Privacy Policy

Last updated August 22, 2026

How ConcordiaTracker collects, uses, and protects your information.

1. Data Collection (Law 25 Compliance)

In compliance with Quebec’s Law 25 (Act respecting the protection of personal information in the private sector), we disclose that we collect:

Identification Email address, display name, and profile picture (via Google OAuth).
Academic Data Course names, assignment titles, weights, due dates, and grades: all entered voluntarily by the user.
Technical Data Our hosting and database providers process your IP address and browser information to keep the service secure and to mitigate abuse. We do not store your IP address ourselves, and it is never used for analytics or advertising.
Usage Statistics Anonymous statistics about how the service is used: see Usage Analytics below for exactly what is and is not recorded.

2. Google OAuth & API Data Usage

We use Google OAuth 2.0 solely for secure authentication. When you sign in with Google, we only request and access your basic profile information: email address, display name, and profile picture. We do not access your Google Drive, Gmail, Calendar, Contacts, or any other Google service data.

Google API Services User Data Policy Compliance ConcordiaTracker’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI / ML Disclosure We do not share, sell, or use information received from Google APIs to train third-party artificial intelligence or machine learning models.

3. How We Use Your Data

Provide grade calculations, GPA projections, and dashboard features.
Send essential service updates and deadline notifications (if opted-in).
Improve application performance and user experience through anonymized analytics.

We do not, and will never, sell your personal or academic data to third parties. Your data is never used for advertising, profiling, or any purpose beyond providing the ConcordiaTracker service.

4. Data Storage & Security

Encryption All data is encrypted in transit (TLS 1.3) and at rest via Supabase PostgreSQL infrastructure.
Row Level Security Database access is enforced per-user via Supabase RLS policies. You can only read and modify your own data.
Payment Info Financial data is handled exclusively by Stripe. We never store credit card numbers on our servers.
Authentication Session tokens are managed by Supabase Auth and are never exposed to client-side JavaScript.

5. Data Retention & Deletion

Your data is retained for as long as your account is active. You may delete your account and all associated data at any time using:

In-app The “Delete Account” button in the Settings page of your dashboard. This immediately and permanently removes all your courses, assignments, grades, notifications, and profile data.
By email Emailing concordiatracker@gmail.com to request manual deletion.

Upon receiving a deletion request via email or our in-app settings, ConcordiaTracker will permanently delete all associated user data from our active databases within 30 days. Backups are automatically rotated and do not retain deleted user data beyond this period.

Primary Support & Data Privacy Contact: concordiatracker@gmail.com

6. Your Rights

Under Quebec’s Law 25 and applicable Canadian privacy legislation, you have the right to:

Access a copy of all personal data we store about you.
Request correction of inaccurate data.
Request complete deletion of your data and account.
Withdraw consent for data processing at any time.

To exercise these rights, contact us at concordiatracker@gmail.com.

7. Third-Party Services

We integrate with the following third-party providers. Each has their own privacy policy:

8. Cookies & Local Storage

We use essential cookies only for session management via Supabase Auth. These cookies are strictly necessary to keep you logged in and do not track your browsing activity. We do not use advertising cookies, and we do not allow any third party to track you across other websites.

We also store a small amount of data in your browser’s local storage: your interface preferences, and the anonymous identifiers described in the Usage Analytics section below. This data stays in your browser, is never shared with third parties, and is cleared when you clear your browser data.

9. Usage Analytics

To understand how the service is used and where to improve it, we collect anonymous usage statistics ourselves. We do not use Google Analytics or any other third-party analytics provider, and no advertising or tracking script runs on this site.

What we record when you visit a page:

Anonymous identifiers two randomly generated ids stored in your browser: one per browser (to distinguish new from returning visitors) and one per tab session (to count how many people are using the site at a given moment). They are random values that identify a browser, not a person, and contain no personal information.
Page visited the general route you viewed (for example, /app/courses). Addresses that contain private links: such as invitation links: are stripped of their unique code before anything is recorded, so those codes are never stored.
Referring website the domain that linked you here (for example, instagram.com): never the full address, which can itself contain personal information.
Campaign tags if you arrived through a tagged link we share (for example, a link posted by a student club), the tag on that link.
Device type whether the screen is phone-sized or desktop-sized.

What we deliberately do not collect: your IP address, your browser or device fingerprint, your location, or any identifier that could link your browsing to you personally or follow you to other websites. If you are signed in, a visit may be associated with your account so we can measure how the product is used; it is never sold, shared, or used to build an advertising profile.

This analytics data is anonymous and stays with us. We will never sell it, share it with advertisers, or use it to track you across the internet.

Retention: activity signals used only to count who is currently online are deleted after 7 days, and page-visit records are deleted after 180 days.

Because these statistics are anonymous, they generally cannot be traced back to you individually. If you have questions about this, or you would like us to stop associating your signed-in account with usage statistics, contact us at concordiatracker@gmail.com and we will action it.

10. Age Requirement

This service is not intended for children under the age of 16. By creating an account, you confirm that you are at least 16 years of age. If we learn that we have collected personal information from a child under 16 without parental consent, we will delete that information immediately.

11. Changes to This Policy

We will notify users of material changes to this Privacy Policy via email or in-app notification at least 14 days before they take effect. Continued use of the service after changes become effective constitutes acceptance of the revised policy.