Crux – Privacy Policy
Last updated: May 25th, 2025
1. Who We Are
Crux is a third-party tool made for university students, based on publicly available course data. The Service is operated by Kalan Roye ("we," "us," or "our").
Questions? legal@kalanroye.com
2. Scope
This Policy explains what personal information we collect, how we use it, and your rights. It applies to Crux.ca and any related services or communications (together, the "Service").
3. Information We Collect
| Category | Details | Source |
|---|---|---|
| Account Data | University e-mail address, display name, student ID, faculty, major, academic year | Directly from you at sign-up |
| Usage Data | Pages visited, clicks, time-on-page, referrer URL, device/browser type | Vercel Analytics & server logs |
| Auth Cookies | Encrypted session cookie set by Supabase Auth | Your browser |
| User-Generated Content | Comments, reviews, files you upload (future feature) | Directly from you |
We don't knowingly collect sensitive categories such as SINs, payment info, or health data.
4. Why We Use Your Information
| Purpose | Legal Basis (PIPEDA "reasonable purposes") |
|---|---|
| Create and manage your account | Performance of the Service you request |
| Display personalized dashboards & schedules | Same as above |
| Send transactional e-mails | Same as above |
| Monitor performance, fix bugs, and improve features | Legitimate interest in running a reliable service |
| Detect, investigate, or prevent fraud and abuse | Legitimate interest / legal obligation |
| Optional future donations (if enabled) | Your explicit consent at time of payment |
Marketing e-mails are currently not sent. If that changes, we'll obtain your express consent first.
5. Cookies & Tracking
Essential cookies (NextAuth) keep you logged in; disabling them breaks the Service.
Analytics cookies (Vercel Analytics) record aggregate usage trends; IPs are truncated and never combined with Account Data. You can disable analytics cookies in your browser settings, though some metrics (e.g., server logs) remain for security.
6. Sharing & Disclosure
We never sell personal information. We share it only with:
- Service providers who help us operate Crux (e.g., Vercel cloud hosting, Supabase database, e-mail provider). Each is bound by confidentiality agreements and may process data solely for us.
- Law enforcement or regulators when legally required or to protect our rights, users, or the public.
- A successor entity if Crux is merged, acquired, or sold; you'll receive notice and may opt out before data is transferred.
7. International Transfers
Your data is stored on Supabase servers in North Virginia (USA) and may be processed wherever our providers have facilities. We use contractual safeguards (e.g., Standard Contractual Clauses) to protect data transferred outside Canada.
8. Data Retention
| Data type | Retention |
|---|---|
| Active account data | Until you delete the account |
| Forced-termination data | Indefinitely (security & audit) |
| Server logs & analytics | Up to 12 months, unless required longer for security or legal reasons |
Back-ups containing deleted records may persist up to 30 days.
9. Security
We use industry-standard TLS encryption in transit, database-level encryption at rest, least-privilege access controls, and routine vulnerability scans. No method is 100% secure, but we strive to protect your information.
10. Your Rights
Under Canadian privacy law you may:
- Access the personal information we hold about you
- Correct inaccurate or incomplete data
- Delete your account and associated data (subject to retention in § 8)
- Withdraw consent to non-essential processing (e.g., analytics cookies)
To exercise any right, e-mail legal@kalanroye.com. We will respond within 30 days.
11. Children
Crux is intended for individuals 17 years or older. We do not knowingly collect data from anyone under 17. If you believe a minor has provided information, contact us to delete the account.
12. Changes to This Policy
We may update this Policy occasionally. Material changes will be highlighted in-app or by e-mail at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.
13. Contact
Questions, complaints, or access requests:
Kalan Roye
Email: legal@kalanroye.com
You may also file a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial authority.