Privacy and community policies

1. Privacy Policy

What we collect

• Sign-up details: login email, display name, school, program and member type (local or visiting student)
• Student verification: we email a code to your school address, but once you're verified we don't keep that address. We keep only a one-way hash, needed to stop one school email from verifying several accounts, and the fact that you're verified.
• Password: never stored as typed, only as a one-way hash (PBKDF2).
• Posts and comments you write in the community
• One login cookie, used only to keep you signed in. No ad or tracking cookies.
• Security records: to stop password-guessing attacks we briefly count requests per IP address or email.

What we don't collect

• No ads, visitor analytics or location tracking.
• Saved benefits (☆), guide progress, your chosen school and language stay in your browser and are never sent to our server.

Why we use it: managing accounts, verifying students, running the community, sending reset and verification emails, and security. We never sell your information or use it for ads.

What other members can see: posts and comments show only your display name, school, program and member type. Your email is never shown.

Sharing with third parties: we don't give or sell member information to other groups, sponsors or advertisers. These providers process it to run the site, and we share it with authorities only when the law requires.

• Vercel: hosting
• Neon: database
• Google (Gmail): sending verification and reset emails
• These providers may use servers outside Canada.

Email: today we only send emails your account needs (verification codes, password resets). We don't send newsletters or sponsor promotions. If we ever do, we'll ask separately from sign-up with an unticked opt-in, and every message will include who it's from and a way to unsubscribe (CASL).

Deleting your account

• Go to My account → Delete account and re-enter your password. It's deleted right away.
• Your account, posts, comments, logins, warnings and verification codes are removed immediately.
• Can't log in? Email us from your sign-up address. We'll confirm it's you and delete within 30 days.

Your rights: view and edit your profile in My account. For a copy of your data or a correction, email us; we'll reply within 30 days.

2. Retention

• Account details: until you delete your account
• Logins: up to 12 hours. The cookie disappears when you close the browser, and expired records are removed automatically.
• School email codes: 15 minutes. Reset links: 30 minutes. Deleted once used or expired.
• Security records (request counts per IP or email): deleted within a day
• Posts and comments removed by admins: deleted at once, can't be restored
• Deleted data may remain in our database provider's backups until those backups expire.
• Data stored in your browser disappears when you clear the site's data.

3. Community Guidelines

We remove posts and comments that include:

• Harassment, hate, discrimination or threats
• Someone else's personal information (contact details, address, student number, photos and so on)
• Ads, spam, scams or illegal activity
• Sexual or violent content
• False information that harms other students

Reporting: tap Report under a post or comment to email the admins with a short reason. We never tell the author who reported them.

What happens: admins usually review within 3 days and act in steps.

• Step 1: the post or comment is removed and the author gets a warning, shown in their My account.
• Step 2: repeated violations lead to a temporary posting restriction.
• Immediate action: for serious cases such as threats, sharing personal information or illegal activity, we remove content without warning, may delete the account, and contact authorities if needed.

Appeals: if you think we got it wrong, email us. A different admin will review it.

You can delete your own posts any time in My account.

4. Access Control Policy

Site admin rights

• Only accounts listed in the server settings have admin rights. The Founder approves each one, and we keep the number as small as possible.
• Admins can see the member list: display name, login email, school, program, member type, verification status, join date, and post and warning counts. Passwords and school email addresses aren't stored, so admins can't see them.
• Admins can delete posts and comments and send warnings to authors.
• Admin pages are invisible to everyone else (they show as not found).
• Member information is used only to run the site and is never shared or copied elsewhere.

Service accounts (hosting, database, code repository, email)

• Managed by the Founder. Organizers who need access get the least access necessary on their own personal accounts; we don't share passwords.
• Two-step verification is turned on wherever it's available.

Removing access

• When an organizer's role ends or changes, we remove their admin listing and service access the same day.
• Accounts that lose admin rights can't use admin features from their next request.
• Any shared secrets (such as API keys) are replaced.
• Every 3 months we review the admin list and service access.

5. Incident Response Plan

If we suspect a data breach

• Contain it: end all logins, change secret keys and passwords, and close the cause.
• Assess it: find out what information, whose, and how much was exposed.
• Notify: if there's a real risk of significant harm, email affected members as soon as possible and report to the Office of the Privacy Commissioner of Canada, as the law requires.
• Record it: keep a record of every breach for 24 months.
• Prevent it: fix the cause and note the changes on this page.

If an account is taken over

• Members: use Forgot password to set a new password; this signs out every device at once. Then email us.
• Organizers: end all logins for that account, review and remove posts and comments made while it was compromised, and check whether other members were affected.
• If an admin account is compromised, we remove its admin rights immediately and also follow the breach steps above.

If you notice anything that looks like a breach or a stolen account, email us right away.

6. Account and password security

What SEED does

• Passwords must be at least 10 characters and are stored only as hashes.
• The login cookie can't be read by JavaScript (HttpOnly) and is only sent over HTTPS.
• More than 5 login attempts for the same email in 15 minutes triggers a short lockout.
• Changing or resetting your password signs you out everywhere else.
• Reset links and verification codes work once and expire quickly.
• Deleting your account requires your password again.

What you can do

• Use a password you don't use anywhere else.
• Log out after using a shared computer.
• SEED will never ask for your password by email or message. Ignore such requests and tell us.

Contact and changes

Privacy contact: the SEED Toronto Founder, at the email below. If this policy changes, we'll update this page with a new effective date.