We schedule your staff from codes, not names.

Privacy mode

Privacy mode is designed for teams with sensitive rosters, such as universities scheduling student workers. It is on for every workspace.

• Pseudonymous IDs. Every person on the roster gets a random, stable pseudonym such as “Staff K7Q2”. Rules, availability, events and schedules refer to people only by these pseudonyms, and that is how SchedSolver’s servers receive them, together with the attributes needed to schedule (roles, hour limits, wages and your custom columns), plus your events, rules, setup answers and notes, with roster names replaced by codes.
• A separate name key. Direct identifiers, meaning real names, student and employee IDs (including NetIDs and badge numbers), email addresses, phone numbers and birthdates, are moved into a name key that is kept in your browser’s local storage on your computer. You can download it as its own file and store it wherever your organization keeps sensitive records. SchedSolver never needs it. It is uploaded only if you turn on key sync, and then only as a copy encrypted in your browser with a passphrase we never see.
• IDs stay on your computer. When a spreadsheet has a student ID, employee number, NetID, birthdate, Social Security number or home address column, the import screen marks it “Private: keep on this computer”. Those values go into the name key and are used only in your browser, for example to match next week’s availability file (keyed by student ID) to the right person. Staff codes sent to us are random and never derived from an ID. You can mark any other column private too. If a rule needs an age limit, a birthdate becomes one yes/no fact (“under 21”, as of the import day) and the date itself is not sent.
• See it before it is sent. The first time a new kind of file is imported, “What we will see” shows the exact rows that will be sent, with names and private values shown as codes such as Staff K7Q2. Columns that look like IDs but are not marked private are highlighted with a one-click “Keep private”. You confirm before anything is saved. Known files show a one-line summary instead.
• Real names only on your screen. When the key is loaded, the app shows real names locally. Without it, the app shows pseudonyms. Loading the key file on another computer restores the names there.
• Imports. “Anonymize on import” turns a roster spreadsheet into pseudonyms in the browser, so names are not stored in the workspace. Availability and event files that use names are matched through the key, locally.
• Exports. You choose an anonymized export or a full backup. Schedules and messages you send to your own staff are generated in your browser with real names, for your use.
• Support files. “Share with SchedSolver support” always produces an anonymized file and shows you exactly what is in it. Nothing is sent automatically.
• Reading your words. SchedSolver reads your setup description and interview turns to design your engine, in every setup. Once the engine is built, schedules are computed by our own solver. In weekly use SchedSolver also reads a spreadsheet layout the app’s own reader cannot map, a typed change the app’s own parser could not follow, a typed correction about attached files that the app’s own reader could not follow, a rule described in the rule picker when its own word search cannot place it, and, if the manager asks, writes a short note on what to look at in a finished schedule. All five use only coded text. In detail, the service provider listed under Subprocessors receives: your setup description and interview answers, after your browser removes roster names, email addresses, phone numbers and ID numbers and our server removes contact details, ID numbers and birthdates again; short turns of the setup guide, redacted the same way; when you type what changed and the built-in reader cannot follow the sentence, that sentence with people, events and other names replaced by codes (P1, E1, U1) and contact details and ID numbers removed, plus your role names and your upcoming event and rule labels treated the same way; when you type a correction about files you attached and the built-in reader cannot follow it, that sentence with names replaced by codes the same way, plus the files’ column headers, the cell marks the reader could not read and the words they use for roles, leaving out any header or mark that holds a name on your roster or in the files, and never the rows themselves; what was read is shown back to you and changes nothing until you say yes; when you describe a rule in the rule picker and its own word search cannot place it (a sentence, or words that no kind of rule holds), that text with names replaced by codes and contact details and ID numbers removed, to list the closest kinds for you to pick from; for the written note on a schedule check, the check’s numbers, flag labels and rule ids; and, if you ask for help reading a spreadsheet, its headers and a few rows with names, IDs, birthdates and contact details replaced by codes such as Person1 and ID1. In our back office, drafting your engine uses your pseudonymous rule set, your notes to us and your feedback, redacted the same way. Names typed in free text before your roster exists are not removed, so please describe people by role. These requests never include your roster file or name key.

Pseudonymous is not anonymous. Removing names and IDs does not make data anonymous. Schedule patterns, roles, hour limits and combinations of classes or availability can sometimes identify a person to someone who knows the team. So we treat pseudonymous data as personal data: we collect only what scheduling needs, limit who can access it, delete it on request, never sell it, and do not describe it as anonymous. Privacy mode reduces what SchedSolver holds; it does not replace your own policies.

Where your data lives

On your computer: the name key (real names, student and employee IDs, emails, phone numbers, birthdates and any column you marked private), plus a cached copy of your pseudonymous workspace so the app opens quickly.

On SchedSolver’s servers: your account (email address and a salted hash of your password), your organization and its members, and your workspace: engine rules, events, availability, schedules and the pseudonymous roster (roles, hour limits, wages and your custom columns), plus your setup description and answers, your conversation with SchedSolver, and feedback and notes you send us, with roster names replaced by codes. This is where schedules are computed, with the open-source solvers HiGHS and OR-Tools CP-SAT. In privacy mode this data contains codes instead of roster names and IDs; names you type in free text can still appear in it. The name key is never uploaded in readable form; with key sync turned on, only an end-to-end encrypted copy is stored.

What touches the network

• Loading the app. Your browser downloads the app’s code from our host, like any website.
• Fonts. This website serves its font (Inter, under the SIL Open Font License) from our own host. No third party is contacted to show you this page.
• Voice input (optional). If you speak instead of typing, your browser’s speech service (for example Google in Chrome) hears the audio.
• Your workspace. Saved to your SchedSolver account as you work, pseudonymous only, over HTTPS.
• Building a schedule. SchedSolver’s servers solve the saved, pseudonymous week and send back the schedule. Your browser puts the real names back for display.
• Reading your words (every setup). The redacted setup description and guide turns, “what changed” sentences with names replaced by codes, schedule-check numbers, and for import help a few spreadsheet rows with names, IDs and contacts replaced by codes. See Privacy mode above.
• Emailing us. Only what you choose to write or attach.

Export and delete

Use Export in the app to download a .schedsolver.json file containing your entire workspace, anytime, even after your pilot ends. Delete workspace removes your rules, roster, weeks and setup; delete the organization to remove its activity log too. To close your account, use Delete account in Account settings.

Your workspace is saved to your account, so you can sign in from another computer. Real names appear there only after you load your name key file on that computer.

Teammates and shared computers

Invite teammates from the app and choose their role (viewer, scheduler or admin). They see pseudonyms until you give them your name key file yourself. On a shared computer, sign out when you are done and remove the name key from that browser.

During the pilot

To help tune your rules, we may ask you to share a sample week. Use “Share with SchedSolver support” in the app, which always produces an anonymized file. We delete anything you send us when the pilot ends, or sooner if you ask.

Subprocessors

These are the outside services involved in running SchedSolver, and what each one can see.

We keep this list current. A data processing agreement (DPA) is available on request.

Location and retention

• Where data is stored: [TO CONFIRM: United States].
• Workspace data is kept while your account is active. Deleting your account (in Account settings) or your organization removes it right away, and we delete it when you ask. Each saved week keeps its latest schedule result; results of individual solve jobs are kept for 30 days.
• Engine requests: when we build or change your engine, the request, including any drafted rule set, is stored with it so we can review it.
• Demo sandboxes are deleted automatically after 24 hours.
• Backups: a snapshot is taken every day and kept for 14 days. Data you delete leaves the backups as they rotate out, within 14 days.

If something goes wrong

If we learn of a security incident that affects your data, we will notify affected customers without undue delay, tell you what happened and what we know about its scope, and keep you updated as we learn more.

Student employees and FERPA

Schedules for student workers, especially work-study and student-only jobs, can be education records under FERPA. We never assume student staff data is outside FERPA: we treat it as regulated by default. When a school uses SchedSolver, we act as a school official with a legitimate educational interest or as a service provider under the institution’s direct control, as your agreement sets out. We use the data only to provide the service to you and do not disclose it to anyone else except the subprocessors listed above.

In privacy mode, SchedSolver’s servers receive no student names from your roster, and no student IDs, email addresses, phone numbers or birthdates. A name typed in free text can get through, so describe students by role. They see staff codes and the scheduling details you choose to include. Because pseudonymous data can still identify a student in context, we handle it with the same care. Your privacy office can review this page with us, and we are glad to sign your institution’s data agreement where it fits.

Questions

Security questionnaire or privacy review from your institution? We are glad to fill it in and to walk your privacy office through privacy mode. We do not currently hold third-party security certifications. Contact us. See also our privacy policy.