Privacy Policy

1. Scope of Data Collection

We collect personal information strictly necessary to establish your student dashboard, verified portfolio, and university connection:

• Identity & Authentication Data: Full legal name, unique username handle, date of birth, geographic location, primary email address, and OAuth authentication tokens from linked third-party providers (Google, GitHub, Discord).
• Academic Credentials: University or college affiliation, academic department, intended graduation year, and extracurricular verification points.
• Workspace Deliverables: Project tasks, Kanban milestone states, meeting agendas, slide decks, markdown documentation, whiteboard notes, and team chat transcripts within authorized project spaces.
• Developer Metrics: Public GitHub repository URLs, commit histories, LeetCode performance statistics, and problem-solving metrics aggregated via your integrated profiles.

2. Academic Record Protection (FERPA & Global Compliance)

For university-mandated credit claims and departmental oversight, LynDesk operates in strict compliance with the Family Educational Rights and Privacy Act (FERPA) regulations protecting student education records:

• Project accomplishment logs and credit requests are shared strictly with authorized, verified department deans and faculty advisors.
• Students retain full ownership of their extracurricular histories and can opt to make their profiles public or private at any time.
• No educational records or student performance metrics are indexed by commercial search engines without explicit user consent.

3. Multi-Account OAuth & Credential Linking

LynDesk provides unified authentication allowing students to link multiple identity providers (Google, GitHub, Discord) to a single profile:

• OAuth tokens are used solely for identity verification and authorized metadata retrieval (e.g. GitHub repos, LeetCode stats). We never request or store your private repository passwords or third-party credentials.
• You can link or unlink OAuth accounts at any time from your Profile settings, subject to the safety rule that at least one authentication method must remain active to prevent account lockout.

4. WebRTC Real-Time Communications & Voice/Video Privacy

Our collaborative workspace voice and video lounges operate via WebRTC peer-to-peer protocols:

• Audio and video streams are transmitted directly between workspace members using End-to-End Encryption (E2EE) and are never recorded, tapped, or stored on LynDesk servers.
• Signaling metadata is ephemeral and deleted immediately upon channel disconnection.

5. AI Curriculum Processing & Data Privacy

When utilizing the Study Desk AI path generator or syllabus synthesizer:

• Uploaded PDF course syllabi and topic prompts are processed in transient memory to generate pedagogical flashcards and quizzes.
• User data is never used to train generalized foundation models without your explicit opt-in.

6. Security Infrastructure & Zero-Sale Guarantee

All data transfers are encrypted in transit via TLS 1.3, and database records are isolated using strict PostgreSQL Row Level Security (RLS) policies.We enforce a zero-sale policy: LynDesk never sells student profile information, contact data, or project codebases to third-party advertisers or commercial data brokers.