# What is stored and how

| Data | Form |
|---|---|
| USOS access token and its secret | AES-256-GCM with `TOKEN_ENC_KEY`, bound to the user id and the field |
| Calendar address token | 32 random bytes; a SHA-256 hash to look the feed up, and an encrypted copy to show the address on the page |
| Browser session | 32 random bytes in an `HttpOnly`, `SameSite=Lax` cookie for seven days; only its SHA-256 hash is stored |
| Timetable | Plain: course, class type, group, room, building, address, lecturers, times |
| Profile | USOS user id and name |

Only the `studies` and `offline_access` scopes are requested. No e-mail, no personal data, no grades.

- Revoking or reissuing the calendar address replaces the stored hash in one statement; the next request to the old address is answered with 404.
- Sign-out revokes the token in USOS, then deletes the tokens, the calendar address and the sessions. With the checkbox, the user and the timetable are deleted as well.
- When USOS rejects a token, it is deleted; the timetable stays until the user signs out with deletion.
- Nothing is logged per request. Error logs carry the user id and the USOS error message, never a token, a signature or a calendar address. The reverse proxy in front must not log request paths of `/f/`.
- Forms are protected against cross-site requests by the `Sec-Fetch-Site` and `Origin` check of Go's `http.CrossOriginProtection`. A sign-in is bound to the browser that started it by a one-time cookie.
- The page sends `Content-Security-Policy: default-src 'none'` with inline styles only and has no scripts.