Legal
Privacy Policy
Last updated: May 3, 2026
UniOrg (“we”, “us”) is a personal academic organizer for university students. This policy explains what data we collect when you use UniOrg, why we collect it, and how you can control or delete it.
1. Authentication & account data
UniOrg supports two sign-in methods. You can use either independently, or link both to the same account from your profile page:
| Email & password | Your email address and a bcrypt-hashed password. The plain-text password is never stored. |
| Discord OAuth 2.0 | Your Discord display name, email address, avatar URL, and Discord user ID. |
Regardless of sign-in method, we store your name, email, and avatar (if provided by Discord) to display inside the app and to identify your account. We do not use your email for marketing or share it with third parties.
2. Academic data you enter
Everything you create or configure inside UniOrg is stored and linked to your account:
| Subjects | Subject name, lecturer names and contact details, CA breakdown, exam weights, grade ranges, weekly schedule, CA marks you enter |
| GPA settings | Your target GPA, GPA scale, semester start date, week offset |
| Subject grades | The grade you assign to each subject for GPA tracking |
This data is stored solely to provide the app's functionality. We do not analyse, sell, or share it with any third party.
3. Document uploads & AI processing
When you upload a teaching plan (PDF, PNG, or SVG), the document is processed to automatically fill in your subject details. During this process:
- Your document is sent to OpenRouter (a third-party AI API gateway) which routes it to AI model for structured data extraction.
- The document content is processed transiently — neither we nor OpenRouter permanently store the raw document.
- Only the extracted structured data (subject name, schedule, grades, etc.) is saved to your account.
By uploading a document you acknowledge that its contents are sent to OpenRouter for processing. Avoid uploading documents containing sensitive personal information beyond academic content.
OpenRouter's privacy policy: openrouter.ai/privacy
4. Cookies & local storage
We use cookie only for storing your session in this website in order for you to stay logged in:
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. The service worker caches static app assets and the dashboard page in your browser for offline use — this cache contains no personal data.
5. Request verification (Cloudflare Turnstile)
To protect against automated and abusive API requests, UniOrg uses Cloudflare Turnstile — an invisible browser challenge that checks your client periodically, and the result will be passed to server-side to verify when you perform changes to your content (saving subjects, semesters, or settings). No visible CAPTCHA is presented to you.
As part of the challenge, Cloudflare may collect browser and device signals (such as your IP address, user-agent, and browser characteristics) to issue and validate the challenge token. This data is processed by Cloudflare under their Turnstile Privacy Policy, which you can read at: cloudflare.com/turnstile-privacy-policy
We do not receive or store the signals Cloudflare uses for verification — only the challenge result is used to allow or reject the request.
6. Infrastructure & sub-processors
UniOrg is built on Cloudflare's platform. Your data is processed and stored using:
| Cloudflare Workers | Serves the application and API endpoints |
| Cloudflare D1 | Relational database where all user data is stored |
| Cloudflare Observability | Basic request metrics (no personal data in dashboards) |
Cloudflare's privacy policy applies to infrastructure-level data: cloudflare.com/privacypolicy
7. Data retention
Your data is retained for as long as your account exists. Sessions expire automatically. There is no automated deletion of account or subject data — it persists until you delete it yourself.
Deleting your account removes all associated data immediately and permanently: your profile, all semesters, subjects, settings, active sessions, and linked accounts. This is enforced at the database level and cannot be undone.
8. Your rights & how to delete your data
You have full control over your data at any time:
- Individual subjects — use the delete button on any subject card.
- All subjects — use the “Clear all” button on the dashboard.
- Export your data — go to your profile (/me) → Danger Zone → Export. Downloads all your semesters, subjects, and settings as a JSON file.
- Delete your account — go to your profile (/me) → Danger Zone → Delete account. Permanently removes your account and all associated data. Requires typing “delete” to confirm and cannot be undone.
We do not sell your data. We do not use your data for advertising.
9. Changes to this policy
If we make material changes to this policy we will update the “Last updated” date at the top of this page. Continued use of UniOrg after changes are posted constitutes acceptance of the updated policy.