ModuleMate (“we”, “us”, or “our”) values your privacy. This policy explains what information we collect, how we use it, and your rights.

1. Information We Collect

Personal info you provide

• Email addresses
• Passwords
• Academic data (module names, grades)

Automatic Data Collection

In addition to the information you provide, ModuleMate automatically collects certain technical data when you use our service. This includes:

• IP addresses (from server logs)
• Browser and device information (user agent)
• Timestamps of activity (for example, when you log in or create timelogs)
• Session cookies used to keep you logged in

This data is collected to help operate and secure the service and is not used for marketing purposes.

2. How We Use Your Information

• To facilitate account creation and authentication
• To deliver and facilitate delivery of services to the user
• We use the academic data you provide, such as module names and grades, to enable core features of our service. This data is used to help you manage your studies, track your progress, and calculate your academic performance. We do not use this information for any other purpose, such as marketing or sharing with third parties, unless required by law.

3. Legal Basis for Processing

We process your personal data under the following legal bases, as required by UK data protection law:

• Contract: To provide and operate ModuleMate, including account creation, authentication, and delivery of services.
• Consent: When you choose to sign in with Google or enable optional features that require additional information.
• Legal obligation: To comply with applicable laws, regulations, or court orders.
• Legitimate interests: To maintain and improve the security and performance of our service. We balance these interests against your rights and freedoms.

4. Data Retention

We keep your personal information only for as long as necessary to provide the service, meet legal obligations, or resolve disputes. In practice:

• Account data (email, academic data, preferences) is kept until you delete your account, after which it is permanently erased from our active systems within 30 days.
• Backup copies may remain for up to 90 days before automatic deletion.
• Email addresses used for password resets or support requests are retained only as long as needed to complete the request.

We regularly review stored data and delete or anonymise information that is no longer required.

5. Sharing Your Information

We do not share your personal information with third parties except when necessary to provide the service, to comply with the law, or to use third-party services that help us operate ModuleMate.

Google Sign-In

If you sign in with Google, we receive information such as your name, email address, and profile picture (if available). This is used solely to create and authenticate your account. We do not store your Google password and only share the minimum required with Google for authentication.

For more details, see Google's Privacy Policy: https://policies.google.com/privacy.

Third-Party Services

We use certain third-party services to deliver and host ModuleMate:

• Render: Hosts our application and stores app data necessary for the service to run.
• Neon: Hosts our database. All account, module, exam, and timelog data is stored on their servers.
• Postmark: Sends password reset emails. Only your email address is shared for this purpose.

These services process data only on our behalf and are contractually required to protect it. We do not share your information with them for marketing purposes.

6. Your Data Protection Rights

Under UK data protection law, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your data in certain circumstances.
• Right to restrict processing: You can ask us to limit how we use your data in certain situations.
• Right to data portability: You can request that we provide your data in a structured, commonly used format, and transfer it to another service if technically feasible.
• Right to object: You can object to our processing of your data where we rely on legitimate interests.
• Right to lodge a complaint: You can complain to the Information Commissioner’s Office (ICO) if you believe your data protection rights have been violated. More details at https://ico.org.uk/make-a-complaint/

To exercise any of these rights, please contact us at contact@modulemate.app

7. Security

We use technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls to limit who can access your data
• Regular monitoring of our systems for vulnerabilities

While no method of transmission or storage is completely secure, we take reasonable steps to minimise risk.

8. Cookies

ModuleMate uses the Rails session cookie, to manage your logged-in session and keep your account secure.

This cookie does not track your activity for advertising or analytics purposes and is required for you to use the service.

You can delete this cookie at any time, but doing so will log you out of your account.

9. Preferences

Theme Preferences (Local Storage)

ModuleMate may store your theme preferences (light/dark mode) in your browser's local storage.

This information is stored only on your device and is not transmitted to our servers or shared with third parties. You can change or clear these settings at any time by clearing your browser storage.

10. Children’s Privacy

Our service is not intended for children under 13. Users aged 13–18 should only use the service with parental or school consent.

11. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling.

12. Data Breach Notification

In the unlikely event of a data breach that affects your personal data, we will notify you and the Information Commissioner’s Office (ICO) when legally required.

13. Changes to This Policy

We may update this policy occasionally. We will notify you of significant changes.

14. Contact Us

For questions or comments about this policy, contact: contact@modulemate.app