Privacy

How listings are checked

Every date comes from the organiser's own page or application system. We never take a date from another listing site.
Every date with a day carries a word-for-word quote from that page. We keep a private saved copy of the page, and the site cannot be built unless the quote appears in that copy.
We never guess a date, and we never copy last year's date forward. Last year's opening date is shown separately, with its year.
Every programme shows when it was last checked, and whether software or a person did the check.
A published programme has passed at least one check.

Most of the work on this site is done by software, including an AI model. It reads the official page, drafts the listing and takes the quotes. A second, separate AI review compares each draft with the saved copy of the page before the listing is published.

When software checks a programme, it fetches the official page again and looks for every quote on the listing, word for word. The check is refused if a single quote is missing. If the page has changed in any other way, the changed lines are read before the check is recorded.

Software can miss things a person would notice, such as a date given only in a picture or a PDF. Where a person has checked a programme, its page says so. Some organisers block software from reading their pages, and those programmes are only published after a person has checked them.

What we hold and why

This site is run by Junseo Kang, who is the data controller. Contact: help@undergradtracker.uk.

Signing in is optional. If you do not sign in, the site sets no cookies. There is no advertising and no analytics script, whether or not you sign in.
If you mark programmes Completed or Hidden without signing in, your marks are saved in your own browser and nowhere else. It carries no identifier, it is never sent to us, and you can download or clear it under Your marks, at the foot of the tracker.
The course and year you pick are kept in your own browser, under tracker.course.v1, and in the page's address. They carry no identifier and, unless you sign in, are never sent to us. Remove them with “Clear my course and year”.
The site is served by Cloudflare, which processes your IP address in order to deliver pages, as any web host must.
The report and submission forms are run by Tally, which stores responses in the EU. What you type there reaches the person who runs this site and is used only to fix or add a listing.
Email you send to help@undergradtracker.uk is received through Zoho Mail, which handles it on our behalf and holds it in its EU data centre. It is used only to answer you.
This site lists only organisations and publishes no personal contact details.

We keep form responses and email for six months after we have dealt with what they were about, and then delete them. We use them because we have a legitimate interest in keeping the listings accurate and in answering people who write to us. We do not use them for anything else.

You can ask for a copy of what we hold about you, or ask us to correct it, delete it, limit how we use it while a question about it is looked into, or stop using it. Use the contact above.

UK law treats the EU as protecting personal data adequately, so the form responses and the mailbox need no further safeguard. Cloudflare is a US company and relies on the UK Extension to the EU-US Data Privacy Framework for data it moves to the US. If a form sends us an email notification, Tally passes it through SendGrid in the US, under Tally's data processing terms.

If you sign in

Signing in is optional. Everything on the site works without it, and your list then stays in your browser. If you sign in, we keep your list, and the course and year you picked, on our server so that you can use them on any device. Saving the course and year is on unless you untick “Save my course and year to my account”.

What we hold about you:

Your email address. We do not ask for anything else, such as your name, a password or a picture.
Your marks: the programmes you marked Completed or Hidden, when you changed each mark, and when you cleared one.
The course and year you picked, unless you untick the box: at most two subjects, your year of study and your course length, and when you last changed them. We also keep whether saving is on, when you last changed that, and how many changes were saved in the current hour, so that one account cannot save more than 60 an hour. We never ask which university you attend.
The day you last used your account.
Your sign-ins: when each started, when it was last used and when it ends. We do not record your internet address or which device or browser you used.
The times you asked for a code, stored against a scrambled form of your email address that cannot be read back without a secret key. This is how we limit how many codes one inbox can receive.
A code you have not used yet, in a form that cannot be turned back into the code.
The internet address that a sign-in, sign-out or deletion request came from, with a count. This stops the form being used to flood someone's inbox. It is not linked to your account.

We use this only to keep your list and your course and year, and to sign you in. Programmes are sorted by your course and year in your own browser, and we make no decision about you. We never use any of it for marketing or share it for anyone else's use, and signing in does not add an analytics script. Our lawful basis is legitimate interests, because you asked us to keep your list, your course and year are kept only so that you need not pick them again, and we do nothing else with either.

Who handles it for us:

Cloudflare runs the site and stores the account database. The database is held in the European Union. Your requests can pass through Cloudflare's servers in other countries on the way to it.
Resend (Plus Five Five, Inc.) sends the sign-in emails. It keeps a copy of each email it sends, including your address and the code, for 30 days, in the United States. The code stops working after 5 minutes.

UK law treats the European Union as protecting personal data adequately. Cloudflare and Resend are US companies, and for data that goes to the United States both rely on the UK Extension to the EU-US Data Privacy Framework, which UK law also treats as adequate. If that certification lapsed, Resend's data processing terms fall back to the EU standard contractual clauses with the UK Addendum.

How long we keep it:

Your account, with your list and your course and year, until you delete it, or until it has not been used for a year, when we delete it without asking.
Your course and year are deleted straight away if you untick “Save my course and year to my account”.
A sign-in lasts 7 days and is renewed while you keep using the site. Ended sign-ins are deleted by a daily clean-up.
A code works for 5 minutes. The times you asked for codes are kept for 2 days, and internet addresses for a day. The daily clean-up deletes each of these within a day of its time running out.
Resend's copies of the emails for 30 days.
For 7 days after anything is deleted, it can still be recovered from Cloudflare's point-in-time copies of the database. We would use them only to recover from a fault. After that it is gone.

What we store in your browser:

A cookie, __Secure-better-auth.session_token, set only when you sign in. It keeps you signed in for 7 days and does nothing else. Without it, signing in could not work.
Your list, under tracker.items.v1, whether or not you sign in.
The course and year you picked, under tracker.course.v1, whether or not you sign in.
Once you have signed in, tracker.account.v1, which says only that this browser has signed in before, and tracker.sync.v1, which holds removals waiting to be sent. Both are removed when you sign out.

Under Your marks, at the foot of the tracker, you can download everything we hold about you and delete your account yourself. Deleting removes it from our database straight away. Resend's copies of your emails and Cloudflare's recovery copies expire on their own, as above.

You also have the right to ask us to correct your data, to limit how we use it while a question about it is looked into, and to object to our using it at all. Write to help@undergradtracker.uk. We answer within a month. No decision about you is made automatically.

To complain about how your data has been handled, use the contact above. You will get an acknowledgement within 30 days. You can also complain to the Information Commissioner's Office.

If your organisation is listed and you want the listing corrected or removed, use the removal form.