Policy and privacy

I. Scope and operator

Last updated: 12 October 2026. ClubList, available at clublist.scholarbridge.tech, is a directory and management platform for student clubs, projects and organizations, developed by the ScholarBridge educational technology project.

This policy applies to visitors who are not signed in, public account users, registration applicants, club leaders and administrators, Platform staff, and people interacting with content or ClubList Agent.

II. Data ClubList collects and processes

2.1 Visitors who are not signed in

No raw IP address storage: The application uses IP addresses during request processing to prevent spam, enforce rate limits and protect the system. For club views, the application database stores only a one-way, per-club HMAC instead of the original IP address. Infrastructure providers may still process connection data under their own policies.
Qualified views: The clublist_viewer cookie contains a random device identifier, not a name or email. This identifier and the network-source identifier are hashed per club to avoid duplicate view counting within 24 hours and prevent abuse. View logs older than 48 hours are cleaned up daily.
Technical request data: ClubList may process paths, methods, status codes, durations, request identifiers and error types for operations, security and troubleshooting. Application logs are bounded and sanitized and must not contain passwords, tokens, cookies, complete request bodies or raw IP addresses.

2.2 Public accounts and personalization

Account information: When you sign in with Google through Supabase Auth, ClubList stores your Supabase user identifier, normalized Gmail address, display name, Google profile image if available, account status, sign-in timestamps and account preferences.
Interests and interactions: If you use account features, ClubList stores your selected interests, followed clubs, liked posts, notification preferences, notification inbox and aggregate interaction scores per club. ClubList does not store detailed scroll history or a comprehensive anonymous tracking profile.
Bounded personalization: The feed uses qualified club views, post opens, follows, likes, selected interests and content freshness for bounded ranking. You can disable personalization or delete your interaction-score data.

2.3 Registration, club administration and Platform

Registration and ownership-transfer requests: ClubList processes the applicant's name, email, phone number if provided, school or area, organization name and description, Facebook page and review status. Ownership-transfer requests may contain the current owner's and new recipient's email addresses.
Administrator accounts: ClubList stores email addresses, one-way hashed administrator passwords for password-based accounts, memberships, roles, session versions, invitations, time-limited activation or reset tokens and necessary operational activity history.
Public content and profiles: Clubs and Platform staff may provide names, images, biographies, contact channels, logos, covers, posts, guides, events, projects, recruitment campaigns, documents, images and videos. Content marked public is visible to visitors and search engines.

2.4 ClubList Agent

Content sent to Agent: When you actively message ClubList Agent, your messages, bounded page context and necessary tool results may be sent to the model provider to generate an answer. Do not enter passwords, tokens, sensitive information or unnecessary personal data into the conversation.
Agent logs: ClubList stores bounded operational metadata such as actor type, provider, model, timestamps, token and step counts, tool names, error codes and argument hashes. Agent log tables do not store conversation transcripts, answers, reasoning chains, cookies, IP addresses or raw draft content.
Free guest question: Guests may submit one server-admitted question before signing in. The HttpOnly clublist_agent_guest cookie contains a signed random browser identifier. Redis retains HMAC identifiers for the browser and IP for up to 365 days to prevent resetting the allowance through incognito tabs. These keys contain neither raw IP addresses nor conversations. People sharing a network may need to sign in after that network's first question. Admitted questions still count if Agent refuses the content or the AI provider fails.
Browser conversation recovery: For public sessions, up to 20 text messages within a bounded total size may be kept in the same tab's sessionStorage. This is not server memory, is not synchronized across devices, and is partitioned when the identity or active club changes.

III. Purposes of processing

Providing the service: Operating the directory, search, club pages, public content, sign-in, administration, interactions, notifications, handbook and ClubList Agent.
Review and communication: Verifying registrations, managing ownership, sending sign-in or activation links and necessary transactional emails or operational alerts.
Safety and integrity: Preventing spam, view fraud, password guessing, unauthorized access, invalid uploads and harmful activities, and investigating incidents using sanitized logs.
Improving the experience: Recommending content based on context and selected interests, measuring bounded performance signals and maintaining product reliability without selling personal data for advertising.

Public user sessions: Supabase manages clublist_user_auth cookies for sign-in. clublist_user_ui is only a display hint and grants no permissions. The short-lived clublist_user_next cookie returns users to a validated internal path after sign-in.
Club and Platform sessions: club_admin_session authenticates club administration; clublist_staff_session authenticates Platform staff; clublist_club_selection supports club selection. clublist_admin_ui contains only bounded display data and is not a credential. Permissions are always rechecked on the server.
Duplicate-count prevention: clublist_viewer is an HttpOnly cookie containing a random identifier used to prevent duplicate or fraudulent views. It contains no name, email or account permissions.
Local storage: localStorage, sessionStorage, IndexedDB and browser caches may store handbook reading settings and progress, editor recovery drafts, unsaved media, interface state, performance samples and bounded public Agent conversations. You can remove these through the corresponding features or browser settings.
Optional offline content: When offline handbook reading is enabled and you opt to use it, your browser may save articles and related media in Cache Storage. You can remove this data from the device.

V. Service providers and third parties

ClubList transfers only the data needed by a provider to perform its function. Providers process data under their own terms and policies.

Infrastructure and authentication: Vercel hosts the application and processes aggregate performance signals through Analytics/Speed Insights. Supabase provides the database, public-user authentication and legacy image storage. Google provides OAuth sign-in. Cloudflare R2 stores new images and videos. Upstash Redis supports rate limiting.
Email and bot protection: Resend delivers transactional emails or alerts. Cloudflare Turnstile processes technical signals to verify registrations and prevent bots.
ClubList Agent and AI providers: Depending on deployment configuration, AWS Amazon Bedrock or Groq processes messages and necessary tool results for Agent chat. When knowledge retrieval is enabled, OpenRouter processes queries and public documents to generate embeddings. Before enabling private administrative context, ClubList reviews provider retention policies and disables prompt-content logging; Groq requires Zero Data Retention. Redis stores aggregate budget counters without conversations. HMAC burst-control identifiers last up to one minute and concurrent-inference limit keys last up to three minutes.
Content and media imports: When an administrator actively imports a Facebook post or searches for additional photos, the source URL and necessary content may be processed through RapidAPI services and a separate image worker. Valid results pass through ClubList's validation and storage pipeline.
Embeds and external links: ClubList may display or link to Facebook, Instagram, YouTube, Vimeo, TikTok, Heyzine, Google Forms and other websites. Loading embedded content or opening links may disclose connection data to third parties under their own policies. ClubList does not control that processing.
No sale of personal data: ClubList does not sell or rent personal data. Data is shared only to provide the service, secure the system, comply with valid legal requests or protect users' rights and safety.

VI. Retention and your controls

Specific retention periods: Duplicate-view prevention logs are cleaned up after more than 48 hours. Personalization interaction scores expire after 90 days. SystemLog operational logs are retained for 30 days. Agent action approvals expire after 5 minutes. Facebook photo-search queue metadata expires after 1 hour.
Accounts and content: Account data, memberships, requests, content and media are retained while needed to provide the service, maintain public content, resolve disputes, prevent abuse or meet valid obligations. Backups and caches may take additional time to reach the end of their technical lifecycle.
Account and personalization controls: You can edit your display name and interests, disable personalization, clear interaction scores, unfollow clubs or mute notifications, and delete your account. Deleting a public account removes its Supabase identity and related PublicUser data, including interests, follows, likes, interaction scores and notification inbox. Operational metadata separated from content may be retained for security and system integrity.
Support requests: To request access, correction or deletion of data, or report privacy issues that cannot be addressed through your account, contact the official ClubList Facebook page at facebook.com/clublist.scholarbridge. ClubList may need to verify your identity and authority to represent an organization before processing the request.

VII. Account and data security

Separate access realms: Public users, club administrators and Platform staff have separate authentication realms. Matching email addresses do not automatically grant permissions. Protected operations check sessions, roles, memberships and account status on the server.
Passwords and tokens: Administrator passwords are one-way hashed using bcrypt with cost 12. Single-use activation tokens typically last 7 days and password-reset links last 24 hours. Authentication tokens and cookies have bounded scope, lifetime and permissions.
Operational protection: ClubList uses same-origin checks, distributed rate limits, file type and size validation, URL allowlists, server-side authorization, log redaction and other technical measures. No system is absolutely secure. Protect your account and promptly report unusual activity.

VIII. Content, intellectual property and responsibility

Clubs and projects retain rights to content they create and grant ClubList a non-exclusive right to display published content for outreach and student connections. Publishers must have rights to their images, videos, text and documents. Impersonation, fraud, rights violations, harmful content and content that breaches educational-environment rules are prohibited.

ClubList may hide, restrict or suspend content or club pages when it identifies violations, safety risks, impersonation or valid requests from schools or competent authorities. Before providing data through external forms or websites linked by clubs, users should check those services' policies and safety.

IX. Policy updates

ClubList may update this policy when its product, providers or operational requirements change. Material changes will be announced on the platform and, where appropriate, through administrator email. The public version at this link is the version currently in effect.

Data Protection & Privacy Policy