NU Map Privacy Policy

NU Map can optionally connect to Claude (Anthropic's AI assistant) so it can help you plan. This is off by default and only activates after you explicitly approve the connection inside NU Map — either by entering a pairing code, or by approving the request that appears when you connect from Claude. If you never link Claude, nothing in this section applies to you and no connection to our server is ever made.

• You choose the scope. When approving, you can pick catalog only: Claude can search public course and program data but your plan is never shared. Full access can be granted, paused, or reduced later in settings at any time.
• What is shared: if you grant plan access, your active plan (course placements, work-experience entries, selected programs, and related plan settings) is synced to the NU Map connector server (mcp.numap.app) so Claude can answer questions about it. It contains no name, email, or account identifier — NU Map has no accounts. Nothing else on your device is accessed.
• Where it lives: the server runs on Cloudflare's infrastructure. Your plan snapshot is held per-session so that only conversations you have linked can read it, and is used for no other purpose.
• Changes need your approval: by default Claude can only propose plan changes, which you review and approve inside NU Map. Direct application of changes is a separate opt-in you control in settings.
• Pause and delete: the settings toggle pauses all plan access instantly. Disconnect severs the link, deletes your plan snapshot from the server, and revokes the credentials held by connected Claude clients, so previously linked conversations lose access immediately.
• Your conversations with Claude happen on Anthropic's platform and are governed by Anthropic's privacy policy. NU Map never sees your conversations — only the specific tool requests Claude makes on your behalf.

NU Map can ask what a course actually cost you — roughly how many hours a week it took, and how hard it felt — so that the next student can see it before they register. This is the only part of NU Map where something you write is pooled with other people's answers rather than sent somewhere you chose. It is off until you turn it on, you are asked once before anything is ever sent, and you can stop at any time in settings.

• Grades are never part of this. The review panel shows your grade beside the two rating questions because it is convenient to fill in together, but the grade goes only to your own plan, in your browser. It is not transmitted with a rating, and there is no code path that could send it.
• A rating carries three things and nothing else: the course, the hours figure, and the difficulty figure — plus the instructor and term if you supply them. There is no name, no email, no account (NU Map has none), and no device or session identifier.
• No clock. The finest time information stored is which term the course was taken in. Nothing records when you filled the form in.
• Your ratings are not linked to each other. Each one is sent separately, in a shuffled order, with a token derived per course from a secret that never leaves your device. Two ratings from the same person cannot be joined back together into that person's course history — by anyone, including us. This matters more than it sounds: a full list of the courses somebody took identifies them far better than a name does.
• Only aggregates are ever published. Individual answers are never shown. A course's figures appear only once at least five people have answered, and below ten responses only a coarse band is shown, never a number — because an average and a spread published together for a very small group can be solved backwards into the individual answers.
• Published figures are frozen between updates. A course's number does not move until at least five further responses have arrived. Without this, comparing two updates would reveal a single new person's exact answer by subtraction.
• You can change your mind. Clearing a rating in NU Map removes it from your device, and the per-course token lets that withdrawal be honoured in the pooled data.

Every claim above is a property of code you can read: the rules live in src/core/courseRatings.js and src/core/ratingStore.js, and they are enforced by tests that deliberately try to break them.

NU Map has no accounts and no analytics, which means that when it breaks for everybody, nobody finds out. That is not hypothetical: on 20 August 2026 a bug made the app fail to start for every visitor, every automated test passed, every page still answered normally, and it was noticed only because somebody happened to open it. As more people rely on NU Map, "we find out by accident" stops being good enough.

So NU Map may send one tiny message per page load saying whether it managed to start. It is not analytics and it cannot be turned into analytics: it carries no identifier of any kind — no account, no session, no cookie, no random id — so two of these messages cannot be recognised as coming from the same browser, or the same person, by us or by anyone reading the logs. We deliberately give up being able to count how many people use NU Map in exchange for that.

A message carries six things and nothing else:

• whether the app started, or which of eight ways it failed — chosen from a fixed list, never free text, so an error message that happened to mention a course or a file can never travel with it;
• how far it got: the page, the program code, the course data, or the planner;
• roughly how long that took, rounded into a band such as "under 2 seconds" — never an exact number, because an exact timing is itself a way to recognise a device;
• which version of NU Map was running, so a bad release can be identified and undone;
• which browser family it was — Chrome-like, Safari-like or Firefox-like — with the version and device model removed in your browser, before anything is sent;
• a number saying which version of this message format it is.

There is no plan, no course, no grade, no program, no page address, no language, no screen size, no location and no clock reading from your device.

At NU Map's current size every page load sends one of these. As more people use it that will change to a sample — a fraction of loads chosen at random — because the server that receives them has a daily limit. Either way it makes no difference to what a message contains or to whether it can be traced to you: it cannot, because there is nothing in it to trace.

Like the course-ratings rules, every claim here is a property of code you can read — src/core/healthBeacon.js — and is enforced by tests that deliberately try to smuggle a plan, a file path, an email address and a session id through it (test/contract/health-beacon-privacy.test.js).