Privacy Policy

1. Scope and who we are

This Privacy Policy applies to the My Student Desk website, web application, support services, and related features available through mystudentsdesk.com (collectively, the “Service”). “My Student Desk,” “we,” “us,” and “our” refer to the operator of the Service.

This policy does not apply to third-party websites or services that you choose to connect to or visit. Those third parties process information under their own terms and privacy policies.

2. Information we collect

Information you provide

• Account information: name, username, email address, authentication identifiers, and profile preferences.
• Academic information: classes, assignments, grades, GPA information, credits, notes, academic history, goals, schedules, events, and related records you choose to enter.
• Content: documents, attachments, messages, and files you upload or create.
• Support information: support tickets, correspondence, issue details, and feedback.
• Account-management information: account status, closure reason, deactivation date, scheduled deletion date, reactivation date, and lifecycle audit events.

Information collected automatically

• Device, browser, operating system, language, and general connection information.
• IP address, approximate location derived from IP, request timestamps, diagnostic logs, error reports, and security events.
• Usage information such as features opened, actions taken, and session activity needed to operate, secure, and improve the Service.

Connected services

When you connect an optional third-party service, such as Google Calendar, we may receive account identifiers, authorization tokens, calendar information, or other data needed to provide the connection. We access only the permissions you approve, and you may disconnect the integration where the Service provides that option.

3. How we use information

We use information to:

• create, authenticate, maintain, and secure user accounts;
• provide dashboards, classes, notes, grades, calendars, support, notifications, and other requested features;
• save, synchronize, display, and restore user-created academic information;
• send service-related notices, security alerts, and support communications;
• detect abuse, investigate security incidents, prevent fraud, and enforce our Terms;
• diagnose errors, measure reliability, maintain the Service, and improve usability;
• process account closure, reactivation, retention, and deletion requests; and
• comply with applicable legal obligations and valid legal requests.

We do not use your academic content to make official academic decisions on behalf of a school, college, university, employer, or government agency.

4. How information is shared

We do not sell personal information. We may disclose information in the following limited circumstances:

• Service providers: hosting, database, authentication, storage, email-delivery, monitoring, and infrastructure providers that process data for us. Current infrastructure may include Supabase and Netlify.
• Connected services: when you direct us to exchange information with an integration such as Google Calendar.
• Legal and safety reasons: when reasonably necessary to comply with law, respond to valid legal process, protect rights or safety, investigate abuse, or secure the Service.
• Business changes: as part of a merger, financing, reorganization, acquisition, sale of assets, or similar transaction, subject to appropriate confidentiality and legal safeguards.
• With your direction or consent: when you ask us to share information or clearly authorize the disclosure.

Staff access is limited according to assigned roles and permissions and should occur only when needed for support, security, maintenance, or administration.

5. Cookies, session storage, and local storage

The Service uses essential browser storage technologies to maintain authentication, remember preferences, protect sessions, and support application functions. These technologies may include cookies, session storage, and local storage.

We do not currently describe advertising cookies or cross-site behavioral advertising as part of the Service. If analytics, advertising, or other non-essential tracking is introduced, this policy and any required consent controls should be updated before those technologies are enabled.

6. Security

We use administrative, technical, and organizational safeguards designed to protect information. These measures may include encrypted network connections, authentication controls, row-level security, role-based permissions, restricted service credentials, logging, and account-status enforcement.

No system can guarantee absolute security. You are responsible for using a strong password, protecting your sign-in credentials, signing out of shared devices, and promptly reporting suspected unauthorized access.

7. Data retention

We retain information for as long as reasonably necessary to provide the Service, maintain security, resolve disputes, enforce agreements, comply with law, and fulfill the purposes described in this policy.

8. Account closure, recovery, and deletion

During the recovery period

• You cannot normally use the active application while the account is deactivated.
• You may sign in and choose to reactivate before the displayed deadline.
• Successful reactivation restores the account to active status and cancels the pending deletion schedule.

After the recovery period

After the deadline, the account becomes eligible for permanent deletion. The deletion process is designed to remove or anonymize account information and user-created data from active systems, subject to legal obligations, security needs, technical limitations, and temporary backup retention.

A minimal deletion audit record may be retained without academic content, notes, files, grades, or other ordinary profile information. Permanent deletion cannot be undone once completed.

9. Your choices and privacy rights

Depending on where you live and which laws apply, you may have rights to request access, correction, deletion, or a copy of certain personal information, and to appeal or complain about how a request was handled.

• You may update available profile information through the Service.
• You may close and reactivate your account through Account Management during the recovery period.
• You may disconnect optional integrations where that control is available.
• You may contact us to request access, correction, deletion, or information about our processing.

We may need to verify your identity before fulfilling a request. We may deny or limit a request where permitted or required by law, including to protect other users, preserve security, comply with legal obligations, or retain evidence of abuse.

10. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without legally required authorization. If you believe a child under 13 has provided personal information, contact us so we can investigate and take appropriate action.

11. International users

The Service may be operated and hosted in the United States. If you access it from another country, your information may be transferred to, stored in, and processed in the United States or other locations where our service providers operate. Applicable privacy protections may differ from those in your home country.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in the Service, technology, law, or our practices. The “Last updated” date will identify the newest version. When required, we will provide additional notice of material changes.

13. Contact us