Privacy Policy

Last updated September 26, 2026

How ConcordiaTracker collects, uses, and protects your information. This page describes what the product actually does.

1. What We Collect (Law 25)

In compliance with Quebec’s Law 25 (Act respecting the protection of personal information in the private sector), this is everything ConcordiaTracker collects:

• Account Your email address, display name and profile picture. You sign in with Google, with Apple, or with an email and password. A password is stored only as a secure hash by our authentication provider; we never see it. If you use Apple’s “Hide My Email”, we receive Apple’s relay address, and Apple shares your name only on your first sign-in.
• Profile What you choose to add: a handle, a bio, links, your program, school and year of study, and your privacy settings.
• Academic data Your courses, assessments, weights, due dates, grades, notes, tasks and schedules, your record of finished courses, and any instructor or TA contact details you enter.
• Syllabus uploads The files you upload and what we extract from them. See sections 5 and 7.
• Messages and social activity Direct messages you send and receive (their text, and anything you attach, such as a snapshot of your schedule or record), reactions, read receipts (as your settings allow), follows, blocks, short notes, club memberships, comments, likes, reposts, which stories you viewed, schedule-sharing permissions you grant, and your notifications.
• Support and feedback Support tickets (your email, name, and every message in the conversation; for requests sent from our help pages without signing in, also your browser’s user-agent string), bug reports (your email and what you wrote), feature requests and comments, survey answers, course-data corrections, access requests, and the reason you give if you cancel or delete your account.
• Payments Your Stripe customer and subscription identifiers, plan, subscription status, amounts and renewal dates. Card numbers are entered on Stripe and never reach us.
• Connected services If you connect Moodle: your Moodle calendar link, stored so that nobody, including you, can read it back, and the deadlines it contains (title, due date, course code and description). If you turn on calendar sync: your private feed link, and when a calendar app last fetched it, including that app’s user-agent string.
• Devices and IP addresses While you are signed in, our authentication provider keeps each session with its IP address and browser user-agent string. We keep a copy of your past sessions (IP address, user agent, first and last seen) for 90 days, so Settings → Devices can show where your account has been used. You can see this list, and so can ConcordiaTracker administrators.
• Push notifications If you allow them: your device’s push address and keys, and the browser’s user-agent string.
• Usage analytics See section 9 for exactly what is recorded, and how to turn it off.

2. Google and Apple Sign-In

We use Google OAuth 2.0 and Sign in with Apple solely for authentication. With Google we request only your email address, display name and profile picture; with Apple, your email address (or relay address) and name. We do not access your Google Drive, Gmail, Calendar, Contacts, or any other Google or Apple service data.

Google API Services User Data Policy Compliance ConcordiaTracker’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI / ML Disclosure We do not share, sell, or use information received from Google APIs to train third-party artificial intelligence or machine learning models.

3. How We Use Your Data

• Provide the service: grade calculations, GPA projections, deadlines, planning, messaging and clubs.
• Read the syllabi you upload, using Google’s Gemini AI service (section 7).
• Send the emails the service needs: renewal notices, replies to your support requests, and club invitations.
• Understand how the product is used and improve it (section 9).
• Answer support requests and keep the service safe.

We do not, and will never, sell your personal or academic data. Your data is never used for advertising or shared with advertisers.

4. Security and Who Can See Your Data

• Encryption All data is encrypted in transit (TLS) and at rest by our database provider, Supabase.
• Access rules Database rules limit your private data (courses, grades, tasks, settings) to you. Anything you share is visible to the people you share it with: messages to their recipients, a public profile to anyone, posts and comments to their audience, and your schedule to the people you grant it to.
• Clubs Messages you send to a club, and its replies, are visible to every active member of that club’s team.
• Administrators ConcordiaTracker administrators can access account data to provide support and keep the service safe. This includes your profile and plan, courses and grades, support tickets and bug reports, the device and IP history described above, failed syllabus uploads, and every message sent to or from any club. Administrators do not have an in-app view of direct messages between two people.
• Automated support assistant Our support assistant can read and answer support tickets and bug reports, and can open a failed syllabus upload only while it waits for review. What it sends is logged.
• Sign-in session Your sign-in session is kept in your browser’s storage by Supabase Auth and is readable by ConcordiaTracker’s own page code, as with most web sign-ins.
• Payments Payment details are handled by Stripe. We never store card numbers.

5. Data Retention and Deletion

Your data is kept while your account is active. You can delete your account at any time:

• In the app Settings → Account → Delete account. Deletion is immediate and permanent. It cancels any subscription first, then removes your profile, courses, assessments, grades, tasks, messages, follows, notes, notifications that name you, support tickets and every message in them, bug reports, survey answers, course reviews and outlines you shared, device and IP history, analytics records, sign-up attribution, connected Moodle and calendar links, push subscriptions, API keys, and your uploaded files.
• By email Email concordiatracker@gmail.com from the address on your account. We carry out the same deletion within 30 days.

What remains after deletion identifies no one: a count of deleted accounts per day and plan; the reason you chose, if you gave one, kept as a category and plan only, without any text you typed or any link to you; and usage statistics with the link to your account removed. Posts and events you published on behalf of a club stay with that club without your name, and images the club still displays stay with it.

What we do not control: Stripe keeps its own records of past payments, as financial law requires. Our email provider, Resend, keeps logs of emails it sent under its own retention. Our database provider’s backups are replaced on a rolling basis, so deleted data can remain in a backup for up to 30 days before it is overwritten; backups are not used to restore individual accounts.

Syllabus files you upload are read to extract your course schedule, then stored privately for up to 30 days so that, if the result was wrong or the file could not be read, we can read it again and fix your course for you. The files are not public and are not shown to other users. Administrators may open a stored file to review it by hand, and the support assistant may open one only while it is a failed upload waiting for that review. Stored files are deleted automatically 30 days after upload. A record that the upload happened (the file name, the date, and whether it could be read) stays with your account until you delete it.

• Page-visit records 180 days. Short “who is online now” signals: 7 days.
• Product analytics events 13 months.
• Email delivery records 180 days.
• Cancellation and deletion reasons 2 years, without any link to you once your account is deleted.
• Device and IP history 90 days.
• Uploaded syllabus files 30 days.

These periods are enforced by an automatic job that runs daily. Until September 26, 2026 the automatic deletion of page-visit records had never run, so page views recorded before that date were kept longer than stated. The job now runs every day, and records past these periods are deleted.

Primary Support & Data Privacy Contact: concordiatracker@gmail.com

6. Your Rights

Under Quebec’s Law 25 and applicable Canadian privacy legislation, you have the right to:

• Access a copy of the personal data we hold about you.
• Request correction of inaccurate data.
• Delete your account and data (section 5).
• Withdraw consent to optional processing: turn off usage analytics in Settings → Privacy at any time (section 9).

To exercise these rights, contact us at concordiatracker@gmail.com.

7. Third-Party Services

We rely on these providers. Each has its own privacy policy:

• Supabase (Database, authentication, file storage)
• Vercel (Hosting, Web Analytics, Speed Insights)
• Google (Sign-in, and Gemini AI for reading syllabi)
• Apple (Sign in with Apple)
• Stripe (Payments)
• Resend (Transactional email)

• Google Gemini When you upload a syllabus, its text (or, if the text cannot be read, the file itself) is sent to Google’s Gemini API to extract your assessments and dates.
• Moodle If you connect Moodle, our server fetches your Moodle calendar link from Concordia’s Moodle once a day to import your deadlines.
• Loaded by your browser Pages load fonts from Google Fonts, profile pictures from Google, some club images from image hosts such as ImgBB, and the weather widget from Open-Meteo. These providers receive your IP address as part of the request. Push notifications are delivered through your browser’s push service (for example Google, Apple or Mozilla).

8. Cookies and Browser Storage

• ct_ref (cookie, 30 days) Set when you arrive through one of our short links (such as /r, /ig, /li or /qr). It holds only the name of that link, so we can tell which one brought a visit or a sign-up.
• __stripe_mid, __stripe_sid (cookies, 1 year and 30 minutes) Set by Stripe when the checkout loads, for fraud prevention.
• Sign-in session (browser storage) Kept by Supabase Auth so you stay signed in.
• Other browser storage Your interface preferences, the analytics identifiers and first-visit record described in section 9, and conveniences such as recent searches. This stays in your browser and is cleared when you clear your browser data.

We do not use advertising cookies, and we do not let any third party track you across other websites.

9. Usage Analytics

We measure how the service is used in three ways.

1. Page visits (our own). When you open a page we record: two random identifiers kept in your browser (one per browser, one per tab session); the general route you viewed, with invitation codes and other private links stripped out; the website that linked you (its domain only); campaign tags on the link; whether the screen is phone- or desktop-sized; and the short-link name from the ct_ref cookie. If you are signed in, the visit is linked to your account unless you turn analytics off.

2. Vercel Web Analytics and Speed Insights. Our hosting provider records page views and page-loading performance. Before anything is sent we remove query strings and private codes from page addresses, and referring addresses are limited to the site’s domain. Vercel derives an approximate country from your IP address; it does not give us your IP address.

3. Product analytics (signed-in accounts). We record:

• How you found us from your first visit: campaign tags, the referring domain, the page you landed on, and the channel we derive from them, saved to your account when you sign up.
• Getting started when you finish setup, add your first course, and complete your first assessment.
• Features you use quick links, outline previews and imports, syllabus uploads, club follows, the notifications panel, calendar sync and Moodle, at most once per feature per day.
• Club invitations whether an invitation was sent, opened, claimed, and led to an active club.
• Email whether each email we send was delivered, and, where our email provider’s tracking is enabled, opened or clicked, by type of email. We do not store the address, subject, or links.
• Syllabus reading whether each upload was read successfully, and a category for any failure.
• Weekly activity whether you used the service in a given week, grouped by the week you signed up.
• Leaving when a subscription is cancelled or an account is deleted, and the reason you give, if any.

Product analytics never include your grades, the text of your messages, file contents, passwords, or codes from private links. They are used only to improve the service and are never sold or shared with advertisers.

Turning analytics off Settings → Privacy → “Share how I use ConcordiaTracker”. When you turn it off we stop recording product analytics for your account, delete what we had already recorded and your sign-up attribution, and stop linking your page visits to your account. Pages you open are still counted anonymously, as a signed-out visitor’s are.

10. Age Requirement

This service is not intended for children under the age of 16. By creating an account, you confirm that you are at least 16 years of age. If we learn that we have collected personal information from a child under 16 without parental consent, we will delete that information immediately.

11. Changes to This Policy

Material changes to this policy are announced in the app and take effect when posted. The date at the top of this page shows when it last changed.