COA Privacy Policy

COA - Commitment of Academia is a student workspace for organizing school work and study activity. This policy explains what data COA requests, why it is requested, how it is used, and how COA protects user information, including Google user data.

Information you provide

COA stores the account and workspace data needed to run the app, including username, display name, school name, password hash, profile fields, homework, reminders, notes, flashcards, schedules, grades, budget entries, public posts, friend requests, private messages, reports, moderation records, and locally saved synced item copies.

Google data requested

Google connection is optional. COA requests Google data only after a user chooses to connect Google and approves the OAuth consent screen. COA uses Google data for the following purposes:

• Google Classroom course and coursework data: to show school assignments inside the COA dashboard.
• Google Calendar and Meet event data: to show upcoming school events, deadlines, and meeting context.
• Gmail metadata: to show school-related message context such as sender, recipient, subject, date, headers, and labels. COA does not intentionally read or store email body content.
• Google profile information: to let the user fill their COA profile name, email, and avatar if they choose.

How data is used

COA uses user data to authenticate accounts, save student workspace content, display assignments and events, support social study features, deliver private messages between accepted friends, handle safety reports, and operate moderation tools. COA uses Google user data only to provide the user-facing features that the user requested by connecting Google.

How COA protects Google user data

Security procedures are in place to protect the confidentiality, integrity, and availability of user data, including Google user data. COA applies the following data protection mechanisms:

• Encryption in transit: COA is intended to be accessed over HTTPS in production so that data sent between the user's browser, COA, and Google APIs is protected during transmission.
• Secure OAuth authorization: Google data is accessed only through Google's OAuth authorization process after the user grants consent. COA does not ask users to share their Google password.
• Limited access tokens: Google access is limited to the scopes approved by the user on the OAuth consent screen. COA uses those permissions only for the related Classroom, Calendar, Meet, Gmail metadata, and profile features.
• Password protection: COA stores COA account passwords as salted password hashes instead of storing plain-text passwords.
• Session protection: COA uses signed-in session tokens for app access and checks authentication before returning private workspace information.
• Access controls: Google user data is associated with the user's own COA account. Other COA users cannot access another user's private Google sync data through normal app features.
• Data minimization: COA requests and stores only the Google data needed for the app features. For Gmail, COA uses message metadata for school context and does not intentionally read or store full email body content.
• Restricted human access: COA does not allow humans to read Google user data except when necessary for security, legal compliance, abuse investigation, or user-requested support.
• No advertising use: COA does not use Google user data for advertising, ad targeting, credit decisions, or unrelated profiling.
• No sale of data: COA does not sell Google user data or other user data.
• Operational safeguards: COA keeps application data in controlled server-side storage and uses application logic to separate account data, workspace data, messages, reports, and optional Google sync data.
• Revocation control: Users can disconnect Google access at any time from their Google Account permissions page. After access is disconnected, COA can no longer request new Google data unless the user reconnects Google.
• Retention limits: Locally saved Google sync copies remain only as long as needed to provide the connected features or while the user's COA account remains active, unless deletion is required sooner by the user or by an applicable moderation, safety, or legal process.
• Deletion on request: Users may stop using Google sync, disconnect Google permissions, or request removal of their locally stored COA workspace data and locally saved Google sync copies.

Google API Limited Use

COA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. COA does not use Google user data for advertising, does not sell Google user data, and does not allow humans to read Google user data except when necessary for security, legal compliance, abuse investigation, or user-requested support.

Data sharing

COA does not sell user data. User data is not shared with advertisers. Google user data is not shared with third parties except when necessary to provide the requested COA feature, comply with law, protect against abuse or security threats, or respond to a user-requested support issue. User-created public posts and basic public profile details may be visible to other COA users. Private messages are visible only to the message participants and to authorized moderation workflows when needed for safety reports or abuse review.

Retention and control

Workspace data remains stored while the account is active. Private chat history remains saved to the user's account unless removed by the user or moderation workflow. Locally saved Google sync copies may remain in the user's COA workspace so assignments, events, and message metadata can be displayed in the dashboard. Users can disconnect Google access from their Google Account permissions page and can stop using Google sync at any time.

Security

COA stores passwords as salted hashes, uses session tokens for signed-in app access, and is intended to run over HTTPS in production. We use encryption in transit to protect information sent between the user, COA, and Google APIs. Users should avoid adding sensitive personal, financial, health, or identity information to homework notes, posts, chats, or profile fields unless it is necessary for their own school organization.

Contact and homepage

The public homepage should be hosted at https://commitmentofacademia.com. This privacy policy should be hosted at https://commitmentofacademia.com/privacy, is available without logging in, and should match the privacy-policy URL configured on the OAuth consent screen.