Privacy Policy

StockAttack School Calendar · version 2026-09-24

The short version. We keep what the calendar needs to work: your name, your email, the calendar links you paste in (encrypted), and your due dates. We never ask for, see, or store your school password, and we never log into your school accounts. No ads, no tracking, and we never sell anything about you. The person who runs the service can open your calendar to help you, and every time that happens it shows up in your calendar's activity list. You can ask for everything to be deleted.

Who we are

The StockAttack School Calendar is run by Hunter Berresford, Lethbridge, Alberta ("we"). We follow Alberta's Personal Information Protection Act (PIPA). Questions, requests, or complaints: use the Support page when signed in, or email hunterberresford@gmail.com.

What we collect

• Your account: your name, email address, an optional username, and your password. The password is stored only as a one-way scrambled form (a hash); nobody, including us, can read it back.
• Your calendar links: the private Moodle, Outlook or other calendar links you paste in. They are stored encrypted and are never shown again, not even to you.
• What those links contain, and what you add by hand: titles, course codes, descriptions, times and places of assignments, quizzes, exams, labs and classes; which ones you have ticked off.
• Your settings: whether the morning email is on, how far ahead it looks, and your time zone.
• An activity list for your calendar: actions such as "added a feed", "ticked off", "sent a test of the morning email", or "opened by an admin". It names web sites (like moodle.uleth.ca), never your links. The internet (IP) address recorded with each action is removed after 30 days; the action itself stays.
• Posts you write on the Community or Support pages.
• Security records: each sign-in and sign-up attempt, with the internet (IP) address it came from, so we can stop password guessing. These are deleted after 30 days.
• Payment status: whether your subscription is on trial, active or cancelled, and a reference number from our payment processor. Your card details go straight to Stripe and never reach our server.
• Email records: that a morning email was sent on a given day and how many items it listed.

Your browser also keeps one sign-in cookie, and remembers a few display choices (for example which sources you have hidden) in its own storage. There are no advertising or analytics trackers on the calendar.

Why we use it

• To show your due dates, check your links every 30 minutes, and send the emails you asked for: the email-address check, password resets, notices about changes to your account, and the morning email if you turn it on.
• To keep accounts secure and to help you when something goes wrong.
• To handle your subscription.

We do not use your information for anything else, and we do not sell, rent or trade it.

Who can see it

• You.
• The administrator (the person who runs the service) can open any calendar, to help with support or fix a problem. Every time, "opened by an admin" is added to that calendar's activity list, so you can see it happened.
• Other students see only what you post on the Community page, shown under your first name and a number (for example "Sam #2987"). Support posts are seen only by you and the administrator.
• Service providers that do a job for us, and only what that job needs: Stripe (payments) and Resend (sends our emails, so it handles your email address and the email's contents). Both are in the United States, so this information may be stored there and be subject to United States law. Our web server is run by a hosting provider, whose standard server logs record the IP address, page and time of each visit. You can ask us about how these providers handle your information.
• Anyone else only if the law requires it.

How long we keep it

For as long as you have an account. An account whose email address is never confirmed is deleted automatically 7 days after sign-up. Ask us to delete your account (Support page or email) and we delete your account, your calendar, your links, your due dates, your settings, your posts and your calendar's activity list, and cancel any subscription. Nightly backups are kept for up to 30 days, so a deleted account disappears from them within 30 days. Security records are deleted after 30 days whether or not you have an account. We may keep what the law requires (for example payment records kept by Stripe).

How we protect it

The site only works over an encrypted connection (HTTPS). Calendar links are encrypted before they are stored, passwords are stored only as hashes, each student's calendar is kept separate from everyone else's, and repeated sign-in attempts are blocked. The service is tested regularly, including by people trying to break into it. No system is perfectly secure; if something ever went wrong that put your information at real risk, we would tell you and the Alberta privacy commissioner as the law requires.

Your choices and rights

• See and correct: your name and email are on the Account page; ask us for a copy of anything else we hold about you, or to correct it.
• Change your mind: turn the morning email off, remove a calendar link, or delete your account at any time. Without an account we cannot provide the calendar.
• Complain: tell us first. If you are not satisfied, you can contact the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

Changes

If we change this policy in a way that matters, we will post the new version here and ask you to agree again the next time you open your calendar.