Privacy policy

Philopateer Christian College runs the PCC Alumni Platform. We are the school, and we are responsible for your information on it.

AZDEVS builds and maintains the platform on the school's behalf.

When you join, we ask for your name, your email address and your class year. If you register on the website you can also leave a short note for the school.

You can add more to your profile if you wish:

• a phone number and a photo
• a headline, your city and country, and a favourite quote
• your favourite teachers and the milestones on your Road from PCC
• whether you would like to mentor, the topics you could help with, and whether you are hiring

We also keep what you do on the platform:

• connection requests and the short note that can go with one
• mentorship requests and the notes you write
• event RSVPs and check-ins
• memories you submit
• your notification preferences

A few things are recorded for the platform to work. Your sign-in is kept so you stay signed in. A scrambled form of your IP address (never the address itself) is held for a short time, never more than two hours, to slow down repeated sign-in and sign-up attempts. When you sign up we also record that you agreed to the terms and this policy, with the date and which versions you agreed to. Our hosting provider keeps routine server logs. And the school keeps an internal log of important actions, such as approving a registration or deleting an account, that only administrators can read.

Signing in with Google is optional. You can always use your email address and a password instead. If you choose Google, it confirms that you own your email address and sends us your name and a code that identifies your Google account. We send Google nothing from the platform. Google also learns that you signed in to PCC Alumni, and looks after that under its own privacy policy.

• to run a private community for PCC graduates
• to let you find and connect with other members
• to arrange mentorship introductions
• to run events, take RSVPs and check guests in at the door
• to send the emails you would expect, such as approvals, introductions and event confirmations (you can turn most of them off in Edit profile)
• to keep the community safe

We do not sell your information, and we do not use it for advertising.

Other members see the public parts of your profile, such as your name, class year, photo, headline, city and country, quote and the road you have travelled, and only the ones your visibility settings allow. Your email address and your phone number are never shown to other members. Your photo is a private file, shown to signed-in members through links that expire after about 50 minutes.

A connection request and its note go to the person you send it to. There are no private messages on the platform.

When the school arranges a mentorship introduction, it emails both people (each one who has email notifications on), and replying to that email reaches the other person. That is the only way one member's email address reaches another, and it only happens through an introduction the school has arranged.

Memories are read by the school before they appear. Once approved, a memory shows on the Memory Wall for signed-in members, with your name and class year.

School staff and administrators can see account details, including email addresses and phone numbers, registrations, connection and mentorship requests, RSVPs and check-ins, so they can run the platform. One operations account, held by the platform's developer, can see the same so the platform can be maintained. It does not appear in the yearbook, in search or on the map.

People who are not signed in see only the front page. It shows no member information, only the number of graduates and countries once there are enough for the number to mean something.

The platform is closed. Every account comes through the school: an invitation, a registration the school reviews, or a sign-up at one of the school's own events.

If a registration's class year suggests the person is under 18, the school will not approve it until a parent or guardian's consent has been received in writing and recorded.

People get in touch through connection requests and through introductions the school arranges, not through open messages.

We use a small number of companies to run the platform. Each does one job, and this is where each one processes information:

Supabase

Our database, sign-in and file storage. Everything you give us: account details, your profile and photo, requests, memories, RSVPs, and a scrambled form of your password (never the password itself). If you sign in with Google, it also holds the identity Google gives us: a code for your Google account, your email address and your name. Canada (Montréal, the ca-central-1 region).Kept until your account is deleted, then removed from the live database within 30 days. Daily backups are kept for 7 days.

Vercel

Hosting: it runs the website. The pages and forms as you use them, including what you type while it passes through our server, and routine server logs (your IP address, the address of the page and the time). The United States. The website's server code runs in Virginia (the iad1 region), and your connection first arrives at a Vercel location in Canada (Montréal).Routine logs are kept for a short time under Vercel's own plan. We do not store them ourselves.

Resend

Sending the emails the platform sends. Your name and email address, and the text of each email we send you (welcomes, approvals, introductions, event confirmations). The United States (Virginia, the us-east-1 region).Resend keeps a record of each message for the period set in its account. We have not changed it.

Upstash

Rate limiting: it slows down repeated sign-in and sign-up attempts. A scrambled form of your IP address (not the address itself), kept as a counter. Canada (the ca-central-1 region).Each counter removes itself, within two hours at most.

Google

Sign in with Google, only if you choose it: it confirms that you own your email address, so you can join or sign in without a password. Your Google account's email address and name, and a confirmation that you signed in, which it sends us through our sign-in provider. We send it nothing from the platform: no profile, photo, class year or message. It also learns that you signed in to PCC Alumni. Wherever Google runs its services: it keeps servers around the world, including outside Canada, and does not tell us where a given sign-in is processed. Google LLC is in the United States.We keep what Google sends us for as long as your account exists (your email address and name are already on your profile). Google keeps its own record under its own privacy policy, which you can manage in your Google account.

Our database and sign-in, and the service that limits repeated attempts, are in Canada. Our website's servers and our email service are in the United States. Because some processing happens outside Canada, information may be subject to the laws of that country, and may be accessible to its courts, law enforcement and national security authorities.

These are all the cookies the platform sets, and we use no other browser storage. Every one is strictly necessary for the platform to work, which is why there is no cookie banner to accept:

We do not use advertising, analytics services, third-party embeds or external fonts. Nothing on our pages loads from another company's website, and the country outlines on the map are served from our own site. We do count visits ourselves, in a way that needs no cookie. The next section says how.

We count how many people open our public pages (the home page, the sign-up pages, and the privacy policy, terms and guidelines) and how many of them go on to sign up. We do it to see which invitations work: a poster at the door, a card on a table, a link someone shared.

What we keep is a total for each day and each link or code, such as the number of visits that came through one poster. A link or code can carry a short tag, like front-door, and that tag is counted with the totals. We do not set a cookie or store anything on your device for this. We do not record your IP address, your device or your browser, so a count cannot be traced back to a person.

If your browser tells websites not to track you (Do Not Track or Global Privacy Control), we do not count your visit at all. We do not count the pages you use after you sign in. To stop one device from inflating the totals, the same short-lived scrambled form of your IP address described above is used to limit how often a visit is counted. It is never kept with the counts.

We keep your information while you belong to the community, and no longer than we need it. This is how long we keep each kind:

• Your account details. We keep them while your account is active. When you ask us to delete your account, we remove them from our live systems within 30 days.
• Registrations the school does not approve. We remove them after 90 days.
• The school's activity log of important actions. We keep it for 24 months.
• Backups. Our database provider takes a backup every day and keeps each for 7 days. Something you ask us to delete can stay in a backup until it is replaced.
• Counts of visits and sign-ups. We keep these totals. They hold nothing that identifies a person.

An account the school has deactivated stays on record until the school deletes it.

You can change most of your profile yourself in Edit profile. To see what we hold about you, to have something corrected, or to have your account deleted, ask the school (see Contact below).

When the school deletes an account, it removes your profile and your sign-in. A few records stay: memories you wrote can remain on the wall without your name, and the internal log keeps a note that the account was deleted, which can include the name and email address of that account.

We aim to handle your information in line with the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and good privacy practice in Ontario.

If we change this policy, we will update the date at the top of this page. When a change affects how we use members' information, we will also tell members by email.

Questions, and requests to see, correct or delete your information, go to the school: