Privacy Policy

School Timetable Builder · Last updated: 12 October 2026

In short: the service is built to work without names. You can talk to your AI assistant with real teacher names. The assistant replaces them with codes (T01, T02, …) before anything is sent to us, and you can ask it to show you exactly what it sends. We never receive the names of teachers, pupils or your school. School data is deleted right after each job, and results are deleted within 24 hours. We have no user accounts, no cookies, no tracking and no advertising, we never sell data, and we do not use it to train AI.

1. Who is responsible

The School Timetable Builder (the "service") is a free service run by Theis Wilbek, Denmark (the "operator", "we"). Contact: timetablingengine.support@gmail.com.

2. How the service works

You use the service through an AI assistant (e.g. Claude or ChatGPT). The assistant interviews you and then sends the school's timetable data to our service through a connector. We calculate a timetable and send it back. We never see your conversation with the assistant. Only the data the assistant sends to our tools reaches us. Your conversation is handled by the assistant's provider under its own privacy policy.

3. What data we receive

Data	Purpose	Kept for
Timetable data sent by the assistant: classes and grades, subjects and lessons per week, rooms, the school day, teacher codes (not names) with their subjects and maximum lessons, and fixed blocked times with a short reason.	To check the data and calculate the timetable you asked for.	Input files are deleted as soon as the job is finished. Results and the job record are deleted automatically within 24 hours. A download link expires after 1 hour.
Usage log: time, type of call (e.g. "validate" or "create timetable"), whether the call was refused because of usage limits, a one-way keyed hash of the caller's IP address (the IP address itself is never stored), and the first 80 characters of the caller's software name (e.g. "Claude-User").	To enforce fair-use limits, protect the free service from abuse and measure overall use.	Deleted automatically after 7 days.
Feedback you ask the assistant to pass on to us (your words, the overall tone, and if known the language, country and the job it is about). It contains no IP address. The assistant is instructed to leave out names and other personal data.	To improve the service.	Deleted automatically after 12 months.
Anonymous usage statistics: time, type of call (check or timetable), outcome (e.g. valid, done, impossible) and, if the assistant provides it, the language of the conversation and the school's country. No IP address, no content.	To see how much the service is used and how well it works.	Kept as long as the service runs. It cannot be linked to a person.
Technical logs kept by our hosting providers (e.g. request time and status, error messages).	Operating the service and fixing errors.	Short periods set by the providers (typically a few days).
Support emails you send us.	To answer you.	Deleted when the matter is closed, and at the latest after 12 months.

We do not collect names, email addresses (except when you email us), accounts, passwords, payment details, location, cookies or the content of your conversation.

4. Names stay in your chat

The service is designed so that no names are needed. You can use real teacher names in your conversation with the assistant. The assistant is instructed to:

replace every teacher name with a code (T01, T02, …) before sending anything to us, show you the code list, and keep it in your chat;
put the real names back into the finished timetable in your chat;
never send information about pupils, and never send health or other personal reasons (a blocked time is sent with a neutral reason such as "teaches at another school" or "fixed agreement").

You can ask the assistant at any time to show you exactly what it is about to send. The assistant is software and can make mistakes, so please also:

Do not ask it to send names, ID numbers or contact details of teachers or pupils.
Keep reasons for blocked times neutral (e.g. "teaches at another school", "fixed meeting"). Never enter health information, sick leave or other sensitive information.
Do not enter information about individual pupils.

Because we receive only codes and no school name, we cannot tell who a code belongs to. Only your school can, using the list in your own chat. In GDPR terms the data we receive is minimised and pseudonymised, and it is deleted within 24 hours. If personal data is sent anyway, it is deleted on the same schedule. A school that uses the service is responsible for what it sends.

5. Legal basis

To the extent any data we process counts as personal data (e.g. the hashed IP address, or teacher codes that only the school can link to a person), we process it on the basis of legitimate interest (GDPR Art. 6(1)(f)). The interests are providing the service you asked for, keeping the free service available and preventing abuse. We collect as little as possible and delete it quickly.

6. Who else handles the data

We use these hosting providers as data processors. Everything is stored and processed in the EU:

Supabase (database, file storage and the connector). Region: EU (Paris, France).
Railway (the computer that calculates the timetable). Region: EU (Netherlands).

Both companies are based in the USA. Their data processing agreements include the EU Standard Contractual Clauses in case of access from outside the EU. We do not sell, rent or share data with anyone else, and we do not use it for advertising or to train AI models.

7. Your rights

Under the GDPR you have the right to access, correct and delete personal data about you, to object to processing, and to restrict processing. Because we do not know who our users are, and because data is deleted within 24 hours (the usage log within 7 days), we usually cannot link any data to you. Email us and we will help as far as we can. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the authority in your own country.

8. Children

The service is meant for school staff, not children. It is not directed at children, and pupil data must not be entered.

9. Security

Data is sent over encrypted connections (HTTPS) and stored in private storage that only the service can access. Short storage times limit what could ever be exposed.

10. Changes

We may update this policy. The date at the top shows the latest version. Important changes will be described on this page.