Privacy

If you sign in

Signing in is optional. Everything on the site works without it, and your list then stays in your browser. If you sign in, we keep your list, and the course and year you picked, on our server so that you can use them on any device. Saving the course and year is on unless you untick “Save my course and year to my account”.

What we hold about you:

• Your email address. We do not ask for anything else, such as your name, a password or a picture.
• Your list: the programmes and organisations you marked, when you changed each mark, and when you cleared one.
• The course and year you picked, unless you untick the box: at most two course titles, your year of study and your course length, and when you last changed them. We also keep whether saving is on, when you last changed that, and how many changes were saved in the current hour, so that one account cannot save more than 60 an hour. We never ask which university you attend, but a course taught at only one university can show where you study. If you would rather we did not hold that, pick a broader course title or untick the box.
• The day you last used your account.
• Your sign-ins: when each started, when it was last used and when it ends. We do not record your internet address or which device or browser you used.
• The times you asked for a code, stored against a scrambled form of your email address that cannot be read back without a secret key. This is how we limit how many codes one inbox can receive.
• A code you have not used yet, in a form that cannot be turned back into the code.
• If you sign in with Google or Microsoft, or connect one to your account: the identifier that company uses for your account with them, and the day it was connected. Signing in with Google, with the address of an account you already have here, connects Google to that account when the address is a Gmail address or one your university or employer runs with Google. We ask them only for your email address, and we throw away the name and picture they send. We never receive your password, and we keep none of their access tokens.
• If you add a passkey: its public half, the name you give the device, and a counter. The private half never leaves your device, and the public half cannot be used to recognise you on any other site.
• The internet address that a sign-in, sign-out or deletion request came from, with a count. This stops the form being used to flood someone's inbox. It is not linked to your account.

We use this only to keep your list and your course and year, and to sign you in. Programmes are sorted by your course and year in your own browser, and we make no decision about you. We never use any of it for marketing or share it for anyone else's use, and signing in does not add an analytics script. Our lawful basis is legitimate interests, because you asked us to keep your list, your course and year are kept only so that you need not pick them again, and we do nothing else with either.

Choosing Google or Microsoft sends you to them. They will know you are signing in here, they apply their own rules, including anything your university has set, and they keep their own record of it. In that moment they act for themselves, not for us. Both are certified under the UK Extension to the EU-US Data Privacy Framework, which UK law treats as adequate, checked on 23 September 2026. Removing our access in your Google or Microsoft account stops you signing in that way; it does not delete your account here, which you delete on your account page.

Who handles it for us:

• Cloudflare runs the site and stores the account database. The database is held in the European Union. Your requests can pass through Cloudflare's servers in other countries on the way to it.
• Resend (Plus Five Five, Inc.) sends the sign-in emails. It keeps a copy of each email it sends, including your address and the code, for 30 days, in the United States. The code stops working after 5 minutes.

UK law treats the European Union as protecting personal data adequately. Cloudflare and Resend are US companies, and for data that goes to the United States both rely on the UK Extension to the EU-US Data Privacy Framework, which UK law also treats as adequate. If that certification lapsed, Resend's data processing terms (opens in a new tab) fall back to the EU standard contractual clauses with the UK Addendum.

How long we keep it:

• Your account, with your list and your course and year, until you delete it, or until it has not been used for a year, when we delete it without asking.
• Your course and year are deleted straight away if you untick “Save my course and year to my account”.
• A sign-in lasts 7 days and is renewed while you keep using the site. Ended sign-ins are deleted by a daily clean-up.
• A connected Google or Microsoft account, or a passkey, until you disconnect or remove it, or delete your account.
• A code works for 5 minutes. The times you asked for codes are kept for 2 days, and internet addresses for a day. The daily clean-up deletes each of these within a day of its time running out.
• Resend's copies of the emails for 30 days.
• For 7 days after anything is deleted, it can still be recovered from Cloudflare's point-in-time copies of the database. We would use them only to recover from a fault. After that it is gone.

What we store in your browser:

• A cookie, __Secure-better-auth.session_token, set only when you sign in. It keeps you signed in for 7 days and does nothing else. Without it, signing in could not work.
• Your list, under tracker.items.v1, whether or not you sign in.
• The course and year you picked, under tracker.course.v1, whether or not you sign in.
• Once you have signed in, tracker.account.v1, which says only that this browser has signed in before, and tracker.sync.v1, which holds removals waiting to be sent. Both are removed when you sign out.
• While you are away signing in with Google or Microsoft, tracker.sign-in.v1 in that tab's session storage, which says only that a sign-in is on its way back. It is removed as soon as you return, and when the tab closes.

On your account page (opens in a new tab), which the account menu at the top of every page opens, you can download everything we hold about you and delete your account yourself. Deleting removes it from our database straight away. Resend's copies of your emails and Cloudflare's recovery copies expire on their own, as above.

You also have the right to ask us to correct your data, to limit how we use it while a question about it is looked into, and to object to our using it at all. Write to help@undergradtracker.uk. We answer within a month. No decision about you is made automatically.