Privacy Policy

CeidCoursePilot is operated by an independent maintainer based in Greece. In this notice, “we” refers to the maintainer responsible for the service and its personal-data processing. Contact us at up1100565@ac.upatras.gr. This notice applies to ceidcoursepilot.xyz and the same service accessed through its Vercel address.

We process your account identifier, email, profile name and photo, sign-in provider, account timestamps and profile preferences. Email/password authentication is handled by Supabase.

If you choose Google sign-in, Google supplies your basic identity information: identifier, name, email and available profile photo. This integration does not request access to Gmail messages, Drive files, contacts or calendars. We do not receive your Google password. Google identity information is used for authentication and profile display, not targeted advertising or training general-purpose AI models.

We store plan names, course and major selections, scenarios, semester assignments, sharing settings, shared links and preferences so you can use and resume your plans. We also process app ratings you submit and related prompt timestamps. Support messages include the content and contact details you provide.

When you enable sharing, people who obtain the link may access and copy the shared plan. Avoid confidential information in shared content. Revoking a link or deleting a source does not recall copies already saved by other people.

The app records page paths, page durations, feature events, a browser-generated analytics identifier, device category and approximate country. These events may be associated with your account when signed in. Authenticated page views can also record your IP address, browser and operating system. Installation records include installation/access timestamps and device information. This first-party analytics should not be treated as anonymous.

We also use Vercel Web Analytics and Speed Insights for traffic and performance measurement, separately from the app’s own analytics. Hosting and authentication providers process technical logs. App crash reports contain limited route/error categories and compiled JavaScript frame locations, rather than raw error messages or page query strings.

Account and planning processing provides the features you request, including sign-in, saving, export and sharing. Its legal basis is performance of our agreement with you or steps you request before entering it. Security, troubleshooting, support and evaluation of service usage rely on legitimate interests in maintaining a useful and reliable service, subject to necessity and your rights. Applicable legal obligations may require additional processing.

Authentication cookies maintain your session. Browser storage also supports preferences, course caches, installation state and the return path after Google sign-in. The current app automatically records usage events and stores an analytics identifier in local storage. Browser controls can restrict storage, but blocking necessary authentication storage can prevent sign-in. Browser settings and acceptance of the Terms do not replace consent where applicable law requires it. Contact us to object to usage processing associated with your account.

Supabase provides authentication and database services. Vercel provides hosting, delivery, logging, traffic measurement and performance monitoring. Google provides identity information when you use Google sign-in. Email providers process support correspondence and service email where used.

Authorized maintainers can access information needed for administration, support and troubleshooting. We do not sell your personal data. Disclosure may also be necessary to meet legal requirements or establish, exercise or defend legal claims. Shared-plan recipients receive the content you choose to share.

Account and planning data is kept while your account is active and needed for the service. You can request account deletion from your profile. Contact us about associated data, exports or information you cannot manage in the interface.

Usage records, support messages and technical logs can have different retention needs, based on investigating issues, service security, answering requests and legal obligations. The app does not currently configure a single automatic expiry period for all analytics records. Account deletion does not guarantee immediate disappearance of every technical record, usage event or provider backup. We review requests covering remaining identifiable data and relevant retention obligations; backups follow provider lifecycles. We do not control copies already retained by shared-plan recipients.

The maintainer is based in Greece and the Supabase database is configured in Frankfurt, Germany. Hosting, support and other provider operations may involve processing outside the European Economic Area. An EU database location does not mean all processing remains in the EU. International transfers require an applicable legal mechanism and safeguards; contact us for details about the arrangements relevant to your data.

We use HTTPS and account access controls. No online service guarantees absolute security. Protect your credentials and contact us if you suspect unauthorized access.

Depending on the circumstances, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Where consent is the legal basis, you may withdraw it without affecting the lawfulness of earlier processing. Proportionate identity verification may be needed.

Send requests to up1100565@ac.upatras.gr. GDPR requests are normally answered within one month; if a lawful extension is necessary, we will explain it within that initial period. You may complain to the Hellenic Data Protection Authority at dpa.gr or another competent authority. Course suggestions do not make official admission, grading or degree decisions about you.

The service is intended for university students and is not directed at children under 16. Contact us if you believe a child has supplied personal data. This notice may change as our practices change. The date above identifies this version. Material changes require appropriate notice and new consent where legally required.