DeAnzaCompassPrivacy Policy
DeAnzaCompass is an unofficial planning tool for De Anza College students. It is intended for users in the United States only.
1. Information we collect
| Category | What | Source |
|---|---|---|
| Education information | Degree program, catalog year, GPA, units required and applied; for each course: code, title, grade, units, term, status, repeat flag | You (extension or PDF) |
| Identifiers | Email address (accounts); a random guest ID stored in a cookie | You / generated |
| Account credentials (sensitive personal information under the CPRA) | Password, stored only as a hash by our authentication provider; or your Google sign-in identity | You / Google |
| Your settings | Pinned items, saved course choices, selected program, certificate and agreement | You |
| Internet activity | Page views and performance data (Vercel Analytics); server logs including IP address and browser type, kept by our host | Automatically |
| Consent record | Which version of the Terms you accepted and when | You |
What the import does and doesn't send. The Chrome extension reads the Degree Works page only when you click “Import this audit.” It parses the page in your browser and sends us only the education information above.
A PDF you upload may contain your name and student ID. We receive the whole file, process it in memory to extract only the fields above, and do not store the file, your name, or your student ID. We never ask for your Degree Works password.
2. How we use it
To compute your remaining requirements and eligibility; to keep your plan between visits; to sign you in and send account emails; and to secure, debug and maintain the service.
We do not sell or share your personal information, do not use it for advertising or profiling, and do not use it to train AI models. Data received through the extension is used only to provide the user-facing import feature (our Chrome Web Store Limited Use commitment).
3. Cookies and Do Not Track
The dc_profile cookie (guest identifier, 1 year, httpOnly) and Supabase session cookies are strictly necessary. We use no advertising or cross-site tracking cookies.
Because we do not track you across sites, we treat all visitors the same and do not respond differently to Do Not Track signals.
4. Who receives data
Service providers process data for us: Vercel (hosting, analytics), Supabase (database, authentication), Upstash (temporary cache of computed results) and TODO: email provider (account emails).
If you choose Google sign-in, Google receives your sign-in and handles it under its own privacy policy (policies.google.com/privacy).
We may disclose information to comply with law, to protect rights, safety or security, with your consent, or in a merger, sale or transfer of the project. In a transfer we will require the new owner to honor this policy and notify you before data moves under a different policy.
5. Retention
- Imported audits and settings: until you delete them or your account.
- Guest data: deleted after 12 months of inactivity.
- Cached results (Upstash): up to 1 hour.
- Server logs: kept by our host for TODO: log retention (days) days.
- Backups: deleted data may persist in database backups for up to TODO: backup retention (days) days.
6. Your choices and rights
You can delete an audit from the dashboard. The “Your data” page (linked in the footer) lets you download a copy of your data and delete all of it, whether you have an account or are a guest.
We extend the following rights to all users, including California residents under the CCPA/CPRA: know/access, correct, delete, receive a portable copy, and non-retaliation. Email us to use them or to ask us to reconsider a denial.
We verify requests by confirming control of the account email (or, for guests, the browser holding the guest cookie). We respond within 45 days.
7. Security
HTTPS in transit, no direct client database access, and access restricted to our server. No system is perfectly secure, so we cannot guarantee absolute security. We will notify affected users of breaches as required by law.
8. Children
DeAnzaCompass is not directed to children under 13, and you must be 18 or have a parent or guardian's permission to use it (see the Terms). If we learn we hold data from a child under 13, we will delete it.
9. Education records
We receive data from you, not from De Anza College or the Foothill-De Anza Community College District. We are not a school official or an agent of the college.
10. Changes
For material changes we will give at least 14 days' notice by email or in the app. We will not use data we already hold in a materially different way without your consent.