Privacy Policy
Last updated: June 23, 2026
1. Overview
RU Rate (“we”, “our”, “the service”) is a course-search and registration-preparation tool for Rutgers University students. This policy explains what data we collect, why we collect it, how long we keep it, and what rights you have. We are not affiliated with Rutgers University.
2. Data We Collect
Account data
When you sign up we collect your email address through Supabase Auth (managed by Supabase, Inc.). We do not store passwords — authentication is handled via Supabase's secure session system. Your email is used only to identify your account and send transactional alerts you explicitly request.
Course-sniper watchlist
Section index numbers (index numbers only — no course content or personal schedules) you add to your watchlist are stored in our database linked to your account. We poll the Rutgers Schedule of Classes on your behalf and send you an alert when a seat opens. We never log your NetID or access WebReg on your behalf.
Alert contact details
If you enable email alerts we store your email. If you enable SMS alerts we store your phone number. These are used solely to deliver seat-open notifications via Resend (email) and Twilio (SMS). We do not sell or share contact details with third parties.
Subscription and billing
Pro subscriptions are processed by Stripe, Inc. We never see or store your full card number, CVV, or bank details. We store a Stripe customer ID and subscription status in our database so we can gate Pro features. Stripe's own privacy policy governs payment data.
Vote fingerprints
When you vote on a professor review, a one-way HMAC hash of your IP address and a server-side salt is stored to prevent duplicate votes. The raw IP address is never stored or logged.
Usage and logs
Our hosting provider (Railway) retains standard HTTP access logs (timestamps, paths, status codes) for up to 30 days. We do not add additional user-level analytics or tracking pixels.
Third-party professor data
Professor ratings displayed on this site are sourced from RateMyProfessors (operated by Chegg, Inc.). We cache this data in our database to reduce latency. We do not sell or redistribute RMP data.
3. How We Use Your Data
- Authenticate you and maintain your session
- Send seat-open notifications for sections you are watching
- Process and manage Pro subscription payments through Stripe
- Prevent duplicate votes on professor reviews
- Improve the service (aggregate, anonymised usage patterns only)
We do not use your data for advertising, profiling, or sale to third parties.
4. Data Retention
- Account data: retained until you delete your account
- Watchlist entries: deleted when you remove them or delete your account
- Alert contact details: deleted when you delete your account
- Subscription records: retained for up to 7 years for tax/legal compliance after cancellation
- Vote fingerprints: retained indefinitely in hashed form (no personal data recoverable)
- Server access logs: up to 30 days (Railway policy)
5. Your Rights
Depending on your jurisdiction (including the EU/EEA under GDPR and California under CCPA) you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Object to or restrict certain processing
- Data portability
To exercise any of these rights, email us at [email protected]. You can also delete your account directly from Settings, which immediately removes your account and personal data.
6. Third-Party Services
- Supabase — database and authentication (supabase.com/privacy)
- Stripe — payment processing (stripe.com/privacy)
- Resend — transactional email (resend.com/legal/privacy-policy)
- Twilio — SMS alerts (twilio.com/legal/privacy)
- Railway — hosting and infrastructure (railway.com/legal/privacy)
- RateMyProfessors / Chegg — professor rating data (chegg.com/privacy)
7. Cookies and Local Storage
We use browser session cookies solely for authentication (set by Supabase Auth). We do not use advertising cookies. Watchlist data may be stored in your browser's local storage as a performance optimisation; this data never leaves your device unless you are signed in, in which case it is synced to your account.
8. Children
RU Rate is intended for college students aged 18 and older. We do not knowingly collect personal data from anyone under 13. If you believe a minor has provided us data, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be noted at the top of this page with a revised date. Continued use of the service after changes constitutes acceptance of the updated policy.
10. Contact
Questions or requests: [email protected]