Privacy Policy

The short version

• You can browse this website without an account. We do not run ads, analytics or tracking cookies.
• We only receive personal information when you choose to send it: through the contact form, the Pulse assistant, or, for the BMES executive team, by signing in to the admin area.
• We never sell your information, and we only share it with the services that run this website, as described below.

Contact form

When you send a message through the contact page, we receive your name, email address, subject and message. They are emailed to the BMES executive team through our email provider, Resend, so we can reply. The website does not keep a copy; the message lives in the BMES inbox.

Pulse, the website assistant

Questions you type into Pulse are sent to Groq, which generates the answer, and to Hugging Face, which helps find the relevant information about BMES. Pulse does not ask who you are and does not link questions to you. Questions may appear briefly in our hosting provider's server logs, which are kept for a short period for troubleshooting. Please do not enter personal or sensitive information into Pulse.

Admin sign-in (BMES executive team only)

Members of the BMES executive team can sign in to a private admin area to update the website, such as adding events and photos. Sign-in uses Sign in with Google. When you sign in, Google shares with us:

• your name,
• your email address, and
• confirmation that Google has verified that email address.

We do not receive your Google password, contacts, files or any other Google data.

We use this information only to:

• check whether your email is on the list of people allowed to use the admin area,
• keep you signed in (a secure cookie that lasts up to 8 hours), and
• record who made each change to the website.

What we store. For people with admin access, we keep your email address, name, role (editor or owner), when you were added and when you last signed in. If you request access, we keep your email address, name, any note you add, and whether the request was approved or declined. This is stored in our database provider, Supabase, and is only visible to BMES admin owners.

Change history. This website's code is published openly on GitHub. When an admin saves a change, the change is recorded in that public history with the admin's name and email address, so the club can see who changed what and undo mistakes.

Google user data. Our use of information received from Google follows the Google API Services User Data Policy, including the Limited Use requirements. We do not use it for advertising, do not sell it, and do not share it except with the service providers listed below to run the admin area.

Cookies

Visitors get no cookies from us. The admin area sets strictly necessary cookies only for people signing in: one for the sign-in handshake with Google (10 minutes), and one that keeps an admin signed in (up to 8 hours).

Services we use

• Vercel hosts the website.
• Resend delivers contact form messages and admin notifications by email.
• Groq and Hugging Face power the Pulse assistant.
• Supabase stores the admin access list and the information Pulse answers from.
• Google provides admin sign-in.
• GitHub stores the website's code, content and change history.

How long we keep it

Admin access records are kept while you have access, and are removed when an owner removes you or when you ask us to. Access requests are kept so owners can see past decisions, and are deleted on request. Entries in the public change history are part of the website's code history and generally cannot be removed. Contact form messages are kept in the BMES inbox for as long as they are useful for club business.

Your choices

You can ask to see, correct or delete the information we hold about you, or to have your admin access removed, by emailing bmes@torontomu.ca. You can also stop the website's access to your Google account at any time from your Google Account settings, under Security, Third-party connections.

Changes to this policy

If we change how we handle information, we will update this page and the date at the top.