Privacy Policy

Your account and plan

The operator's PostgreSQL database stores an opaque account ID, password-derived credential verifiers, encrypted keys, encrypted plans, when the account was created, the encryption nonces your browser has used (so none is used twice), and the session and expiry information needed to operate the service. Login identifiers are encrypted under an operator-owned key and indexed with a separate keyed lookup value. The operator can decrypt identifiers; this protection is against database-only access.

Creating an account requires a Rice email address (@rice.edu) and a 6-digit code sent to it, and each address can hold one account. The code is stored only as a keyed digest and expires after 10 minutes; expired code records are deleted. If the address already has an account, it receives a notice instead of a code. Mail is sent from a dedicated Gmail account over an encrypted connection, so Google handles the address and the message as the mail provider, and a copy stays in that account's Sent folder. Signing in never sends email.

Your courses, grades, transcripts, schedules, programs, interests, notes and private profile fields are encrypted in your browser before account storage or sync. The account key is randomly generated and wrapped under separate password-derived and recovery keys. The server receives a separate derived login secret, never your raw password or private data key.

New signed-out plans last only in the open tab. Unlocked accounts save encrypted local copies.

Encryption and its limits

Keep your offline recovery material safe. Losing both your password and recovery material makes old private content unrecoverable. There is no administrator master key. Resetting authentication alone cannot decrypt an old plan.

Encryption does not hide account relationships, blob sizes, update times or revisions. Weak passwords can be guessed offline against stolen encrypted keys. A compromised device, extension, server-delivered JavaScript or unlocked browser can capture readable content. There is no absolute-security or zero-knowledge guarantee. If Visor is breached or loses data, the Terms of Use set the limits of its responsibility.

Session cookies are secure and inaccessible to JavaScript. Encryption keys remain in memory while unlocked. Lock or sign out when leaving a shared device. Exported JSON and CSV are readable files; keep them private. A JSON export leaves out your rating keys unless you choose to include them, because anyone holding a file that includes them can change or remove your ratings.

Optional course ratings

Ratings are separate from your private plan and require explicit consent. Raw shared submissions are encrypted at rest with a dedicated operator-owned key; the service decrypts them to compute permitted summaries. Shared encryption does not make the submissions private from the operator.

Each Rice email address can rate a course once. Before you rate a course, your signed-in browser asks for one rating token tied to that course code. The service therefore records that your email address has a token for that course, and keeps that record even if you delete and re-create your account, so no address can rate a course twice. The token is blind-signed, so the service never sees the token itself, and the rating is sent without your account, session or cookies: the stored rating carries nothing that names you.

Blind signing does not make a rating untraceable. The operator, or Cloudflare, which carries the traffic, can see when your browser asked for a token and when a rating arrived, and from which network address, and could match the two. Visor sends each rating as soon as you submit it, so that match is easy. A rating saved by an earlier version for a later time is sent the next time Visor is open.

A rating holds the course and only the answers you give: difficulty, weekly hours outside class, enjoyment, whether attendance was required, how the course was graded and the kinds of work. Every question is optional. Ratings carry no grade. You may also leave an optional written response about the course and one about a listed teacher in that course; text alone is enough, and no rating or text field is required. Teacher names come from verified course teaching listings, not proof that you enrolled with that teacher. A shared semester is checked against that listing; an unshared semester stays private. Including your semester is optional. The box starts checked; untick it before you submit to keep your semester private. If you include it, readers can view that semester's ratings on their own, but only after at least three ratings share that semester, and the service withholds any semester figure that, set against the all-semester summary, could single out one or two people.

Written responses are public and readable by the operator. Each shows in its scope, the course or one teacher in that course, from the first one; hidden and removed responses are not shown. A new or changed response appears as soon as it arrives, so someone who notices when it appeared could tell who wrote it. Text appears only across all semesters, with no date, semester, grade or account link; your wording can still identify you. You can edit your review, remove either response immediately, or withdraw the whole review with its saved token. Three distinct signed-in Rice accounts can hide a reported response until the operator reviews it; the service keeps a keyed account-and-response digest to count reporters, not a public reporter list.

A course's summary appears from its first rating, and each new or changed rating counts as soon as it arrives. Removing a rating takes effect at once. While a course has one rating, its summary shows that rating's answers, and someone comparing a course's figures before and after a rating arrives, changes or is removed could work out what it said.

The token stays in your encrypted plan. Submitting again with it edits your rating instead of adding a second one, up to a limit on changes; removing your rating keeps the token so you can rate the course again later. A plan export leaves your tokens out unless you choose to include rating keys in Settings, because anyone with that file could edit or remove your ratings; importing a plan never replaces the tokens already on your device. A token is lost if you lose your plan without a backup that includes it, and a second one is not issued.

Semester views and shared grades require minimum counts; rating summaries and written responses do not. Small groups, network timing and public aggregates can still expose information about a contributor; anonymity is not guaranteed. Grades, transcripts, plans and private profiles do not become shared with ratings.

The server, providers and backups

Visor's database runs on a single server the operator controls, on an encrypted disk volume, and the service is reached only through Cloudflare. The application uses the operator's own PostgreSQL database and does not require Supabase or a paid hosted backend. Its scripts and its one font come from the site itself. Visor does not add analytics, advertising or session recording. Cloudflare's hosting can advertise network-error reporting through NEL and Report-To response headers; supported browsers may send network-error reports to Cloudflare under that configuration. Those platform reports are separate from Visor's application logging. When account registration is open, sign-up mail is sent through Gmail (see above); apart from Gmail and Cloudflare, no other service receives your address.

Cloudflare serves the site and carries every request to the server. Because it terminates HTTPS, it can observe requests and their contents, including email addresses, sign-up codes, session cookies, derived login credentials and shared ratings; private plan requests contain ciphertext. Requests to create an account or sign in reach the server with a value Cloudflare derives from your network address with a secret key, which changes every day; it limits abuse without passing on the address itself, and rating submissions carry no such value. Following an external link uses that site's privacy practices. Visor has no chat or direct messages.

Each night the server makes a backup of the database and the keys it holds (never your password or private data key), encrypted to a key the operator keeps off the server. The last 14 stay on the server, and each is also emailed to Visor's own Gmail account, where it stays until the operator deletes it. A backup holds what the database held that night: private plans in it stay encrypted with your account key, while account addresses in it are readable by the operator, as on the server.

Your choices

Export your plan from Settings → Your data, where you can also import corrected data. Review sharing is a separate choice from saving a plan. Account deletion removes the active account, sessions and private documents at once; backups made before then still hold them, encrypted, until they are deleted. Deleting your account does not remove ratings you shared, because the service cannot find them from your account: remove them from each course page first, while your plan still holds their tokens. The record of which courses your address has rating tokens for is kept after account deletion so one address cannot rate a course twice; it holds keyed digests of your address and the course, not the address or the rating.

Clearing browser storage does not delete server data or exported files. Keep recovery material and encrypted backups before replacing a device.

Questions, corrections or a request about your account: help@visordp.com. Visor never asks for your password or recovery key by email.

An independent planning tool

Visor is independent and unofficial. It is not affiliated with, endorsed by, or operated by Rice University. Planning information can be incomplete or outdated and does not determine your academic standing or eligibility to graduate.

Your official degree audit is DegreeWorks. Confirm degree requirements and registration decisions with your academic advisor and the Office of the Registrar. See the Terms of Use for service limitations.