Privacy Policy

1. Introduction & Overview

The Undergraduate Science Society of TMU (“USSTM”, “we”, “us”, or “our”) operates the USSTM Portal (the “Portal”), serving students and academic course unions and clubs at Toronto Metropolitan University, located at 40 Gould Street, Toronto, Ontario, Canada.

The USSTM Portal is an administrative and governance platform designed to:

• Grant authorized individuals explicit authority to act on behalf of USSTM and affiliated science clubs without using shared accounts.
• Publish scheduled student events through an open public calendar and API.
• Maintain an open Office Hours drop-in schedule for science students to connect with USSTM Board Members.
• Provide curated operations and finance resources for student groups.

We take the privacy of our members, student representatives, and visitors seriously. This Privacy Policy explains what personal information is collected, how it is used, where it is published, how it is retained, and how you can exercise your privacy rights under applicable Canadian privacy legislation (including PIPEDA and FIPPA, where applicable).

2. Core Architectural Privacy Principles

The USSTM Portal is intentionally built with strict data minimization, zero third-party tracking, and role-based security:

1. No Public Registration: The Portal does not support open self-registration. Only individuals explicitly admitted in advance by an authorized Administrator or the Superuser (“Members”) can sign in to authenticated features.
2. No Passwords Stored: We do not collect, hash, or store passwords. Authentication is handled exclusively through Google OAuth 2.0 with Proof Key for Code Exchange (PKCE).
3. Minimal OAuth Scopes: We request only the minimal permissions required to identify you (openid and email). We never request or access your Google Drive files, contacts, calendars, or other private profile details.
4. No Third-Party Trackers or Ad Networks: The Portal contains zero advertising, tracking pixels, or third-party analytics scripts (no Google Analytics, Meta Pixel, or commercial trackers).
5. Short-Lived, Stateless Sessions: We issue only host-only, signed, HTTP-only session cookies that automatically expire after eight (8) hours without sliding renewal or persistent “remember me” options.

3. Information We Collect and Process

A. Public Visitors and Students

If you visit the public-facing pages of the Portal or consume our public API:

• Technical Access Logs: Standard web server access logs (HTTP method, requested URL, response status, user agent, IP address, and internal request IDs) strictly for operational reliability, abuse mitigation, and security diagnostics.
• No Tracking Cookies: Visitors browsing public pages do not receive advertising, profiling, or tracking cookies.

B. Authenticated Members (Students & Representatives with Portal Grants)

When an admitted Member signs in using Google OAuth:

• Google Identity Information:
  • Verified Email Address: Provided by Google’s OpenID Connect user-info endpoint.
  • Email Verification Status: Confirming that the email address is actively verified by Google.
  • Note on Google Tokens: Google OAuth access tokens are held transiently in server memory solely to verify your email address with Google during login, after which they are immediately discarded. We never store Google access tokens or refresh tokens in our database.
• Member Profile Data (Configured by Administrators):
  • Display Name: Your chosen or official public name (e.g., “Jane Doe”).
  • Normalized Email Address: Used as the unique identifier to grant access.
  • Account Lifecycle Status: active or deactivated.
  • Authorization Grants: Specific organizational authority designations, including:
    • Club Access: Associations with designated student clubs (e.g., Biology Course Union, Chemistry Society).
    • Board Member Status: Your official executive or board title (e.g., “Vice President of Finance”).
    • Administrator Status: Authority to manage members, clubs, resources, and events.

C. Office Hours & Calendar Bookings

• Booking Records: When a Board Member reserves an Office Hours shift, the system records the date, time slot, and a snapshot of the Member’s Display Name and Board Position.
• Public Visibility: The current and upcoming week’s Office Hours calendar is publicly visible to all visitors so that TMU students know when student leaders are available in person for drop-in support.

D. Club & Event Management Data

• Club Information: Club short name, full name, and club contact email address.
• Event Listings: Event title, description, start and end timestamps, physical location (e.g., campus room or address), owning club, and collaborating organizing clubs.
• Public Exposure: Event listings have no draft state; when created, event details are immediately published to the unauthenticated public Events API (GET /api/v1/events) for consumption by student-facing feeds and campus screens.
• Internal Attribution: The system records the creating and editing Member IDs for internal accountability. This personal attribution is confidential and strictly excluded from the public Events API.

E. Administrative Audit Logs

• Under our institutional governance architecture, privileged administrative mutations (such as adding or modifying members, assigning board positions, or archiving clubs) generate an immutable audit log entry.
• Audit Data Collected: actorEmail (email of the administrator taking the action), action, targetType, targetId, changedValues (JSON diff of modified fields), and the exact timestamp.

4. How We Use Your Information

We process personal information only for legitimate educational, operational, and governance purposes:

• Authentication & Authorization: Verifying your identity through Google to ensure that only pre-approved student leaders and representatives access club and organizational records.
• Operations & Scheduling: Displaying scheduled Office Hours so science students can drop in to consult USSTM board representatives.
• Campus Event Dissemination: Distributing details of upcoming academic, networking, and social events organized by USSTM and affiliated science clubs.
• Institutional Accountability: Maintaining an immutable audit log of privileged administrative actions to protect organizational integrity and prevent unauthorized changes.
• System Security & Stability: Detecting and mitigating abuse, unauthorized access attempts, server errors, and technical anomalies.

5. Google API Services User Data Policy Compliance

The USSTM Portal complies with the Google API Services User Data Policy, including the Limited Use requirements:

• Specific Use: Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• No Data Transfers for Advertising: Data obtained from Google APIs (your verified email address) is never transferred to external parties, data brokers, or advertising networks.
• No Retargeting or Marketing: We do not use Google user data to serve advertisements, profile individuals, or send unsolicited marketing.
• Human Review Restrictions: Humans cannot inspect or read your raw Google authentication data unless you have given explicit consent for troubleshooting, it is necessary for security purposes, or it is strictly required by applicable law or university policy.

6. Cookies and Storage Technologies

The Portal uses only strictly necessary, functional cookies to support authentication and security:

We do not use cookies for analytics, tracking across third-party websites, or advertising.

7. How We Share or Disclose Information

We do not sell, rent, lease, or monetize your personal information. We disclose data only under the following specific circumstances:

• Publicly Visible Operational Features: Board Members’ display names and board titles on the Office Hours calendar, and event listings on the public Events API (GET /api/v1/events).
• Internal USSTM Administration: Authorized Administrators and the deployment Superuser can view member rosters, club associations, and administrative audit logs for governance purposes.
• Infrastructure & Service Providers: Google LLC (Identity Services for OAuth 2.0) and our self-hosted virtual private server in Canada with encrypted off-host automated disaster recovery backups.
• Legal & Safety Requirements: If required by applicable law, a valid subpoena, court order, or university governance policy, or to protect the safety and security of USSTM and TMU students.

8. Data Retention, Deactivation & Deletion Policy

Under our institutional records architecture:

1. Deactivation Instead of Permanent Deletion: When a Member graduates, leaves USSTM, or is removed, their profile is marked as deactivated rather than permanently deleted. Sign-in is immediately blocked, all authority grants are revoked, and future bookings are canceled.
2. Historical Accountability: Historical Office Hours shift bookings, event authorship records, and administrative audit entries remain intact to support student union financial transparency, governance accountability, and audit compliance.
3. Past Booking Snapshots: Bookings retain a static snapshot of the Member’s Display Name and Board Position at the time of booking so past calendar records remain stable.
4. Server Diagnostics & Backups: Server access logs are routinely rotated and retained for 30 to 90 days. Encrypted automated database backups follow our disaster recovery backup schedule.

9. Data Security Safeguards

We implement modern, defense-in-depth technical and organizational measures to safeguard your personal data:

• Transport Security: All traffic is encrypted in transit using TLS 1.3 / HTTPS terminated via Caddy.
• Asymmetric Key Cryptography: Authentication cookies are signed asymmetrically via private key on the auth microservice and verified via public key on the portal.
• Strict Boundary Validation: All incoming data is sanitized and validated using Zod schemas and parameterized SQL queries via Drizzle ORM.
• Origin & CSRF Defense: Strict origin validation and SameSite=Lax cookie policies protect all server mutations.
• Role-Based Authorization: Authorization checks are performed server-side on every individual request directly against database records.

10. Your Rights & Contact Information

Under Canadian privacy legislation and USSTM governance standards, you have rights regarding your personal information:

• Right to Inquire & Access: You may request to review what personal data USSTM holds regarding your membership or club representation.
• Right to Rectification: If your display name, club contact email, or associated details are inaccurate or out of date, you may request an update by contacting an Administrator.

If you have questions about how your data is handled or wish to submit a privacy concern, please contact:

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our operational procedures, technical architecture, or legal requirements. Any modifications will be posted to this page with an updated “Last Updated” date.