Privacy policy

Last updated 20 October 2026

Jabal Helper works without an account. If you make one, it keeps as little as it can. It never asks for your student ID, your KFUPM password or your Banner login, and it cannot see your registration.

Without an account

Your plan (term, courses, sections, locks and preferences) and your light or dark choice are saved in your own browser, in local storage. They do not leave your device unless you copy a share link, which carries the plan after the # in the address, a part browsers never send to any server. Clearing your browser data removes them.

With an account

An account is optional. It keeps:

• Your email address, to sign you in and send the emails below.
• Your password, hashed: stored in a form nobody can turn back into the password, including me.
• If you use Google, that your account is linked to a Google account, and Google's number for it. Google offers the site your email, name and photo; the site keeps only the email and that number, and never shares or sells either.
• Whether your email is confirmed, and when the account was made.
• One sign-in record per device you are signed in on, until you sign out or it goes 30 days unused.

No names, photos, phone numbers or browser details are kept. The features you use keep what they need: your saved plans, your grades, your SEP plan (its terms, courses and your major, never the name or ID it is pasted with), the sections on your radar, the Telegram chat its alerts go to, and your open swaps with your yes to sharing them.

A swap stays private. Only when it matches do the students in that trade get your Telegram handle and the section you are giving, and it is deleted as it matches or when you withdraw it.

How it is protected

• Everything travels encrypted, including between the site and its database.
• The database provider encrypts its disks.
• Only the site's own server can read the database. Its public access is switched off for every table.
• Plans, grades, SEP plans and Telegram chats are also encrypted by the site with its own key before they are stored, so a copy of the database on its own shows none of them.
• To slow down password guessing, the site counts sign-in attempts from each internet (IP) address. Those counts are deleted after a day.

Where it is kept

Accounts are stored by Supabase in Mumbai, India, and the site's server code runs on Vercel, also in Mumbai. Both are outside Saudi Arabia.

Emails

The site sends only account emails: confirming your address, choosing a new password, and a note if someone tries to sign up with an email that already has an account. They come from hello@kfupmhelper.com. No newsletters and no marketing.

Cookies

Signing in sets a few cookies that keep you signed in, and Google sign-in uses one for a few minutes while it finishes. The analytics below set none. None are used for advertising.

Deleting your account

Delete account, on your Account page, removes your account and everything saved with it at once. The site's database plan keeps no backups, so nothing lingers.

What the server handles

When you add a course, this site asks the public KFUPM Banner class search for that department, then caches the result for about fifteen minutes so everyone is served the same copy. Instructor email addresses and internal Banner IDs are discarded before anything reaches your browser.

The site is hosted on Vercel, which keeps standard server logs including IP addresses for a limited period as part of running and protecting the service. See the Vercel privacy notice for details.

Analytics

The site counts visits with Vercel Web Analytics, from Vercel, which hosts it. For each page opened it records the page's address with nothing after it, so no reset link or shared plan ever reaches it, along with the site you came from, your rough location, and your browser, system and device type. It sets no cookies and is not tied to you or your IP address: a visit is told apart only by a code made from the request, which is thrown away after 24 hours. The numbers are only ever seen added up, never per person. A tracker blocker stops it without changing anything else on the site.

Google Analytics is built into the site too, but it is switched off. If it is ever switched on, this page will say so first.

The contact form

If you write to me through the contact page, your name, email address and message are delivered to me through a third party form service, and are used only to reply to you. I do not add you to any mailing list.

Your rights

Under the Saudi Personal Data Protection Law you can ask what personal data is held about you, ask for it to be corrected, and ask for it to be deleted. Your Account page shows what the site keeps about you and deletes it in one step. For anything else, write to hello@kfupmhelper.com and I will respond within three business days.

Children

This site is built for university students and is not directed at children under thirteen.

Changes

If this policy changes, the date at the top changes with it. Material changes will be noted on the planner itself.