Privacy policy

Who provides UTLife

UTLife is an independent app owned and operated by Edward Hongwei Liu, an individual developer. Peiyuan (Steven) Guo is one of UTLife's primary developers. UTLife is not affiliated with or endorsed by the University of Toronto.

For privacy questions or data requests, contact us:

Stored on this device

• Your language, appearance, and campus-updates preferences.
• The buildings you viewed most recently.
• The building codes you scanned.
• Your Pomodoro tasks, notes, timer settings, active session, and focus history. These stay on this device and are removed by Clear local data.
• The timetable you chose to import, after it has been converted into class times and rooms, and your personal events, including editable device-calendar imports. Schedule sharing is a separate, optional choice.
• A randomly generated session identifier that is not tied to you.

Your Community account

If you join Community, your email and sign-in credentials are handled by Supabase Auth. Your username, display name, profile picture, and selected campus are stored with your Community account so the same profile appears on every device where you sign in. Community posts and comments, including their public username and profile picture, can be read without an account. Account blocking limits signed-in interactions but does not prevent someone from reading public content after signing out. Your email and verification records are not part of the public profile.

Timetable imports

iCalendar files are read and converted on your device. Calendar access can be granted during setup or later. Permission alone does not import events: each confirmed import reads selected device calendars for the next 12 months and replaces earlier device-calendar imports and edits to those copies. Other app events and timetables stay unchanged. The app never writes changes to source calendars. Device-calendar imports do not refresh automatically. Imported titles, times, locations, and notes are stored on this device. Imported events start private; you can opt in to sharing eligible events individually.

PDF import is a legacy feature no longer offered in the interface. Existing PDF timetables remain usable. Older app versions may still send PDFs over an encrypted connection to the authenticated timetable parser, which processes them in memory and returns only extracted class data without saving the document.

Connected Google and Outlook calendars

Connecting a calendar is optional and requires an account. If you connect Google Calendar, UTLife requests read-only access to events on calendars you own and reads events from your primary calendar, so you can see them alongside your timetable. If you connect Outlook, UTLife requests read-only access to basic event details and reads your primary calendar. UTLife does not create, change, or delete events in either provider.

The service requests events for the next 12 months. Google may return other event details in its response, such as descriptions and attachment metadata; UTLife selects and stores an account-linked snapshot of event identifiers, titles, dates and times, all-day status, time zones, and locations. Times are normalized to UTC. Event descriptions and attachments are not stored. Supabase hosts and processes the connected-calendar data for the service. The snapshot is accessible to the signed-in account and is not included in schedule sharing. A successful sync replaces the previous snapshot.

Provider access and refresh tokens are encrypted on the server and used to maintain the connection and retrieve events. Automatic synchronization starts when you connect. In Calendar accounts, you can turn it off, sync manually, or disconnect. If automatic sync is off, the last snapshot can remain until you refresh or disconnect. Disconnect removes the stored provider tokens and event snapshot from the active database; you can also separately revoke access through your Google or Microsoft account. Copies may remain in backups after deletion from the active database.

UTLife's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Sharing a timetable

Schedule sharing is off by default and is independent of live location sharing. After signing in, you can confirm that the calendar belongs to your account and publish imported class names, times, rooms, and recurrence dates. Newly imported device-calendar events are private by default. You can opt in individually to share events whose location contains a recognized two- or three-letter campus building code. Previously imported events keep their sharing settings until you import again. These events are published only when schedule sharing is enabled, and only to mutual friends you explicitly select. Shared fields include the event title, time, and recognized building or room; notes, original calendar files, and manually created personal events are excluded.

When this device is linked to your publication, local edits, ICS import, and device calendar import update it while signed in to the same account, preserving its selected recipients. Device calendar import also removes stale shared events. If an update fails, the previous published version remains available; Schedule sharing shows the error and offers a retry. Publishing a replacement resets the recipient list. Signing out does not withdraw an already published calendar.

Stop sharing deletes the server copy and recipient permissions. Blocking or unfollowing removes the affected permission, and following again does not restore it. Readers must be online to open a shared timetable; permission is checked on every read. While the view is open, the app refreshes access periodically and clears it on leaving the screen or changing accounts. Information someone already viewed cannot be recalled.

When signed in, Clear local data first deletes that account's shared timetable and requires a successful server response. When signed out, it clears only this device; sign in to stop an existing publication.

Anonymous usage analytics

When the app is connected to a campus content service, it records anonymous events: opening the app, scanning a QR code, viewing a building, running a search, opening a map marker, opening a nearby building, and starting directions. Each event stores the event type, the campus, the building where one applies, the random session identifier, and the platform name.

What analytics never include

Analytics do not include your name, contact details, an account, device location, device identifiers, or the text you type into the search box. Search events record only that a search happened, how long the term was, and how many buildings matched.

Camera

The camera runs only while the Scan screen is open and is used only to read QR codes. The QR scanner does not record, store, or upload photos or video. You can refuse camera access and keep using search, the map, and building guides.

The campus map

On iPhone and Android the campus map is drawn by the device's map service — Apple Maps on iOS and Google Maps on Android — which loads map imagery over the network under that provider's own privacy terms. The app does not send the map service your identity, your scan history, or the buildings you viewed. The web version uses a built-in diagram and contacts no map service.

Current location

Choosing the location button shows your position on Map without uploading it. Sharing is a separate, explicit choice: open Sharing with friends from Profile or the location-sharing shortcut on Map, select mutual friends, then turn on Live location. Sharing stays enabled until you turn it off. Sharing also includes positions outside campus.

On iPhone and Android an explicitly started session continues while minimized or locked, with the iOS location indicator or Android foreground-service status. Map displays an existing sharing session and lets you Stop sharing at any time. Web shares only while open. Denying sharing permissions does not prevent ordinary guide browsing.

The service holds one reduced-precision point per account, rounded to approximately 11 metres, with no location history. Each location expires within 90 seconds of the reported observation, even while sharing remains enabled. Network or operating-system limits can pause updates; stale positions disappear rather than being shown as live.

Stop disables new uploads locally before network cleanup. A request already sent can finish, and recipients’ cached points expire independently. Sign-out, loss of the last eligible recipient, or account restrictions revoke server sharing. Your sharing setting survives app restarts on iPhone and Android; reopening validates and resumes an enabled session. Temporary interruptions pause location updates while preserving that setting.

Encrypted login and consent metadata use device-bound storage accessible after the first unlock so authentication can refresh while the phone is locked. Coordinates remain in memory and are excluded from analytics. UTLife does not request Always location access or Android background-location permission for this user-initiated service.

Leaving the app

Choosing directions opens Apple Maps or Google Maps, and opening an official website leaves the app for your browser. Those destinations are governed by their own privacy terms.

Your choices

Settings lets you clear your imported timetable, recently viewed buildings, and scan history from this device, change or refuse camera, location, and photo-library access through your system settings, and choose your language and appearance. When signed in, Profile lets you change or remove your Community display name, username, and picture, and choose exactly which mutual friends may receive your location during an explicit sharing session.