DiplomaHub Privacy Policy

1. Who This Applies To

DiplomaHub is intended for users 13 years of age or older. If you are under the age of majority in your jurisdiction, you confirm that you have permission from a parent or guardian to use the Platform, where required by local law.

We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly.

2. Information We Collect

Information you provide directly:

• Account information (name, email address, password — handled via Supabase Auth). If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Profile information (IB year/grade, bio, if provided)
• Content you submit (articles, resources, comments, and discussion posts submitted before the discussion feature was retired)
• Hub planner data: the subjects and levels you select, and the items you add, including their titles, dates and times, subject, type, stages, completion status, and notes
• Study sessions you record with the Hub focus timer
• Calendar events you choose to import from a calendar file (see Section 5)
• Communications with us (support requests, feedback)

Information collected automatically:

• Basic usage data (pages visited, actions taken, timestamps) for the purpose of improving the Platform
• Standard technical data (IP address, browser type, device type) collected by our hosting provider (Vercel) and database provider (Supabase)
• If you create a private calendar link, the time it was most recently accessed by a calendar app

Cookies and browser storage:

We use essential cookies to keep you signed in and to secure the sign-in process. We may also use your browser's local storage to remember interface preferences on your device. These are necessary for the Platform to work, and we do not use advertising cookies.

We do not use third-party advertising trackers or sell user data to advertisers.

3. How We Use Information

We use collected information to:

• Create and manage your account
• Display your public profile and contributions to other users
• Operate reputation/trust features (e.g., contribution history, badges)
• Provide the Hub, including your calendar, today's focus, progress tracking, and resources related to your tasks
• Process calendar files you choose to import and generate your private calendar link when you create one
• Send account emails, such as sign-up confirmation and password reset messages
• Improve and maintain the Platform
• Communicate with you about your account or platform updates
• Enforce our Terms of Service and keep the community safe

4. How Information Is Shared

• Other users: Your profile, articles, comments, and published resources are visible to other users of the Platform (and, for public pages, to visitors without an account), depending on your privacy settings. Your Hub planner data is private and is not visible to other users.
• Service providers: We use Supabase (database, authentication, storage), Vercel (hosting), Resend (email delivery), and Google (sign-in with Google and email correspondence through Google Workspace) to operate the Platform. These providers process data on our behalf under their own security and privacy commitments.
• Calendar apps you connect:If you add your private calendar link to Google Calendar, Apple Calendar, Outlook, or another calendar app, that app's provider retrieves the information included in your calendar feed (see Section 5) and handles it under its own privacy policy. This only happens if you choose to add the link.
• Legal requirements: We may disclose information if required by law, or to protect the rights, safety, or property of DiplomaHub, our users, or others.
• We do not sell your personal information to third parties.

5. The Hub and Calendar Features

Planner data

Items, subjects, notes, and study sessions in the Hub are private to your account. Access controls ensure that only you can view or change them.

Importing calendar files

When you upload a calendar file (.ics), we read it on our servers to show you a preview. Only the events you select and confirm are saved. For those events, we store the title, date and time, and the event's identifier from the file, which we use to avoid creating duplicates if you import the same file again. We do not store event descriptions, locations, or attendee information, and the uploaded file itself is not kept after it has been processed. You can undo an import from the Hub.

Private calendar link

If you create a calendar link, we generate a unique secret link that lets calendar apps display your Hub items. We store only a hashed version of the link's secret, so we cannot recover the link itself. The feed includes item titles, subjects, dates, times, and completion status. It never includes your notes.

Anyone who has your link can see the information in your feed, so do not share it. You can generate a new link at any time, which immediately stops the old link from working. Calendar apps may continue to show events they have already downloaded until they refresh or you remove the calendar from the app.

6. Data Retention

We retain account and content data for as long as your account is active. Hub planner items are kept until you delete them or delete your account. Deleting your account also deletes your planner items, imported events, study sessions, and calendar link.

You may request deletion of your account and associated personal data at any time by contacting us (see Section 12). Deleted data may remain in backups maintained by our service providers for a limited period before it is overwritten. Some content (e.g., discussion replies) may be retained in anonymized form to preserve conversation context.

7. Security

We protect your information using encrypted connections (HTTPS), database access controls that restrict each user to their own private data, and authentication handled by Supabase Auth, which does not store passwords in plain text. Calendar link secrets are stored only in hashed form. No method of transmission or storage is completely secure, so if you believe your account has been compromised, please contact us.

8. Legal Basis for Processing (GDPR)

DiplomaHub is operated from Germany, and personal data is processed in accordance with the EU General Data Protection Regulation (GDPR). We process your data on the following legal bases:

• Contract(Art. 6(1)(b) GDPR): to create your account and provide the Platform's core features, including the Hub, calendar imports, and your private calendar link
• Legitimate interests (Art. 6(1)(f) GDPR): to maintain security, prevent abuse, and improve the Platform
• Consent (Art. 6(1)(a) GDPR): where you opt into optional features (e.g., a newsletter), which you may withdraw at any time
• Legal obligation (Art. 6(1)(c) GDPR): where processing is required to comply with applicable law

9. International Users & Data Transfers

DiplomaHub is used by IB students and alumni globally. By using the Platform, you understand that your information may be processed and stored in a country other than your own, including outside the EEA, depending on where our service providers (e.g., Supabase, Vercel, Resend, Google) operate their infrastructure. Where personal data is transferred outside the EEA, we rely on appropriate safeguards recognized under GDPR, such as Standard Contractual Clauses, to protect your data.

10. Your Rights (GDPR)

If you are located in the EEA, UK, or another jurisdiction with similar data protection laws, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Eraseyour data ("right to be forgotten"), subject to certain exceptions
• Restrict or object to certain processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority (in Germany, the relevant Landesdatenschutzbehörde for your state, or the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI))

To exercise any of these rights, contact us using the details in Section 12.

11. Your Choices

• You can access and update most profile information directly in your account settings.
• You can edit or delete your Hub items at any time, and undo calendar imports from the Hub.
• You can generate a new private calendar link at any time, which disables the old one, and remove the calendar from any calendar app you added it to.
• You can request a copy of your data, correction, or account deletion by contacting us.
• You can control what information appears on your public profile.

12. Contact Us

Questions about this Privacy Policy or your data, or requests to exercise your rights under Section 10, can be directed to: info@diplomahub.org

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date. If we make significant changes, we will also let you know by email or through a notice on the Platform.

14. Data Controller

The data controller responsible for your personal data under this Privacy Policy is:

ANDY NATHAN PIEUME TCHIYEP — info@diplomahub.org