Draft · not yet adopted

Privacy notice

Draft, pending adoption. This policy is written and complete, but it has not been reviewed by a lawyer or adopted by the school, and no responsible person or contact address has been named yet. The full text is in the repository under legal/.

What is collected

Your email address, your password as an Argon2id hash, the fact that you accepted these notices, the Mac you enrolled (its name, macOS version, architecture, and public keys), your purchases and access grants, and security events such as “lease issued” or “device revoked”.

What is never collected

The websites you visit, your DNS queries, and the contents of your traffic are never collected, proxied, or logged. Your VPN traffic goes directly from your Mac to Private Internet Access and does not pass through this server. Your Mac’s serial number and hardware UUID are not collected. There is no analytics, no advertising, and no client-side JavaScript.

IP addresses

Application records store only a salted hash of a coarse network prefix, never your full address. Infrastructure logs on the host keep addresses and timestamps briefly for security purposes.

Retention

Financial records are kept for the statutory period, security events for 90 days, and account data for the life of the account.

Contact: to be completed — no responsible person or contact address has been named yet.