Privacy

StarsTask is open-source software. The person or team that deploys it is the operator of this instance and decides how it is run. This page describes the behaviour of the software itself. Your institution does not automatically receive your data.

We store only what the features you use require. Depending on how you use StarsTask, that can include:

• Account data from Google sign-in: your Google account identifier, name, email address, and avatar URL.
• Profile data you add: display name, avatar, student ID number (NIM), declared position (student or class representative), and biography.
• Class data: class memberships, admin roles, invitations you create or accept, and the class metadata you enter.
• Academic content: assignments and announcements, submissions and their attachments, revision history, reports, session RSVPs, attendance records, leave requests with supporting evidence, document-reader output, and class-representative verification material.
• Notification data: notification preferences, inbox read state, delivery records, and browser push endpoints and keys for devices you enable.
• Optional calendar data: encrypted Google Calendar tokens and event identifiers when you connect a calendar, and a hashed token for your personal calendar feed.
• Operational data: audit records, sanitised error events, sign-in activity, and rate-limit counters.

Session cookies keep you signed in. Local browser storage remembers small interface preferences, such as whether the sidebar is collapsed.

• Public visitors can see active class directory metadata: class name, code, course, institution, lecturer name, semester, and academic year.
• Signed-in users can see approved assignment briefs and their attachments. Browsing assignments requires a session.
• Class members and class admins can see the class roster, published class content, sessions, and attendance. Class admins can also review submissions and leave requests for their own class.
• Platform administrators can moderate published content, review class applications and representative verification, and read the audit trail.
• No one else can read your email address, student ID number, leave details, evidence files, document-reader output, push endpoints, calendar tokens, or precise check-in coordinates through the application. Published class metadata never includes personal contact details.

We use this data to sign you in, run your classes, deliver notifications you request, keep academic records consistent, protect the service from abuse, and investigate failures. We do not sell personal data, run advertising, or use third-party analytics or session-replay tools.

The deployment relies on infrastructure providers to store data and deliver the service: Supabase for authentication, database, and private file storage; Google for sign-in and, only if you connect it, calendar access; the hosting provider for serving the application; and browser push services for delivering notifications. These providers process data on the operator's behalf.

Check-in coordinates are removed by a scheduled job after the configured retention window while attendance status and distance are kept for review. Notification delivery records may also be purged on a schedule. Other records are kept while the related class or account is active, because they are academic history, and are removed through normal deletion flows or a verified request.

StarsTask does not yet offer self-service account deletion. Ask the operator to delete your account and explain which records must be retained. Backups may keep copies for a limited period before they rotate out.

• Edit your profile at any time from Settings.
• Disable browser push or disconnect Google Calendar from Settings; this deletes the stored subscription or tokens.
• Ask for a copy, correction, or deletion of your personal data. Some academic records may need to be retained, and we will explain why.
• Raise a concern with the operator. You may also have rights under the law that applies where you live.

Access is enforced on the server and in the database with row-level security. Evidence and attachments live in private storage and are served through short-lived signed links. Service credentials stay on the server and are never sent to the browser. No system is perfectly secure; report a suspected issue to the operator promptly.

StarsTask is intended for university students and is not directed at children. Do not create an account if you are below the minimum age required by your institution or local law.

We will update this page when the data practices change. The date at the top shows the latest revision.