Privacy Policy

CUWeave is an unofficial, student-led CUHK planning service. It collects the email address used for one-time-code authentication, account and session records, favorites, saved schedules, reviews, votes, reports, and moderation records needed to operate current features. Previously stored requirement-plan choices remain protected while that feature is unavailable.

One-time-code email is processed by the configured SMTP provider. Sessions may record a user-agent but raw IP tracking is disabled. Abuse controls store only keyed hashes of request identifiers, never raw IP addresses. Server logs must redact secrets, email addresses, tokens, and raw network identifiers.

Reviews displayed as anonymous are anonymous to other students, not to the service: an internal authenticated author relationship is retained for edits, abuse handling, and moderation. Shared schedules are visible to anyone with an active link until the owner revokes it.

Account deactivation revokes authentication records and pseudonymizes the account. Reviews may remain as “Deleted user” to preserve discussions and moderation history. Operational retention and backup windows follow the published operations runbook; maintainers should handle deletion requests through the security contact.

Course data retains source provenance and may be incomplete or stale. CUSIS remains authoritative. This draft requires maintainer and legal review before production launch.