Effective: June 10, 2026 · Developer: Adam Hamza · Contact: adam.socials346@gmail.com
Vextal ("the app", "we") is a free dashboard for student life developed by Adam Hamza. This policy explains exactly what data the app touches, where it lives, and what control you have. The short version: your school password never touches our servers, your grades are encrypted when cached, guests are never tracked or stored, and we sell nothing to anyone.
Google account basics (signed-in users): when you sign in with Google we receive your name, email address, and profile picture from Google's identity service. These are stored in your browser and, together with your dashboard preferences, in a profile record in our database so your setup follows you across devices.
Aspen portal credentials: your Aspen username and password are stored only in your own browser, on your device. When you sync, they are transmitted over HTTPS to our server, used in memory for a single login to your district's Aspen portal, and discarded immediately. They are never written to any database, log, or file — encrypted or otherwise.
Academic data (grades, assignments, schedules, GPA): retrieved from your district's Aspen portal at your request, displayed to you, cached in your browser, and cached on our server encrypted with AES-256-GCM so repeat visits load instantly without re-fetching.
Preferences: layout, colors, and settings — stored in your browser and in your profile record when signed in. Optional phone number stays on your device only. Optional school email is used solely to pre-select your district account for school integrations.
Location (optional): used for live local weather and to identify your school district's portal. Coordinates are sent to the Open-Meteo weather service and are not stored by us. If you deny location access, the app continues with simulated weather — nothing breaks.
Bank data (Finances module, optional): bank linking is performed by Plaid. We never see or store your bank username or password; our server holds Plaid's access token and shows you balances.
Guests: if you don't sign in, nothing persists. Settings live in memory for the visit and every refresh starts from a clean slate.
We do not sell, rent, or share your personal data with advertisers or data brokers. We show no ads. We do not read your email or files. We request only the minimum Google scopes needed for sign-in (name, email, picture) and — only if you connect it — read-only access to your own Google Classroom coursework.
Google (sign-in, and Classroom when connected) · Supabase (encrypted data storage) · Railway (backend hosting) · Cloudflare (site hosting & DNS) · Open-Meteo (weather) · Plaid (bank linking) · Follett Aspen (your district's grade portal, accessed on your behalf). Each processes only what is necessary for its function under its own privacy policy.
Vextal is intended for students aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has used Vextal with personal data, contact us and we will delete it.
In the app, Profile → REMOVE ACCOUNT wipes every trace from your device (session, credentials, cached grades, settings). To delete your server-side profile record and encrypted academic cache, email adam.socials346@gmail.com from your account email and it will be removed within 30 days. You may also request a copy of your stored data.
All traffic is HTTPS. Cached academic data is sealed with AES-256-GCM. Credentials follow a memory-only, never-stored design. No system is perfectly secure, but minimizing what we keep is the core of how Vextal is built.
If this policy changes, the effective date above changes with it; material changes will be noted in the app. Questions: adam.socials346@gmail.com.
VEXTAL · DEVELOPED BY ADAM HAMZA · TERMS OF SERVICE