Privacy Policy · Conexus

1.What we collect

Account: name, school email, school, grade, and birth month and year (only to confirm you’re 13 or older).
Profile: skills, what you want to learn, availability, preferred kinds of places, bio, an optional photo and portfolio uploads.
Activity: requests, messages, sessions, ratings, reviews, and the summaries you write after sessions.
Check-in evidence: at check-in and check-out, your phone’s distance from the booked place and the time of the QR scan. We store the distance, not your coordinates.
Password screening: when choosing a password, only the first five characters of its hash are sent to the free Pwned Passwords service. Your password and email are not sent to that service.
Certificates: the name and school email of the teacher you ask to sign your hours.

2.How we use it

To run the exchange: matching, messaging, scheduling, verifying sessions, and tracking credits and hours.
To keep people safe: moderators review sessions, summaries and reports, and can read messages when a report involves them.
We send password recovery links when requested, session and safety notifications, and certificate review links to staff-approved teachers. Optional notification emails can be changed in settings. Student sign-up does not require email confirmation.

3.Who sees what

Other students see your public profile: first name and last initial, grade, school, skills, availability, reviews and portfolio. Never your email, birth date, credits or location.
Your session partner sees your summary only after they’ve submitted their own.
Conexus moderators can see everything needed to verify sessions and handle reports.
A teacher you choose sees your name and verified teaching session dates, subjects, minutes, and both session summaries when you send them a certificate to sign.
Service providers: Supabase (database and accounts), Cloudflare (hosting), Mapbox (maps), and Resend (transactional email). They process data only to provide their service.
We never sell your data or use it for ads.

4.Children under 13

Conexus isn’t for children under 13. Our sign-up stops anyone under 13 before an account is created, and if we learn we have data from someone under 13, we delete it.

5.Your choices

Edit or hide your profile, and hide your last name, in Settings.
Download your hours log at any time.
Delete your account in Settings; we delete your personal data within 30 days. Verified hour records on signed certificates may be kept so certificates stay verifiable.
California residents have additional rights under the CCPA/CPRA. Email us to use them.

6.Security and retention

Data is encrypted in transit and at rest, and access is limited by role. We keep messages and session records while your account is active, and for up to 12 months afterwards for safety reviews, then delete them.