Privacy Policy

Information depends on the features you use. It may include:

• Account name, email address, password authentication records, email verification status, account roles, and account status.
• Member profile and onboarding details: name, faculty or program, year of study, AI experience, goals, interests, availability, preferred track, project ideas, and mentoring or leadership interests.
• Course interests, event registrations and waitlists, attendance, Lab applications, team participation, project descriptions, links, milestones, uploaded evidence, and publication choices.
• Community posts, replies, reports, and moderation records; mentoring, project reviews, Demo Day submissions and judging, and opportunity participation records where those activities apply.
• Session and security information, including session timestamps, IP addresses, browser information, authentication rate-limit records, administrative audit records, and operational logs.
• Email delivery records, including recipient addresses, the associated event, delivery status, attempts, provider message IDs, and recorded failures.

Please avoid submitting sensitive personal information or information about others that is not needed for a club activity.

Information supports account access, onboarding, learning-path suggestions, course interests, event registration and attendance, Lab and team administration, project development, mentoring, Community participation, showcase publication, and opportunities.

Authorized club operators also use records to manage membership, review participation and program outcomes, moderate content, investigate problems, and maintain security. Information submitted for a particular activity may be available to the operators responsible for it.

Account verification and password-reset emails may be sent when those features are used and email delivery is configured. When an administrator publishes a new event and enables its announcement, the website selects active accounts with completed onboarding and the MEMBER role; verified email is also required when email verification is enabled. Event announcements include public event details and a link to the event page.

The website currently has no built-in event-email preference centre, member email-consent setting, or automated unsubscribe mechanism. Contact aicia.uoft@gmail.com with questions or requests about communications. This contact route is not an automated unsubscribe feature, and this policy does not treat account registration as consent to every type of email.

The club authorizes the website to send messages from aicia.uoft@gmail.com through the Google Gmail API. This integration is designed for the Gmail send-only permission and uses the club account's authorization. It does not ask members to authorize their Gmail accounts or request access to members' inboxes, messages, or contacts.

Google processes outgoing message content and recipient addresses to provide email delivery. The application records delivery results; provider acceptance does not guarantee inbox delivery.

The website uses Better Auth for authentication and PostgreSQL for application records. Hosting and database operators process information needed to run the deployed website. Uploaded files use local server storage or configured S3-compatible object storage. The specific hosting, database, and storage providers and locations depend on the deployment; contact AICIA for details about the current setup.

The email system supports Google Gmail API and an alternative Resend provider, depending on configuration. Embedded videos use YouTube's privacy-enhanced player. Following external links or loading third-party content may allow that service to receive information about your visit and use its own cookies. Those services have their own privacy practices.

Account and membership records are restricted through application access controls. Administrators and authorized instructors, Lab leads, mentors, or judges can access information appropriate to their roles and assigned activities. Eligible signed-in members can see Community contributions, including displayed author identities; Community discussions are not public.

Approved project showcases and selected evidence can be public through the existing publication and participant-consent workflow. Published learning-resource metadata may be public even when its content is members-only. Public resources and public project content can be viewed or copied by visitors; avoid including private information in material intended for publication.

Service providers receive information needed for hosting, database, storage, or email operations. AICIA may need to disclose information in response to an applicable legal requirement; contact the club with questions about a specific disclosure or request.

Application safeguards include server-side access checks, session expiry, authentication rate limiting, password authentication, upload validation, protected file-delivery routes, security headers, and redaction of sensitive credentials in structured logs. Secure cookies and HTTPS are required by the production configuration.

No website, storage system, or email service can guarantee absolute security. Do not share your password, and contact AICIA if you suspect unauthorized access or a privacy problem.

The application retains account, participation, content, delivery, and audit records. Account deactivation disables access and removes sessions; it does not erase all account or activity data. Community removal and file replacement use soft deletion, so records, moderation information, stored objects, and backups may remain after content stops appearing in the interface.

There is no self-service account-erasure feature or application-wide automatic retention schedule. Contact aicia.uoft@gmail.com to request access, correction, or deletion. AICIA will assess the request, including related contributors' records and applicable requirements; deletion from every record, backup, or external service is not promised immediately.

Authentication uses cookies to maintain and validate your session. Blocking these cookies may prevent sign-in or member features from working. Authentication also stores session and rate-limit information for security.

The application currently contains no advertising trackers or third-party website-analytics integration. Club program reports use recorded participation data rather than an advertising-tracking system. Embedded YouTube content and other external services may use their own technologies as described above.

You can update available profile fields through your member account and contact aicia.uoft@gmail.com to ask about your information, request corrections or deletion, or raise a privacy concern. AICIA may need to verify your identity before handling a request. Applicable privacy requirements and the circumstances of the request may affect what can be provided or removed.

This policy may change as club activities, website features, or service arrangements change. Updates will appear on this page with a revised last-updated date. Questions can be sent to aicia.uoft@gmail.com.

AICIA is presented as a student-led club; no institutional endorsement is implied. See the Terms of Service for website-use expectations.