1 · Browse
Vercel serves public pages, scripts and resource catalogs to your browser over HTTPS.
The service, in three parts
2 · Sign in
Supabase handles Harper accounts. Resend delivers confirmation and recovery emails to your email provider.
3 · Save
Your browser sends saved workspace items to Supabase. Database rules restrict ordinary account access to the owner’s records.
Feedback has a separate delivery path
When configured, the feedback form sends your report through Vercel and Resend to Jenn’s inbox. Cloudflare Turnstile checks for automated abuse. The server fixes the recipient, checks submitted fields and requires verification; a submission receipt confirms acceptance for email delivery, not that the message reached an inbox. An unavailable service or failed submission does not show a success receipt.
Optional Twilio notifications remain off unless credentials and Jenn’s verified recipient are configured. These texts contain only a receipt reference. A short-lived Supabase claim prevents repeated notification attempts; notification failure does not change an accepted email submission. These capabilities are not a claim that delivery has been enabled or verified. See Privacy for provider processing.
Leadership reports have a separate boundary
PDF on your device → browser extraction → your review → optional account save. The report tool reads the original PDF locally. All extracted feedback remaining in the reviewed draft is saved when you choose Save. Remove confidential or identifying third-party comments first. Do not upload material you lack permission to process.
Private and public are different choices
- Private workspace: classes, notes, plans and reflections are owner-restricted through the application. Authorized administrators and providers may still have access. This is not end-to-end encrypted storage.
- Public contributions: approved reviews and published Skills Exchange descriptions can be seen publicly. Listing contacts are available to signed-in Harper accounts, which are not verified Booth identities.
- Your exports: files you download or share are under your control. Check them for private notes before forwarding.
Protections and practical limits
Harper uses HTTPS, account authentication and database access rules. The publishable browser key is not an administrator credential. These measures reduce risk; no service can guarantee that information will never be exposed.
Harper does not replace school systems, verify degree completion or provide school SSO. Source links may require a separate school login. Resource snapshots can become outdated. Access to school content does not automatically permit redistribution.
Archive hides an item and is not permanent deletion. See the Privacy Policy for storage, support and removal requests. Avoid storing highly sensitive information and use a separate password for Harper.
How the architecture is supported
Supabase’s row-level security documentation explains database authorization. Vercel’s shared responsibility model explains why application and data security remain the operator’s responsibility. These documents describe mechanisms, not a certification of Harper.
UChicago’s web policies and standards inform the ongoing review. Harper does not claim institutional approval or full compliance certification.
Report a concern
Email jumanzor@chicagobooth.edu with the affected page and a description. Do not include passwords, sign-in links, codes or another person’s private data. For a suspected school-system incident, contact your school IT team through its official channel.