Privacy Policy — Nestrel

01 Who this covers

This Privacy Policy applies to Nestrel (nestrel.org), a campus platform for verified Caldwell University students, operated by KR, doing business as Amahle Digital Creatives ("we," "us," "our"). Nestrel is independent: it is not owned, operated, or endorsed by Caldwell University.

The standard we hold ourselves to: FERPA

FERPA (the Family Educational Rights and Privacy Act) is the federal law that protects students' education records — things like grades, transcripts, and class schedules kept by a school. It doesn't legally apply to Nestrel: we aren't a school, and we don't receive any records from Caldwell University. What we hold is information people give us directly through Nestrel.

That's also why you won't see us call Nestrel "FERPA compliant" or "FERPA certified". The law governs schools, and there is no official certification an outside app can earn — so any app claiming one is overstating it. What we can promise, and do, is that we voluntarily meet FERPA's standards:

What FERPA gives students	What Nestrel does
The right to see your records	Ask for a copy of everything we hold about you, and get it within 45 days — FERPA's own deadline (section 08).
The right to ask for corrections	Edit most things yourself; for anything else, ask us. If we decline, we explain why in writing (section 08).
Consent before records are shared	We share only with the people and services named in sections 05 and 06, and nowhere else without your consent — except where the law or someone's safety requires it.
A record of disclosures	We log any disclosure outside those categories, and you can ask to see it (section 05).
Limits on "directory information"	Only your public profile is visible to other students, and you choose most of what's on it.
Safeguards and staff access limits	Access rules enforced by the database itself, admin access limited to named accounts, and an activity log (section 09).

Why go further than the law asks? You sign up with your university email, and Nestrel holds your messages and campus activity — information that deserves that care whatever the law technically requires. In practice, it also means:

We use your information only for the purposes we list (section 03), and nothing broader.
We don't sell it, advertise with it, or pass it on beyond the people and services named in sections 05 and 06.
We collect only what we need to verify you and run the platform (section 02).
You can see, correct, and delete your information, with a set response time (section 08).
We keep information for stated periods (section 07) and protect it with real safeguards (section 09).

If a university ever shares its own student records with us, we'll accept them only under a written agreement that gives the university control over how those records are used, kept, and destroyed — and we'll update this policy before that happens.

02 What we collect

Category	Examples
Account & identity	Your `@caldwell.edu` email, first and last name, username, and display name — plus, if you add them, a profile photo, bio, pronouns, major, and class year. We also record when you accepted our Terms and which version you accepted.
Signing in with Google	You sign up with your `@caldwell.edu` Google account. When you do, Google tells us your name, your email address, a link to your Google profile picture, and an ID number for your Google account. We use your name to fill in your Nestrel profile, which you can change. The picture link is kept with your sign-in record but isn't shown anywhere in Nestrel. We never see your Google password, and we get no access to your Gmail, Google Drive, contacts, or anything else in your Google account.
Your Nestrel password	You also set a Nestrel password, so you can log in with your email instead of Google. It is stored by Supabase in scrambled (hashed) form: nobody at Nestrel can read it.
Listings & content	Items and textbooks you post, photos you upload, prices, descriptions, and course details.
Messages	Messages you send and receive through the platform, and when they were read.
Clubs & organizations	Clubs you follow or join, your role in a club (for example, officer), posts you publish for a club, and your votes in club polls.
Club pages & event photos	If you're an officer: the logo and cover photo you upload for your club, and photos you share from an event (a "recap") with an optional note. Recap photos can show the people who were there, so if you attended an event, you may appear in one.
Events	Events you RSVP to, whether and when you checked in (and which officer checked you in), and any rating or comment you leave after an event. We also record the first time you open an event's page, so each person counts once in its view total. That record is erased 30 days after the event ends, leaving only the number.
Activity	Saved items, and actions on your listings (posting, marking sold, renewing). We also remember which updates in your Activity feed you've seen and opened, so every device you use shows the same thing.
Feedback	What you send from the Feedback button or the 2-minute feedback: your rating, which parts of Nestrel you tried, your answers, and whether we may contact you about them. The app adds the page you came from, your device type (phone, tablet or computer), your browser, the app version, and how long the feedback took — never your IP address. When you finish the 2-minute feedback, we also keep a confirmation code with the date, so you can show a professor you completed it.
Safety & moderation	Reports you file or that are filed about you, appeals, and any suspension history — and, for a reported conversation, a record of each time an administrator opened it.
Technical	Basic technical data your browser sends (e.g., device/browser type) and data our infrastructure providers process to keep the service running and secure.
Notifications (only if you turn them on)	If you turn on notifications, your browser gives us an address for your device at its push service (run by Apple, Google, Mozilla or Microsoft, depending on your device) and two keys used to lock each alert so only that device can read it. We also keep your choices for that device: messages, new listings, or both. This address isn't your phone number or your location. An alert shows on your screen, including the lock screen: the sender's name and the start of their message, or a new listing's title and price. Your phone's settings let you hide previews on the lock screen.
Stored on your device	Nestrel keeps a few things in your browser's storage (local storage and session storage): your sign-in session, and small conveniences such as the page you were last on, the club console you used last, and which updates you've already read. We don't use advertising cookies or third-party trackers.
Information others give us about you	When a club officer checks in a walk-in at an event, they may enter that person's name and email, even if the person has no Nestrel account. People who join our waitlist for another school give us their email, school name, and role.

Data from your Google account

Signing up requires your @caldwell.edu Google account. From Google we receive only your name, email address, profile-picture link and Google account ID — nothing from your Gmail, Drive, calendar or contacts. We use it only to create your account, confirm you're a Caldwell student, and sign you in. We never use Google data for advertising, never sell it or transfer it to anyone else, and no person reads it except to fix a problem you ask us about, for security, or when the law requires it. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

What we don't collect. We collect what we need to verify you and run Nestrel, and nothing more. We never ask for your student ID number, Social Security number, date of birth, grades, class schedule, precise (GPS) location, or financial account information — and Nestrel does not handle payments. Please don't put any of these in listings or messages.

03 How we use it

To verify you're a current Caldwell student and give you access.
To operate core features: listings, marketplace, textbooks, free items, clubs and organizations, events, saved items, and messaging.
To display your listings and public profile to other verified students.
To let club officers run their events — RSVP lists, door check-in, and feedback summaries (see section 05).
To show club officers how their club is doing, using totals only — how many students viewed, saved, RSVP'd to and attended each event, average ratings once at least five people have rated, and how many new followers the club gained. The record of who opened an event is used only to count each person once; officers never see it (see section 05).
To keep you up to date in your Activity feed — for example when an event you're going to changes or is cancelled, when photos from an event you went to are shared, or when a poll you voted in closes. These updates are worked out from information we already hold; nothing extra is collected to make them.
To read your feedback and improve Nestrel. Our team’s feedback screens show your name only if you tick “You can message me about this”; otherwise your answers appear without it. Your feedback is still linked to your account in our database, so we can limit spam, show you your own confirmation, and tell you in your Activity feed when something you asked for is built. Your confirmation code shows only that you finished and when — never your answers — and we can confirm a code for your professor if they ask.
To keep the platform safe — moderating content, investigating abuse, and enforcing our Terms.
To understand how the platform is used and improve it, using totals and counts (e.g., which categories are active) rather than tracking what individual students do.
To contact you about your account, security, or important service changes.
To meet legal obligations, such as responding to a valid court order (see section 05).

During the beta

While Nestrel is in beta we look at totals and counts — how many listings were posted, how many people opened events — to find bugs and decide what to build next. The beta is a product test, not a research study: we don't run experiments on individual students or publish findings about you. If we ever want to run a study, we'll ask you separately, with its own consent form, and saying no will never affect your account.

Only these purposes

These are the only things we use your information for. If we ever want to use it for something new, we'll update this policy and tell you in the app before the change takes effect (see section 12).

We do not:

sell or rent your personal information;
show you targeted advertising, or let advertisers use your information;
share your information with data brokers or marketers;
use your listings, messages, or activity to train AI models.

04 Why we're allowed to process your data

We process your information to provide a service you've signed up for, to meet our legitimate interest in running a safe and functional platform, to comply with legal obligations, and — where applicable — with your consent (which you can withdraw). If you're in a region with specific legal-basis requirements, this section describes the grounds we rely on.

Here is who can see what.

Other students: your public profile (name, username, display name, photo, and — if you add them — bio, pronouns, major, and class year), whether your account is currently suspended (never the reason), your listings, and posts you publish for a club. Messages are visible to the person you send them to. Your listings don't carry your email address — other students reach you through Nestrel messages. Poll results are shown to students as totals. A club's logo, cover photo, and the event photos it shares are visible to every signed-in student — so if you appear in a club's event photo, other students can see it. Ask the club's officers or us and it will be taken down.
Club officers: officers who manage an event or run its check-in can see the name and email of everyone who RSVPs to that event, and whether they checked in. Officers who manage a club's membership can see its member list. Officers with analytics access can see how individual members voted in that club's polls. Officers can't see who follows a club. Officers with analytics access also see totals for their club's events and followers — views, saves, RSVPs, attendance and ratings — but never who viewed, saved or followed. Event ratings and comments are shared anonymously with the organizers: they see the comments and an average rating, never names, and the average stays hidden until at least five people have responded — though in a small event, what a comment says may still hint at who wrote it. Officers must use what they see only for their club's own activities (see our Terms, section 06).
Nestrel administrators: the people who run Nestrel can access account information, listings, reports, and activity records in order to verify students, review reports, investigate abuse, and keep the platform working. For your messages, they can see who messaged whom and when — not what was said. There is one exception: when someone in a conversation reports it, an administrator who has been given permission to review reported conversations can read that conversation's messages up to the moment it was reported, while the report is open and for 30 days after it is closed. Every time a reported conversation is opened, it is recorded in our activity log. The person reported is not told about the report itself, only about any action we take. Admin access is limited to accounts we've given an admin role; data exports never include what messages say, and every export is recorded in our activity log. Beyond this, we disclose messages only as described under "Legal & safety" below.
Caldwell University: Nestrel is independent of the university, and we do not share information that identifies individual students with it. If we share anything with the university — for example, as part of a pilot with a university office — it will be totals, such as how many students attended an event, and never figures for a group of fewer than five people. If that ever changes for a particular event or program, we'll tell you there, before you sign up — not after. The one exception is safety: if we believe someone is in danger, we may alert Caldwell's Campus Safety (see "Legal & safety" below).
Service providers (subprocessors): companies that help us run Nestrel, listed in section 06.
Legal & safety: we may disclose information if required by law (for example, a valid subpoena or court order), or where needed to protect the safety of our users or the public — including alerting law enforcement or Caldwell's Campus Safety when someone may be in danger, or when a serious crime such as threats, violence, fraud or exploitation is reported — or to protect Nestrel against fraud or abuse. We report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), as U.S. law requires. We share only what the situation requires, and we record these disclosures (below).
Business transfer: if Nestrel is transferred to another entity (for example, once Amahle Digital Creatives is formally registered), your information may transfer with it under this policy.

No passing it on

Beyond the people and services listed above, we don't share your personal information with anyone. We do not sell your data or share it with advertisers. When we share totals or statistics instead of personal information, we remove names and anything else that could identify you, and we don't report on groups of fewer than five people.

A record of disclosures

If we ever disclose your personal information to someone outside the categories above — for example, in response to a legal request — we'll record who received it, what was shared, when, and why. You can ask to see that record for your account (section 08), unless the law prevents us from telling you.

06 Third-party services (subprocessors)

We rely on trusted third parties to operate Nestrel:

Provider	What it does	Data involved
Supabase	Hosts our authentication, database, and file storage (including listing and event photos), and sends account emails such as password resets.	Account data, listings, messages, club and event records, uploaded photos, activity records, and your email address for account emails.
Vercel	Hosts the Nestrel website at nestrel.org and delivers its pages to your browser.	Like any web host, it receives your IP address and basic browser details when you load a page, and may keep them briefly in its logs for security and reliability. It doesn't receive your account data or messages.
Google	Lets you sign up and log in with your `@caldwell.edu` Google account, and confirms that the address is really yours.	Your name, email address, profile picture link, and Google account ID, sent to us when you choose "Continue with Google". Google also knows that you signed in to Nestrel.
GitHub	Runs our weekly database backup and stores it in a private repository, so Nestrel can be restored if something goes wrong.	A copy of our database — account data, listings, messages, club and event records, and activity records, but not photos. It is encrypted as it is made, and only the encrypted copy is kept, for 35 days.
Apple, Google, Mozilla and Microsoft push services	Deliver notifications to your device, only if you turn them on. Which one depends on your device and browser (for example Apple's for an iPhone, Google's for Chrome).	Your device's push address and the alert itself. Each alert is encrypted so only your device can read it: the push service sees that an alert was sent to your device, and when, but not what it says.
Google Fonts, jsDelivr, and cdnjs (Cloudflare)	Deliver the fonts and two code libraries our pages load (the database client, and a QR-code generator for event check-in).	Like any file a website loads, your browser's request includes your IP address and basic browser details. No account information is sent.

We use these providers only to run Nestrel, and we don't give them your information for any other purpose. How they handle data is also governed by their own privacy and security terms, and we encourage you to review their privacy policies. We'll update this section before we start using a new provider that handles your personal information.

07 How long we keep it

We keep information only as long as we need it for the purposes in section 03. Here is how long that is:

Information	How long we keep it
Your account & profile	While your account is open. If you ask us to delete your account, we complete the deletion within 30 days of confirming your request. If your account was suspended when it is deleted, we keep your email address for 2 years so the account can’t simply be made again; after that it is deleted.
Listings	Listings you mark sold or withdrawn, or that expire, stop being visible to others but stay in our database so we can support your listing history, moderation, and totals. They're deleted along with your account.
Messages	While your account is open. A conversation is stored once for both people, so deleting your account also removes those conversations from the other person's inbox.
Club & event records	RSVPs, check-ins, feedback, poll votes, follows, and memberships are deleted along with your account, or when the club deletes the event. Someone checked in as a walk-in without an account can ask us to delete their entry.
Club & event photos	Until the club removes them, the club is closed, or the event is deleted. A photo you appear in is removed promptly if you ask.
Notification devices	Until you turn notifications off on that device, sign out there, or delete your account.
Activity feed read state	While your account is open, and deleted along with it. The copy in your browser stays until you clear your browser's storage.
Event views	The record that you opened an event is erased 30 days after the event ends; after that only its total view count is kept. It is also deleted along with your account.
Feedback & confirmation codes	Up to 2 years after you send it, then deleted automatically. If you delete your account sooner, your confirmation codes are deleted with it, and your feedback is kept but no longer linked to your account.
Reports, appeals, suspensions & the admin activity log	Up to 2 years after your account is closed, so we can handle repeat abuse and answer questions about past moderation decisions. After that they're deleted, or the details that identify you are removed.
Waitlist sign-ups	Deleted when we launch at that school or decide not to — or sooner, if you ask.

If Nestrel shuts down. We'll tell you in the app at least 30 days before, so you can ask for a copy of your information. Then we delete it, as described below.

When we delete information, it is removed from our database, not just hidden. Deleted information may remain in backups until they expire: our own weekly backups are encrypted and kept for 35 days, then deleted, and our hosting provider may keep its own for a short time on its regular schedule. If you graduate or leave Caldwell, your account stays open until you delete it; if we close an account we can no longer verify, we delete it on the same timeline.

08 Your rights & choices

These rights apply to every Nestrel user, wherever you live. New Jersey's Data Privacy Act doesn't yet cover a service Nestrel's size, but the rights it describes — to see, correct and delete your information — are ones we give everyone already. We don't sell personal information or use it for targeted advertising, so there is nothing to opt out of; if your browser sends a Global Privacy Control signal, that is already how we treat you.

See your information: ask for a copy of the personal information we hold about you. We'll send it within 45 days — the same window FERPA gives students — and usually much sooner.
Correct it: you can edit most of your profile and listings yourself in the app. For anything you can't edit, ask us. If we decide not to make a change, we'll explain why in writing.
Delete it: you can delete listings in the app. To delete your whole account, email us and we'll complete it within 30 days of confirming your request (section 07 explains what is kept, and for how long).
Turn notifications off: any time, in Edit profile → Notifications, for each device. You can also choose messages only, or new listings only.
Take down a photo of you: if you appear in a photo a club has shared, ask the club's officers or us and it will be removed.
See our disclosure record: ask whether we've disclosed your information to anyone outside the categories in section 05, and to whom.
Raise a concern: if you disagree with how we use your information, tell us. We'll review it and reply in writing.

How to make a request. Email amahledigitalcreatives@gmail.com from your @caldwell.edu address, so we can confirm it's really you. If you no longer have access to that address, tell us and we'll find another way to confirm who you are. Requests are free, and using these rights won't affect your account.

09 Security

We protect your information with measures including:

Encryption: data is encrypted in transit (HTTPS) and at rest by our hosting provider, Supabase.
Access rules enforced by the database: each account can read only the records it's allowed to see, and those rules are enforced by the database itself — not just by the app's screens.
Limited extra access: only accounts we've given an admin role get administrator access. Club officer permissions (managing events, checking people in, viewing analytics) are granted one at a time.
Verified accounts: new accounts can only be created with a @caldwell.edu Google account, so Google confirms that the address belongs to you. The database itself refuses sign-ups from any other domain. (Accounts created before Google sign-in confirmed their address by email.)
Passwords: any new password must be at least 8 characters, and passwords are stored only in scrambled (hashed) form.
Logging: moderation decisions, data exports, and every opening of a reported conversation are recorded in an activity log.

No system is perfectly secure, and as a beta product Nestrel may have vulnerabilities. Please use a strong, unique password and let us know right away if you notice anything suspicious.

If there's a breach. If we learn that someone has gained unauthorized access to your personal information, we'll notify affected users without unreasonable delay — and at least as quickly as New Jersey law requires — and tell you what happened, what information was involved, and what we're doing about it.

10 Age requirement

Nestrel is intended only for users 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we've collected data from someone under 18, we'll delete it. If you believe a minor is using Nestrel, contact us.

11 International note

Nestrel is operated for a New Jersey university community, and our providers may process and store data in the United States and other countries. By using Nestrel, you understand your information may be processed in the U.S. and elsewhere, where data protection laws may differ from those in your home country.

12 Changes to this policy

We may update this policy as Nestrel develops. When we do, we'll change the "Last updated" date above.

If a change affects what we collect, how we use it, or who we share it with, we'll tell you in the app before it takes effect and say plainly what is changing — not just post a new version. We won't start using information we already hold for a purpose this policy didn't cover without telling you first. Continuing to use Nestrel after changes take effect means you accept the updated policy.

13 Contact

Questions or privacy requests? Email amahledigitalcreatives@gmail.com.