When you text koala, we store your phone number and the messages you send us, so koala can reply and remember what you asked for. When you paste a Brightspace calendar link, we store that link and the deadlines it contains, and we re-read it a few times a day to keep your calendar current. If you sign in through koala, it also reads whether you've turned things in (the submission status and time, so it can count them for you); it never reads your grades, your feedback, or the files themselves. If you choose to give koala more (a forwarded course email, a study-pack request), we store that material under your account so it can be used for your reminders and study guides. If you buy big koala, our payment processor (Stripe) handles your card; we only receive confirmation that you paid and an identifier for your purchase.
We do not collect your school password. koala never asks for it. Calendar links from Brightspace contain a token that is unique to you; treat it like a password and only share it with koala directly.
| what | kept? | readable by |
|---|---|---|
| your phone number, the texts you send koala, your plan | yes | the two founders |
| your deadlines (title, course, due date, a link) | yes | the two founders, and anyone you give your calendar link to |
| your Brightspace calendar link and, if you sign in through koala, your Brightspace session | yes, encrypted on disk | the founders can decrypt it; it's what lets koala read your course pages |
| syllabus photos, slides, assignment pages, announcements | big koala only, free accounts keep just the deadlines found in them | the two founders |
| emails you forward | no, we keep the deadlines and a one-line note of where each came from, then discard the message | , |
| your school password | never asked for, never stored | , |
Plainly: koala is not end-to-end encrypted, and no service that has to read your course material to work could be. Course content is encrypted in transit and the disk it sits on is encrypted, but the people who run koala can read it, the same way the people who run Quizlet or Notion can read what you upload there. We look only to fix something you've reported or to keep the service running, and never to grade, judge, or share. If you'd rather we never hold course material at all, stay on the free tier: you still get every deadline and the morning text.
To find your deadlines, put them on your calendar, text you before they're due, and, if you ask, write a study guide from the course material you've provided. We use the content to serve you and to fix bugs. We don't use it to train models, and we don't build profiles for advertising.
koala runs on a few services that process data on our behalf: Twilio delivers text messages; OpenAI's (or Anthropic's) API reads your texts to understand them, and course material to extract deadlines and write study guides, neither trains on your data; Stripe processes payments; Cloudflare and our hosting provider serve the website and store the database. Each sees only what it needs to do its job. We don't sell your data and we don't share it with your school, your professors, or anyone else, unless the law requires us to.
By texting koala you agree to receive recurring automated text messages about your deadlines at the number you texted from. Message frequency varies, typically one morning message a day, plus reminders on the schedule you set. Message and data rates may apply. Reply STOP at any time to stop, or HELP for help. Consent to texting is not a condition of any purchase.
You opt in by texting LOCK IN (or any first message) to koala's number, by scanning the QR code on our site or flyers, or by entering your number on lockinkoala.com and ticking the consent box, in which case koala texts you once asking you to reply YES, and nothing else is sent until you do. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.
The fast setup opens a window that shows Vanderbilt's real Okta sign-in page, the same one you use for Brightspace. You type your password into Vanderbilt's page, not ours, and you approve the Okta Verify push on your phone as usual. koala never sees, asks for, or stores the password. What koala keeps is the session Vanderbilt hands back afterwards (the same thing your browser keeps so you don't have to log in every page), encrypted, so it can read your calendar and, if you allow it, your Gradescope. Sessions expire on their own after roughly a day; koala then only has the calendar link it saved.
To revoke: text delete to koala (removes the session and everything else immediately), or sign out of all devices in your Vanderbilt Okta settings, which invalidates koala's session along with every other one.
We keep your data while you use koala. Text STOP to stop all messages. To delete your account and everything stored under it, text delete to koala and confirm, it's immediate. Or email hello@lockinkoala.com and we'll remove it within 7 days. Backups are purged on a rolling 30-day cycle.
Data is encrypted in transit and the server disk is encrypted. Your Brightspace session and any sign-in tokens are additionally encrypted with a key kept outside the database. Calendar, study-pack and email-forwarding links are protected by long random tokens that only you receive. Access to the servers is limited to the two people who run koala. No system is perfect; if you believe your data has been exposed, email us and we'll tell you what we know.
koala is for college students aged 18 or older. If you're under 18, don't text koala; if we learn we've stored a minor's data, we'll delete it.
If this policy changes in a way that matters, koala will text you once. Questions: hello@lockinkoala.com.
koala is made in Nashville, Tennessee, and is not affiliated with Vanderbilt University, D2L, Gradescope, or zyBooks.