Privacy Policy
At CUIRank, we treat privacy as a fundamental engineering requirement. This document explains how we handle student feedback, enforce abuse protection through one-way cryptographic hashing, utilize cookies, and safeguard data.
1. Core Privacy & Anonymity Commitment
Zero accounts, zero student identification
CUIRank operates under a strict principle of data minimization. We do not require, request, or store:
- Student names, university registration numbers, or roll numbers
- Personal or official university email addresses
- User account passwords, social media logins, or profile data
- Physical geolocation coordinates or GPS data
Students can freely browse academic rosters and submit course evaluations without creating an account or logging in.
2. Information We Collect & How It Is Handled
User submissions and technical telemetry
A. User-Submitted Review Content
When submitting an evaluation, we collect the course name, numeric rating scores (1–5 scale across 4 pedagogical metrics), and the optional written commentary. This content is published publicly upon passing automated and editorial moderation.
B. Device Signatures for Spam Prevention (FingerprintJS)
To prevent automated review manipulation and ensure fair feedback, our client-side software utilizes FingerprintJS (Open Source). This script inspects non-sensitive browser characteristics (such as screen dimensions and browser engine) purely in your local browser memory, generates a SHA-256 cryptographic hash, and transmits only the resulting hash to our API. The raw browser attributes and any personally identifiable device parameters are discarded immediately and never sent to or stored on our servers. This hash is never used for advertising, cross-site tracking, or behavioral profiling.
C. Salted Network Identifiers (IP Hashing)
When a review, vote, or report is submitted, the connecting IP address is passed through a one-way hashing algorithm combined with a secret cryptographic salt (`IP_HASH_SALT`). We record only this irreversible hash to enforce rate limits (such as a 30-day single-review cooldown per professor). Raw IP addresses are never written to our database tables.
D. Honeypot Anti-Bot Inputs
Our forms include hidden input fields invisible to human users. Automated spam bots that fill these fields are silently rejected without recording their payloads.
3. Cookies & Local Storage Usage
Technologies used for performance and verification
We utilize standard web technologies strictly for essential functionality, security, and traffic performance analytics:
Google Analytics 4 (`_ga`, `_ga_*`)
AnalyticsMeasures aggregate traffic trends, pageviews, and bounce rates. IP anonymization is active by default. You can block these cookies using browser privacy settings or the official Google Analytics Opt-Out browser extension.
Google AdSense & Advertising Cookies
AdvertisingThird-party vendors, including Google, use cookies to serve ads based on your prior visits to our website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the Internet. You may opt out of personalized advertising by visiting Google Ads Settings.
Google reCAPTCHA v2 (`_GRECAPTCHA`)
SecurityLoaded exclusively on review report dialogs to distinguish human users from automated spam scripts submitting false flags.
Client Browser Local Storage
FunctionalStores client-side interface state preferences (such as dismissed announcement banners or search filters) locally on your device.
4. Third-Party Sub-Processors
Infrastructure and technology providers
We partner with enterprise cloud infrastructure providers under strict data-protection agreements:
Supabase Inc.
Stores submitted course reviews, aggregate metrics, and hashed rate-limiting records behind strict PostgreSQL Row-Level Security (RLS).
Google LLC (Analytics & reCAPTCHA)
Google Analytics 4 collects aggregated, IP-anonymized site performance metrics. Google reCAPTCHA v2 verifies human interactions on content report forms.
Groq Inc. & Google Gemini API
Evaluates submitted review text against community safety guidelines to flag profanity, threats, or harassment. No user identifiers, IP addresses, or device signatures are transmitted to AI processors.
Vercel Inc.
Delivers application pages and securely processes server actions across global edge nodes with automated TLS encryption.
5. Automated AI Moderation & Privacy Safeguards
How text is processed without exposing user data
To protect faculty and students from harassment, submitted review texts are evaluated through a multi-model AI cascade (Groq OSS models with Gemini Flash Lite fallback).
Zero Identity Exposure: The payload transmitted to AI moderation APIs contains only the review comment and course title. No IP addresses, device signatures, timestamps, or personal credentials are ever attached to AI requests.
6. Data Retention Schedules
How long various categories of data are retained
Approved Student Reviews
Retained publicly to support course planning until subject to a validated takedown request or faculty catalog deprecation.
Rate-Limiting & Cooldown Hashes
Compound SHA-256 identifier hashes are retained strictly during the cooldown window to enforce submission limits and prevent vote ballot-stuffing.
Content Abuse Reports
Reports submitted by users or faculty are kept during active investigation and purged from administrative logs following resolution.
Google Analytics Metrics
Aggregated browser and session measurements are managed according to standard Google Analytics 4 data retention parameters.
7. User Rights, Corrections & Content Disputes
Mechanisms for correction and removal
We provide accessible avenues for all campus community members to exercise data controls:
- Content Dispute & Takedown: Faculty members or students may flag any review containing factual inaccuracies, private phone/email details, or defamatory remarks. Our editorial council reviews disputes within 24 to 48 hours.
- Roster Corrections: Faculty addition or department transfer requests can be submitted via the Faculty Addition form.
- Analytics Opt-Out:You may prevent Google Analytics tracking across our platform by enabling your browser's Global Privacy Control (GPC) or using privacy-focused content blockers.
8. Children's Privacy (COPPA Notice)
University and higher education scope
CUIRank is designed exclusively for university students, faculty, and prospective students enrolled in higher education programs (typically aged 16 and above). We do not knowingly collect, request, or maintain data from children under the age of 13. If you believe a child under 13 has submitted content, please contact us for immediate deletion.
9. Technical Security Safeguards
Database security and data isolation
We implement comprehensive technical and organizational safeguards:
- End-to-end TLS 1.3 encryption across all public web and API connections
- PostgreSQL Row-Level Security (RLS) policies enforcing read-only isolation on public clients
- Strict segregation of server-side service role secrets via isolated server action wrappers
- Routine dependency vulnerability audits and zero-log API routing
Privacy & Data Protection Inquiries
For questions regarding this policy, dispute notices, or data removal requests, contact our editorial team directly. We commit to responding within 24 to 48 hours.