Who operates Harper
Harper is an independent, student-built guide and planning tool operated by Jenn Umanzor. It is not an official University of Chicago or Chicago Booth service. Privacy questions and requests can be sent to jumanzor@chicagobooth.edu.
Information used by the service
- Browsing: the hosting provider receives ordinary request information such as IP address, browser information and requested pages to serve and secure the site. Provider log and backup retention can differ from the records visible in your account.
- Account: email address, authentication records and profile details you supply, such as preferred name and interests. Supabase handles authentication. Do not use your school password as your Harper password.
- Private workspace: saved classes, clubs, links, schedules, recruiting plans, values, reflections and notes you choose to save. Some fields autosave after editing while signed in; watch the save status.
- Leadership reports: the current report tool reads a selected PDF in your browser. The original PDF is not uploaded by that tool. Extracted ratings and written feedback are added to a draft automatically. You can edit or remove them; all feedback remaining in the reviewed draft, together with your plan, is sent to your account when you save. Remove other people’s identifying or confidential information first, and use only material you are entitled to process.
- Community contributions: class reviews, listing descriptions, display names and contact details you submit. Publication and audience differ from private workspace storage, as explained below.
- Optional coffee-chat reminders: when delivery is enabled and you opt in, Harper stores your selected chat time, reminder intervals and delivery status in your private account. Reminders go only to your confirmed account email through Resend and contain a generic prompt and tracker link, not your private conversation notes. You can turn them off. A message already in delivery may still arrive. The controls state when email reminders are unavailable; saving a contact alone never enables them.
- Support: information you choose to send by email or through the feedback form, including your selections, comments, page path and optional reply email. When direct submission is enabled, Vercel processes the report and Resend sends it to Jenn’s email inbox. Cloudflare Turnstile processes browser and network signals to check for automated abuse. Opening the form loads that verification only when configured. If submission is unavailable, the form says so and offers a copy-and-email fallback. Please allow 1–3 business days for a response.
Why information is used
To operate accounts, save and restore your work, provide suggestions from explicit choices, show permitted community contributions, deliver account emails and investigate problems. The inspected recommendation feature uses rules based on interests, saved courses and selected values; it does not automatically analyze private reflections. The reviewed report parser does not call a generative AI service. AI-assisted development is separate from these runtime features.
Who can see it
Workspace data is intended to be available only to its account owner through the application. Authorized administrators and service providers may have access needed to operate the service; this is not end-to-end encrypted storage.
Approved class reviews are public. Text you submit can identify you even when your account ID is not published. Published Skills Exchange listings are public; their designated contact details are available to signed-in Harper accounts. A Harper account does not establish Booth affiliation. Publishing means others may copy information, and withdrawing it cannot recall copies already made.
Vercel hosts the website; Supabase supplies authentication and database storage; Resend delivers account emails. Your email provider receives those messages. If direct feedback is enabled, Resend and Jenn’s email provider also receive the report. Optional SMS notifications, when separately configured, use Twilio to send Jenn only a feedback receipt reference, not your report text or reply address. Twilio and the mobile carrier process the recipient number and notification; The existing Supabase database stores a hashed receipt claim to avoid duplicate notification attempts. Claims expire after 48 hours and are removed on a later notification attempt. This describes optional processing, not confirmation that direct feedback or SMS is currently enabled. The form reports submission availability. Support correspondence remains in the receiving mailbox subject to its retention and removal practices; provider logs and backups may have separate retention. Opening an external school, event or resource link takes you to that provider’s policies. Exported files are stored wherever you choose to save or share them.
Availability links
Find a Time keeps an unfinished draft in this browser tab’s session storage. When you choose to share, the link contains your selected times, optional location labels, plan title and any When2meet link you attach. Anyone with the link can read that snapshot and forward it. Editing your draft does not update or revoke a link already shared. Do not include details you would not want recipients to retain.
Harper does not read your calendar or publish a class roster through this tool. When2meet is a separate service; its own privacy practices govern responses entered there. Locations are plans you choose to share, not device location tracking.
Browser storage and analytics
Browser storage supports sign-in and may retain drafts or preferences. Sign out on shared devices. Harper measures usage with Vercel Web Analytics: which pages are viewed and which features are used (for example a bulletin filter or a course area), counted in aggregate. It sets no cookies. Vercel derives a visitor identifier from request data that is hashed and changes daily, so it is not linked to your account, name or email, and no typed text is recorded. Hosting logs still exist. You can turn measurement off for this browser here: Browsers that send the Global Privacy Control signal are not measured. If an offline calendar copy is available, event details are also stored on your device. Sign out and use the device’s clear-site-data controls on shared devices.
Retention and your choices
You can edit or archive supported workspace items. Archiving is reversible and is not permanent deletion. Contact Jenn to request access, correction, export or deletion; identity may need to be verified. Saved records remain until they are removed; automatic age-based deletion is not currently promised. Requests are handled manually, and completion will be confirmed after the relevant systems are checked. Archiving alone does not start an erasure process. Do not send passwords or sign-in codes. Provider logs, backups, published copies and exported files need separate handling.
Security and changes
Harper uses encrypted web connections and account access controls. These reduce risk but do not guarantee security. Report suspected exposure to the contact above without including secret tokens. Material changes to data practices will be described here before taking effect.