Privacy Policy & Terms of Use

1Who we are

ClubSync is a club, event, and volunteer-hour tracking platform built for students and staff at participating schools, starting with Hugh Boyd Secondary School. It is currently operated independently by its student developer, not by the school district itself, unless and until a school formally adopts it — see Section 6 for what changes if that happens.

2Information we collect

We do not collect payment information, government ID numbers, health information, or location data. We do not use tracking or advertising cookies of any kind — see Section 13.

3Why we collect it

Every piece of information above exists for one reason: to run your school’s clubs, events, and service-hour tracking. Specifically, we use it to:

• Let you sign in and keep your account secure
• Show you the clubs and events relevant to your school and grade
• Let club teachers and admins manage membership, attendance, and events
• Track and verify volunteer/service hours
• Contact you about your account or activity within the app (never marketing, and never to a third party)

We do not use your information for advertising, and we do not sell, rent, or trade it to anyone, for any reason.

4Your consent

By creating an account, you’re agreeing to let ClubSync collect and use your information as described in this policy, for the purposes described in Section 3 — this is how British Columbia’s private-sector privacy law (PIPA) expects consent to work: specific, and limited to what you were actually told.

If you’re old enough to sign yourself up for a school club without a parent present, we treat that as old enough to understand and agree to this policy. If you’re younger, or your school requires it, we ask that a parent or guardian review this page with you before you sign up.

5Who can see your information

We never share your information with anyone outside of ClubSync — no advertisers, no data brokers, no other companies — except where required by law.

6Where your information is stored

Your account and activity data — the actual database — is hosted with Supabase, in Supabase’s Canada (Central) data centre. Your information is encrypted in transit (HTTPS) and the database itself is not publicly accessible.

Two other services touch a narrower slice of your information as part of running the site, and aren’t confirmed to store or process data in Canada the way the database is: ClubSync’s website itself runs on Vercel, whose servers primarily operate in the United States, and password-reset emails are sent through Resend, a transactional email provider that stores email metadata in the United States. Neither one receives your broader account data — Vercel only handles a request as it happens, and Resend only ever sees a one-time reset link and the email address for that single message — but we’d rather say this plainly than let “the database is in Canada” be read as “everything about ClubSync is in Canada,” which isn’t accurate yet.

7How your information is protected

• Passwords are never stored in plain text — they’re one-way hashed using industry-standard bcrypt, so even we can’t see your actual password
• All traffic between your device and ClubSync is encrypted (HTTPS)
• Access to club and student data is restricted by role — a club officer can’t see another club’s data, and a student can’t see another student’s private records
• Every sensitive administrative action (suspending an account, merging accounts, editing service hours) is logged with who did it and when

8How long we keep your information

We keep your account and activity data for as long as your account is active. You can delete your account and personal information yourself at any time from Settings, and it’s removed right away — your email, password, sign-in access, profile photo, club memberships, event registrations, notifications, and any unverified service hours are all gone immediately and permanently.

The one exception is verified service hours: since a school may need those totals as part of its own records, deleting your account keeps your name attached to just those specific verified records, even though the account itself can never be signed into again — everything that would let you (or anyone else) use, access, or be contacted through that account is still removed. How long the school itself needs to keep that record afterward is up to the school’s own retention requirements, not something we set unilaterally.

Graduating or leaving the school doesn’t delete your account automatically today — that only happens when you (or a parent/guardian, for a minor) actually request it, the same as any other deletion request in Section 9. Automatically archiving a graduated student’s account is on our roadmap; until it ships, this policy describes what actually happens, not what’s planned.

9Your rights

You can, at any time:

• Access — see everything ClubSync has stored about you (most of it is already visible in your own account)
• Correct — fix inaccurate information
• Delete — request your account and personal information be removed
• Ask questions — find out exactly how a specific piece of your information is being used

To exercise any of these, contact us using the details in Contact. We’ll respond within a reasonable time, consistent with what BC’s privacy law (PIPA) expects of organizations handling personal information.

10Signing in with Google and connecting Google Calendar

Signing in. If you choose “Continue with Google” instead of a password, Google shares your name, email address, and profile photo with ClubSync — nothing else. We never see or store your Google password. You can disconnect ClubSync from your Google account at any time from your Google Account settings, independently of ClubSync.

Connecting Google Calendar (optional). ClubSync works fully without it. If you choose “Connect Google Calendar” in Settings, Google asks whether ClubSync may have read-only access to your calendar (the calendar.readonly permission). We use that access for one purpose: to show your own Google Calendar events alongside your club events on your ClubSync calendar, so you can see clashes in one place.

• What we read: the title and start time of events on your primary Google Calendar, for the dates you’re looking at, each time you open a ClubSync calendar page.
• What we store: the events themselves are not saved in ClubSync’s database. We store only the permission token Google gives us (a long-lived one and a short-lived one) so we can keep reading your calendar until you disconnect. While a calendar page loads, events pass through ClubSync’s web servers (see Section 6) on their way to your screen.
• Who can see it: only you. Your Google Calendar events are never shown to other students, club directors, teachers, or school administrators, and never shared with anyone else. We can’t add, change, or delete anything in your Google Calendar — the access is read-only.
• What we never do: sell it, use it for advertising, or use it to train any AI or machine-learning model. ClubSync staff don’t read your calendar data.
• Disconnecting: press “Disconnect Google Calendar” in Settings and ClubSync deletes its stored permission tokens right away. You can also remove ClubSync’s access from your Google Account under Security → Third-party apps & services. Deleting your ClubSync account removes the tokens too.

ClubSync’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11Children and students

ClubSync is built for a school environment where most users are minors. We collect the minimum information needed to run school clubs, we never use it for advertising, and we never share it outside the small set of people described in Section 5. If you are a parent or guardian and want to review, correct, or delete your child’s information, contact us — we’ll work directly with you, no separate account needed.

12Built with AI assistance

In the interest of being upfront about it: ClubSync’s code was written with the help of AI-assisted development tools (Claude Code, by Anthropic). No part of your personal information is used to train any AI model — the AI was a tool used during development, the same way a code editor or a spell-checker is a tool. It does not run inside the live app, does not read your data, and is not involved in any decision the app makes about your account.

Responsibility for how ClubSync actually behaves — what it collects, how it’s protected, and how it’s used — rests with its developer, not with any AI tool that helped write it. Using AI during development doesn’t change that.

13Cookies

ClubSync uses one small, secure cookie to keep you signed in. That’s it — no advertising cookies, no third-party tracking scripts, no analytics that follow you around the web. The sign-in cookie is deleted when you sign out.

14If something goes wrong

If we discover a privacy or security incident affecting your information, we’ll act on it without delay: contain and assess it as soon as we’re aware, notify anyone affected (and their school, where applicable) as soon as reasonably possible once we understand what happened, and tell you plainly what occurred, what information was involved, and what we’re doing about it. This isn’t a hypothetical policy — it’s the actual process we’d follow, and it applies whether the incident is large or small.

15Changes to this policy

If this policy changes in a meaningful way, we’ll update the “Effective” date at the top of this page and, for significant changes, notify users directly within the app.

1Accepting these terms

By creating a ClubSync account, you agree to these Terms of Use and the Privacy Policy above. If you don’t agree, don’t create an account.

2Who can use ClubSync

ClubSync is intended for students, teachers, and staff at participating schools. One account per person — accounts are not transferable, and you shouldn’t create an account on someone else’s behalf.

3Your account

• Keep your login information accurate and your password private
• You’re responsible for activity that happens under your account
• Tell us right away if you think someone else has accessed your account

4Acceptable use

Don’t use ClubSync to:

• Harass, impersonate, or misrepresent yourself or anyone else
• Create a fake club, event, or account
• Try to access another person’s account or data without permission
• Misuse admin, officer, or director permissions — for example, approving your own self-reported hours, or removing another member without a legitimate reason
• Post anything abusive, hateful, or otherwise inappropriate for a school setting

Club teachers, school admins, and the platform administrator can remove content or suspend accounts that break these rules — see Section 8.

5Club and content responsibility

If you’re a club director, officer, or admin, you’re responsible for what you post on behalf of your club — descriptions, announcements, and event details. ClubSync doesn’t review content before it’s posted; it can be removed after the fact if it violates these terms.

If you upload a photo or video, only do so with the parent or guardian permission your school requires for that student, and avoid images that include a student’s full name, address, or phone number.

6Service hours and records

ClubSync is a record-keeping tool, not the final authority on your school’s service-hour requirements. Self-reported hours are logged on an honor system; verified hours require confirmation from a club teacher, director, or admin. Whether hours logged in ClubSync count toward your school’s official graduation or program requirements is entirely up to your school’s own policies — ClubSync doesn’t control or guarantee that.

7Service availability

ClubSync is currently a student-built, independently-run pilot service, not an enterprise product with a guaranteed uptime commitment. We do our best to keep it reliable, but the service is provided on an “as available” basis, and we’re not responsible for lost access to data during outages — see Section 8 of the Privacy Policy on how long records are actually kept regardless of short-term downtime.

8Suspension and termination

An account that violates these terms can be suspended or removed by a club teacher/director (within their own club), a school admin (within their own school), or the platform administrator (anywhere). You can also delete your own account at any time by contacting us.

9Disclaimer and limitation of liability

ClubSync is provided “as is,” without warranties of any kind. To the fullest extent allowed by law, ClubSync and its developer are not liable for indirect, incidental, or consequential damages arising from your use of the service — including lost data, missed events, or disputes over service-hour credit. Nothing in this section limits any liability that cannot legally be limited under British Columbia or Canadian law.

10Governing law

These terms are governed by the laws of the Province of British Columbia and the federal laws of Canada applicable within it.

11Changes to these terms

We may update these terms as ClubSync grows. Material changes will be flagged in the app, and continuing to use ClubSync after a change means you accept the updated terms.