Privacy notice
This notice summarizes purpose and retention for categories of personal data processed by the platform. It is operational documentation, not legal advice.
Data categories
- Account: email, password hash, session tokens — retained while the account is active; sessions revoked on password reset and email change.
- IP / user-agent: used for rate limiting and abuse prevention; logged only as short hashes in application logs (see trusted proxy docs).
- Analytics: events retained per
ANALYTICS_RETENTION_DAYS; consent choices control identifiable vs anonymous collection. - Audit: security/admin actions retained per
AUDIT_RETENTION_DAYS. - School / gender metadata: optional profile fields for program matching; deleted or anonymized with the account deletion lifecycle.
Full retention table: cookie & analytics preferences and internal docs/security/DATA_LIFECYCLE.md.