Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account registration data: name, institutional email address, password (stored as a salted hash), and user handle.
• Profile information: display name, biography, profile photo, and affiliation details.
• Content you create: research projects, documents, blog posts, comments, and collaboration requests.
• Communications: messages, notifications, and support requests.

1.2 Information Collected Automatically

• Log data: IP address, browser type, pages visited, and timestamps.
• Usage data: features accessed, actions taken, and session duration.
• Device information: operating system and browser version.

2. How We Use Your Information

• To create and manage your account and authenticate your identity.
• To provide, operate, and improve the Service.
• To send transactional emails (email verification, password reset, notifications).
• To enforce our Terms of Service and applicable policies.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

We do not sell your personal information to third parties, and we do not use your data for advertising purposes.

3. Information Sharing

We may share your information only in the following circumstances:

• With your consent: when you explicitly agree to share information.
• Service providers: trusted third parties that help us operate the Service (e.g., cloud infrastructure, email delivery), bound by confidentiality agreements.
• Legal requirements: when required by law, regulation, or valid legal process.
• Safety: to protect the rights, property, or safety of StuVe, our users, or the public.

Your public profile information (display name, handle, public posts, and public projects) is visible to other authenticated users of the platform.

4. Data Storage and Security

Your data is stored on Google Cloud Platform infrastructure within secure, access-controlled environments. We implement industry-standard security measures including:

• Passwords stored using bcrypt hashing with a cost factor of 12.
• Data in transit protected by TLS encryption.
• Files stored in private Google Cloud Storage buckets with signed URL access.
• Rate limiting on authentication endpoints to prevent brute-force attacks.

No method of transmission or storage is 100% secure. We encourage you to use a strong, unique password and to notify us immediately of any suspected security breach.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as dispute resolution.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing of your data.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at privacy@stuve.app.

7. Cookies

We use a single authentication cookie ("next-auth.session-token") to maintain your login session. This cookie is strictly necessary for the Service to function. We do not use tracking or advertising cookies.

8. Children's Privacy

The Service is intended for university students and researchers with verified institutional email addresses. We do not knowingly collect information from individuals under the age of 13. If we become aware that we have inadvertently collected such information, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at: privacy@stuve.app