Privacy Policy

Last updated: 2026-07-14

This page describes what information Baruch Econ & Finance Studio (the "Service") collects from students, how it is stored, who can see it, and your rights regarding it.

1. What we collect

The Service intentionally collects the minimum information needed to operate. When you create an account we store:

• Your email address, held in the authentication system. It is not duplicated in plaintext in the application database.
• An account identifier (random UUID).
• An account role (student, teaching assistant, instructor, or admin).
• An optional display name you set.
• The policy version, timestamp, and account flow through which you accepted the Terms of Service.

When you use the Service we additionally store:

• Per-lesson progress markers ("started" / "completed").
• Quiz attempts: your answers, score, and submission timestamp.
• Workshop attendance: the workshop session, timestamp, and whether attendance was verified by the one-time location check, the workshop window, or an instructor's manual correction. A manual correction also records the instructor and their stated reason.
• For location-enabled workshop attendance, your browser sends one latitude/longitude reading when you press the stamp-in button. The server uses it to make the geofence decision and does not retain the coordinates. The Service does not request background location.
• A random workshop-device cookie, retained for up to 180 days, helps prevent multiple accounts from stamping in from the same browser. For new attendance stamps, the application database stores only an HMAC-SHA256 derivative scoped to one workshop session, not the raw cookie identifier or a token that can link the browser across different workshops. The cookie is issued only when a signed-in user visits the protected workshop area.
• For staff roster access, exports, and management actions: an audit record containing the actor's account identifier, the action and resource, an optional target-student identifier when one student is addressed, and an HMAC of the actor's IP address and User-Agent (the raw IP and User-Agent are not stored). The actor identifier is set to null if that staff account is later deleted.

2. What we do not collect

We do not collect Social Security numbers, dates of birth, home addresses, phone numbers, government IDs, or payment information. We do not embed third-party advertising trackers on authenticated pages.

3. FERPA notice and non-waiver

The Service treats quiz attempts, lesson progress, and any related records as education records under the Family Educational Rights and Privacy Act of 1974 (FERPA, 20 U.S.C. § 1232g; 34 CFR Part 99) when the Service is used as part of an institution- authorized course. Where the Service operates as a "school official" under § 99.31(a)(1) of the FERPA regulations, it does so under the direct control of the contracting institution and is bound by the no-redisclosure terms of the underlying Data Privacy Agreement.

Nothing in this Privacy Policy or in the Terms of Service requires or permits a student to waive any right granted to them by FERPA. Any clause that purports to do so is void and severable from the rest of these terms. If you believe your FERPA rights have been violated, you may file a complaint with the U.S. Department of Education's Student Privacy Policy Office.

4. Who can see your records

• You can see your own profile, lesson progress, and quiz attempts and your own workshop attendance at any time via your dashboard or the relevant workshop page.
• Instructors can see lesson progress and quiz attempts only for students who are enrolled in their own courses. Workshop attendance is limited to the instructor-owned course, semester, and section. These boundaries are enforced in the database and rechecked by server routes.
• Administrators (the project owner only) can read all records. The Service attempts to audit staff roster-page access, exports, and management actions; actions directed at one student include that student's account identifier. A failed best-effort audit write is logged server-side, and availability-sensitive operations may continue.
• Nobody else. We do not sell, rent, or share records with advertisers, data brokers, or any third party except as required by law.

5. How long we keep records

• Inactive student accounts are automatically deleted 24 months after the later of account creation or last sign-in, along with directly associated progress, quiz, enrollment, and attendance rows. Staff accounts that still own rosters, workshop schedules, or archive content or any archive-upload authorization are skipped until those records are transferred or removed.
• Quiz attempts older than 730 days are automatically purged.
• Workshop attendance is retained with the related education record until account deletion or the institution's applicable retention schedule. New attendance stamps do not retain submitted coordinates. Older attendance rows may still contain a raw legacy browser identifier, submitted coordinates, and HMACs of the request IP address or User-Agent. Those fields are blocked from student and instructor database access, remain unchanged until the project owner separately approves a retention scrub, and are not populated by new stamps. The browser cookie expires after at most 180 days and is cleared after successful account deletion.
• Audit records are retained until an administrator applies the institution's approved audit-retention schedule. They may outlive the underlying account or education record; deleting a staff account nulls its actor identifier, while resource and target identifiers can remain.
• Unfinished staff archive uploads are removed after their upload authorization expires. When a staff member deletes an archive paper, its database row and stored file are permanently removed after a 24-hour recovery window. Finalized upload-authorization records are removed after 30 days.

6. Your rights

You can at any time:

• Access your records via the dashboard and relevant workshop pages.
• Update your display name from your account settings.
• Delete your account and directly associated education records via the "Delete account" flow under your dashboard. This action is irreversible. Staff accounts that own institutional records require an administrator to transfer that ownership before removing sign-in access. Accountability or disclosure-audit records may remain for the institution's applicable retention period.
• Export your records — contact us and we will provide a machine-readable copy within 30 days.

Students who are residents of California (CCPA / CPRA), the European Union (GDPR), or other jurisdictions with comparable data-protection laws have the same access, update, deletion, and portability rights described above. Where the Service is acting as a school official under FERPA for records covered by FERPA, that statute controls.

7. Security

• All data is encrypted in transit (TLS) and at rest (AES-256, via our database provider Supabase).
• Student and ordinary staff reads use PostgreSQL row-level security. Server-only pages and routes that require elevated database access recheck either the signed-in user's own record identifier or the staff role, instructor ownership, semester, and section before reading or changing records.
• Location checks are a convenience control rather than conclusive proof of physical presence. If browser permissions or accuracy prevent a successful check, students may ask their instructor for manual verification.
• IP addresses and User-Agent strings in our audit log are stored only as HMAC-SHA256 values using a server-side secret — a leak of the application database alone cannot enumerate them.

8. Children under 13

The Service is not directed to children under 13 and is not designed to comply with the Children's Online Privacy Protection Act (COPPA). By creating an account you affirm you are 18 years of age or older, or that an adult has set up the account on your behalf.

9. Changes to this Policy

We may update this Privacy Policy. Material changes will be announced on the Service at least 30 days before they take effect. The "Last updated" date at the top of this page indicates the current version.

10. Contact

Questions about this policy, requests to exercise your rights, or reports of suspected privacy violations may be sent to the project owner at hyunjun.yoo@baruch.cuny.edu. We will respond within 30 days.

This policy is a starting template and is not legal advice. If you are an institution adopting Baruch Econ & Finance Studio for credit-bearing coursework, please review with your own counsel and Data Privacy Officer before signing a Data Privacy Agreement.