service. Like any email provider, Resend handles your address to deliver the message and keeps delivery records under its own privacy policy. Sign-in codes expire after 15 minutes, and we delete our records of them within about a day.
Your reviews
A review holds your ratings, what you wrote, any tags, grade, and attendance you chose, which class and semester it's about, and the month you posted it. That's what other students see. Your name and email are never shown, and we don't have them to show.
We do keep which account wrote each review. That's how we allow one review per class, let you see and delete your own reviews, and deal with abuse. Admins approve every review before it goes live, and the admin pages don't show who wrote it. Someone with direct access to both our database and our secret key could check whether a particular email address has an account, so we limit that access to the people who run the site.
When you delete a review, it's removed from the database right away. Reviews that admins reject or take down are kept, hidden, so we have a record of moderation decisions.
Reports and feedback
When you report a review, we save the reason and any note you add, linked to your account so one person can't report the same review over and over. When you send feedback, we save your message and the page you were on. If you're signed in, it's linked to your account. If you're not, we save a scrambled version of your IP address instead, only to limit how many messages can be sent. Admins see whether feedback came from a signed-in student, but not who.
Cookies
We set one cookie: a random sign-in token, so you stay signed in. It can't be read by scripts on the page, and it expires after 30 days (12 hours for admins). Signing out deletes it, along with our record of it. We don't use advertising or tracking cookies of any kind.
Visit counts
To see how many people use the site and how quickly pages load, we use Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser. When you open a page, your browser sends Cloudflare, through our own web address, the page's address (including anything you searched for), your browser type, and how long the page took to load, tagged with a random number that changes on every page. That means your visits can't be linked to each other or to your account. We only see totals, like page views per day.
Security records
Like any website, our server sees your IP address when you visit. We don't store it. For sign-in attempts and signed-out feedback, we keep a scrambled version for rate limits. Our security log records events like sign-ins, failed sign-in attempts, and moderation decisions, by account ID only, never by email address.
Professors
Professor names, titles, and departments come from BYU-Idaho's public faculty directory. Which classes each professor teaches in a semester comes from BYU-Idaho's class schedule; we keep only the instructor's name as the schedule lists it (which can include a middle name) and the courses, not times, rooms, or enrollment. We don't collect photos, biographies, email addresses, or phone numbers. If you're a professor with a concern about your listing or a review, see how we handle takedown requests.
Where it's kept
The site and its database run on a server we rent from Oracle Cloud in the United States. Every visit passes through Cloudflare, which protects the site from attacks. Like any network provider, Cloudflare handles your IP address and the pages you request to deliver them, under its own privacy policy. Neither company gets anything from us beyond that and the visit counts above.
Keeping it safe
Pages are protected against common web attacks, everything you send is checked on our server, and only admins can approve or remove content. Backups of the database are kept for disaster recovery and replaced over time.
Your choices
- Delete any of your reviews from My reviews.
- To delete your account entirely, contact us through the feedback form while signed in, and we'll remove it and everything tied to it.
- Questions about your data? Reach us through the feedback form.
Changes
If we start handling data differently (for example, adding AI summaries of reviews), we'll update this page and the date at the top before the change goes live.