Crux Planner – Privacy Policy
Last updated: February 12th, 2026
1. Who We Are
Crux Planner is a third-party tool made for university students, based on publicly available course data. The Service is operated by Kalan Roye ("we," "us," or "our").
Questions? legal@kalanroye.com
2. Scope
This Policy explains what personal information we collect, how we use it, and your rights. It applies to cruxplanner.ca and any related services or communications (together, the "Service").
3. Information We Collect
| Category | Details | Source |
|---|---|---|
| Account Data | University e-mail address, full name (display name), student number (optional), faculty, major, academic year | Directly from you at sign-up |
| Usage Data | Pages visited, clicks, time-on-page, referrer URL, device/browser type | Vercel Analytics & server logs |
| In-App Activity Data | Optional in-app analytics events (e.g., page views, course/professor views, feature clicks) stored with your account when enabled in Settings | From your use of the Service |
| Auth Cookies | Encrypted session cookie set by Supabase Auth | Your browser |
| User-Generated Content | Posts, comments, course/professor reviews, and other content you submit in the community | Directly from you |
| AI Uploads (Optional) | Images you upload (e.g., schedule or transcript screenshots) which may contain course codes and, if present, grades. We process these images to extract course information and do not store the uploaded image after processing. | Directly from you |
| Moderation & Safety Data | Moderation outcomes (e.g., flags/categories) and enforcement signals (e.g., content strikes) related to content you submit or images you upload | Generated by our safety systems during use of the Service |
We don't ask for sensitive categories such as SINs, payment information, or health data. Please do not upload or post sensitive personal information.
4. Why We Use Your Information
| Purpose | Legal Basis (PIPEDA "reasonable purposes") |
|---|---|
| Create and manage your account | Performance of the Service you request |
| Display personalized dashboards & schedules | Same as above |
| Send transactional e-mails | Same as above |
| Provide optional AI features | Performance of the optional feature you request (and your consent when you choose to upload an image) |
| Monitor performance, fix bugs, and improve features | Legitimate interest in running a reliable service |
| Detect, investigate, or prevent fraud and abuse | Legitimate interest / legal obligation |
| Moderate content and enforce community standards | Legitimate interest in keeping the Service safe and usable |
Marketing e-mails are currently not sent. If that changes, we'll obtain your express consent first.
5. Cookies & Tracking
Essential cookies (Supabase Auth) keep you logged in; disabling them breaks the Service.
Analytics helps us understand aggregate usage and improve reliability. We use Vercel Analytics and server logs for aggregate trends and security. Separately, we may also store optional in-app activity eventslinked to your account (see § 3) when you enable "Analytics Collection" in Settings. You can turn off in-app activity logging in Settings, and you can control cookies through your browser settings. Some server-side logging may remain for security and abuse prevention.
6. Sharing & Disclosure
We never sell personal information. We share it only with:
- Service providers who help us operate Crux Planner, including:
- Supabase (authentication, database, and storage infrastructure)
- Vercel (hosting and performance analytics)
- MailerSend (transactional email delivery)
- OpenAI (AI image processing for optional schedule/transcript uploads, including safety checks and course extraction, and automated text moderation for community safety)
- Law enforcement or regulators when legally required or to protect our rights, users, or the public.
- A successor entity if Crux is merged, acquired, or sold. We will provide notice as required by law. Where feasible, you may have options such as closing your account.
7. International Transfers
Your data is stored on Supabase servers in North Virginia (USA) and may be processed in other jurisdictions where we or our service providers operate. We use reasonable contractual, technical, and organizational safeguards appropriate to the transfer. By using the Service, you consent to the transfer and processing of your information outside your jurisdiction.
8. Data Retention
| Data type | Retention |
|---|---|
| Active account data | Until you delete the account |
| Forced-termination data | As long as reasonably necessary for security, abuse prevention, auditing, and legal purposes |
| Server logs & analytics | Up to 12 months, unless required longer for security or legal reasons |
Back-ups containing deleted records may persist up to 30 days.
9. Security
We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit and least-privilege access controls. No method is 100% secure, but we strive to protect your information. We welcome good-faith vulnerability reports at legal@kalanroye.com. Please do not perform penetration testing or attempt to bypass security controls without our prior written permission.
10. Your Rights
Under Canadian privacy law you may:
- Access the personal information we hold about you
- Correct inaccurate or incomplete data
- Delete your account and associated data (subject to retention in § 8)
- Withdraw consent to non-essential processing (e.g., turning off in-app analytics collection in Settings, controlling cookies in your browser)
To exercise any right, e-mail legal@kalanroye.com. We will respond within 30 days.
11. Children
Crux Planner is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us so we can delete the account and associated data.
12. Changes to This Policy
We may update this Policy occasionally. Material changes will be highlighted in-app or by e-mail at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.
13. Contact
Questions, complaints, or access requests:
Kalan Roye
Email: legal@kalanroye.com
You may also file a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial authority.