★ Your data

Privacy Policy

Last updated: 24 September 2026

1Who is responsible for your data

csdash is an independent project run by eftihis (papasifakis.gr), who decides how and why your personal data is used ("controller"). To reach us about anything here: [email protected].

2What we collect, and why

Only what's needed to run the app:

  • Account: username, email address, a bcrypt hash of your password (never the password itself), whether your email is verified, and when the account was created and last changed. Why: to give you an account and sign you in.
  • Email verification: a short-lived 6-digit code, kept only as a hash and deleted once you verify, or when it expires. Why: to check the address is yours.
  • Your academic data: courses, semesters, grading components and weights, homework, lab and project items, and exam dates that you enter. Why: it is the service.
  • Sign-in session: a session record that keeps you signed in (see Cookies below).
  • Security records: the network address you connect from (an IPv4 address, or the first half of an IPv6 address) and counts of requests and failed sign-ins, used to block abuse. If you have signed in successfully from a network, we remember it against your account for up to 60 days, so that you can still sign in if someone is trying to guess your password. Why: to protect accounts and the service.
  • Email records: the address, subject, time and delivery status of emails we send you. The content of verification emails isn't kept. Why: to run the email service and to help if something goes wrong.

Legal basis (GDPR): providing the service you asked for (contract), and our legitimate interest in keeping the service secure. We don't rely on consent, because we don't do anything that needs it.

3Cookies and local storage

csdash uses one cookie that is essential, so there is nothing to accept for it, and, only if you agree, cookies from Google Analytics:

  • sid (essential): keeps you signed in. It is httpOnly (page scripts can't read it), sent only to csdash, and marked secure over HTTPS. It lasts up to 4 hours, or 30 days if you tick "Remember me". Signing out removes it.
  • Theme preference (essential): your chosen color theme is stored in your browser's localStorage. It never leaves your device.
  • Your cookie choice (essential): whether you accepted or rejected analytics cookies is itself remembered in localStorage, so we don't ask you every visit.
  • Google Analytics cookies (optional, only if accepted): see below.

We use no advertising and no tracking beyond the analytics described next.

4Analytics

csdash can use Google Analytics to see how the site is used: which pages are visited, roughly how many people visit, and where from. It never runs before you choose "Accept" on the cookie banner shown on the site, and you can withdraw your choice at any time from the "Cookie preferences" link in the footer.

  • Legal basis: your consent. Nothing else on csdash needs a cookie banner, only this.
  • What it collects: pages visited, general location (country/city level, from an anonymised IP address, never the full address), device and browser type, and how you arrived at the site. It does not collect your name, email or anything you type into csdash.
  • Cookies it sets: _ga and _ga_<id>, used to tell repeat visits apart from new ones. They last up to 2 years unless you reject or withdraw consent, which removes them from your browser immediately.
  • Who processes it: Google Ireland Limited. See Google's Privacy Policy for how Google itself handles this data.
  • If you reject or never decide: Google Analytics does not run at all, and no analytics cookie is set. The site works exactly the same either way.

5Who else handles your data

We don't sell your data or share it for advertising. To run the service we use a few providers that process data on our behalf:

  • Database hosting: Neon (PostgreSQL), with servers in the EU (Frankfurt). Everything above is stored there.
  • Web hosting: the company that runs the server csdash is served from.
  • Email delivery: our email provider, which handles your address and the emails we send you.

We don't hand your data to anyone else, except where a law or a court requires us to.

6How long we keep it

  • Your account and academic data: until you delete your account.
  • Accounts that never verify their email, and their codes: removed after 24 hours.
  • Verification codes: 15 minutes.
  • Sign-in sessions: 4 hours, or 30 days with "Remember me", or until you sign out.
  • Security and email records tied to your account: erased when your account is deleted.
  • Security records about a network address are kept only as long as needed to protect the service. They aren't tied to your name, and you can ask us to erase records about your address.

7How we protect it

Passwords are hashed with bcrypt, connections to the site and to the database are encrypted and the database certificate is verified, sign-in and code guessing are rate-limited, and email addresses must be verified. No system is perfectly secure, but we take care with your data.

8Your rights

Under the GDPR you have the right to:

  • get a copy of your data (access and portability);
  • have wrong data corrected;
  • have your data deleted;
  • limit or object to how we use it.

You can also complain to your data protection authority. In Greece that is the Hellenic Data Protection Authority (dpa.gr).

9How to use your rights (by email, for now)

The app doesn't have buttons for these yet, so they are handled by email. Write to [email protected] from the email address on your account and tell us which you want:

  • A copy of your data. We email you a file with everything we hold about your account: profile, courses, items, exams, and the security and email records tied to it. Your password hash is left out.
  • Deletion of your account. We permanently delete your account and everything tied to it: courses, items, exams, sign-in sessions, and the security and email records linked to your account. This can't be undone, so please export first if you want a copy.
  • A password reset. We email a temporary password to your account address. Sign in with it and change it straight away.
  • Corrections. Your username can be changed on your Account page. For anything else, email us.

Because we only act on requests that come from the address on the account, we can be sure it's really you. We reply as soon as we can and always within 30 days. Buttons for all of this inside the app are planned.

10Children

csdash is meant for university students and isn't directed at children. If you believe a child has created an account, email us and we'll delete it.

11Changes to this policy

If we change how we use personal data we'll update this page and the "last updated" date, and for meaningful changes we'll email the address on your account.

12Contact

Questions or requests about your data? Email [email protected].