# Collective Souls Academy — Privacy Policy **Review draft dated October 13, 2026. Published for review; not yet adopted.** Effective date: the date displayed when adopted. Operator: Collective Souls Academy. Website: https://collectivesoulsacademy.com/. Proposed privacy contact: Reina_martha809@hotmail.com, subject to administrator confirmation. This policy describes the Academy website’s current library, sign-in, student notes, and administration functions. The section on automated assistance applies only when that feature is activated and must be checked against its final implementation before publication. It does not describe the practices of every external website linked from the library. ## 1. Information we process - **Account information:** Email address, account identifier, authentication and confirmation status, and information necessary to register, sign in, recover access, or secure an account. Authentication is provided through Supabase. The Academy’s ordinary interface does not display your password to library administrators. - **Student desk information:** Notes, checklist choices, associated library-document identifiers, and update information saved to your account. - **Library administration:** Files and descriptions uploaded by owners, edits and removal status, and an audit record identifying the administrator and time of an update. Administrative update history is restricted to authorized owners. Public library entries and uploaded public files can be accessed by visitors. - **Technical information:** Our hosting and authentication providers may process IP addresses, device or browser information, timestamps, session information, request metadata, and security or error logs to deliver and protect the service. - **Communications:** Information you provide when requesting assistance, reporting an issue, or making a privacy request. Do not provide unnecessary sensitive information. Redact full Social Security numbers, full bank or payment-card numbers, credentials, protected third-party information, and sealed or confidential court material before using educational tools. ## 2. Why we use information We use information to provide access to accounts; save and retrieve each student’s notes and checklists; maintain the library; send account-confirmation and password-recovery emails; respond to requests; investigate abuse; correct problems; and meet legal obligations. If automated assistance is activated, information you deliberately submit to that feature will be used to generate the requested response or draft. We do not promise that educational tools establish confidentiality, attorney-client privilege, or a professional relationship. The Academy does not obtain ownership of your private notes merely because you save them. ## 3. Student privacy and administrator access Student notes are separated by account so that another student should not be able to read your notes through their account. They are not published in the public library. Authorized hosting administrators and service providers may access data where reasonably necessary for maintenance, support, security, legal compliance, or a request you make. Library ownership alone should not give routine access to a student’s private workspace. Public-library uploads are different: files and descriptions placed in the public library are intended to be public and may be downloaded, copied, or indexed. Removing a link may not remove copies already obtained by others. Do not upload private case records to the public library. ## 4. Providers and external features We use third parties to operate the service, including: - **Supabase:** Account registration, authentication, and session services. [Supabase privacy notice](https://supabase.com/privacy). - **Resend:** Delivery of account-related emails. [Resend privacy notice](https://resend.com/legal/privacy-policy). - **OpenAI Sites and hosting infrastructure:** Website delivery and application storage. Cloudflare infrastructure is used in connection with the domain and hosting. [OpenAI privacy policy](https://openai.com/policies/privacy-policy/) and [Cloudflare privacy policy](https://www.cloudflare.com/privacypolicy/). - **Google Programmable Search:** Government-information searches and embedded results. Google may receive your query and related browser or device information when that feature is used. [Google privacy policy](https://policies.google.com/privacy). When activated, the student assistant will use the **OpenAI API**. Text and selected document passages sent for a response may be processed by that provider. API data is not used to train OpenAI models by default, but provider retention and security processing depend on the service and configuration. We do not claim zero retention or that data stays entirely on your device. [OpenAI API data controls](https://developers.openai.com/api/docs/guides/your-data). Third-party educational links, including Kill Debt, receive information under their own policies when visited. Access to a linked service is not the same as a private Academy workspace. ## 5. Cookies and sessions The Academy uses essential sign-in cookies to maintain authenticated sessions. Current account-session cookies are Secure and HttpOnly and are configured with SameSite protections. You may block or remove cookies through your browser, but account features may stop working. Embedded search and outside sites may use their own cookies or similar technologies. Sign out after using a shared device; clearing browser cookies does not delete notes already saved to your account. ## 6. Disclosures We disclose information to providers as needed to operate the requested service, to authorized personnel for legitimate administration, when legally required, and where reasonably necessary to investigate misuse or protect rights and security. If operations transfer to another operator, information may transfer subject to applicable law and appropriate notice. Any optional new use requiring consent will be presented separately where legally required. This draft does not assert “we never share data,” “we never sell data,” or a legally defined sale/sharing exemption without reviewing the final search, analytics, advertising, and provider arrangements. The published policy must state the Academy’s actual practices and include any notices or opt-out mechanisms required by applicable law. ## 7. Retention and deletion Saved notes and checklist information remain associated with your account until removed through an available control or an approved deletion request, subject to necessary legal and operational exceptions. Security logs, administrative audit records, email records, and provider backups may have different retention periods. The Academy has not yet established a verified automatic deletion schedule for every category and does not promise immediate erasure from backups or provider logs. You may ask for deletion of your account or personal information by contacting the privacy address. We will verify your authority, review applicable requirements, and explain any information retained for a lawful reason. Do not send identity documents or unnecessary sensitive information with your first request. A deletion request is not a request to erase public court records held by other organizations. ## 8. Choices and rights You may choose to browse the public library without creating an account, avoid embedded search, refrain from submitting sensitive information, and contact us to request access, correction, export, or deletion of your personal information. Depending on your location and applicable law, you may have additional rights, such as objection, restriction, appeal, withdrawal of consent, or complaint to a regulator. We will handle requests within applicable legal requirements; this draft does not claim that every jurisdiction grants identical rights or that every exemption applies to us. ## 9. Security and international processing The service uses HTTPS, account verification, and access restrictions for private workspaces. No internet service is completely secure. Protect your credentials and notify us of suspected unauthorized access. Provider systems may process information outside your state or country. Do not assume that all information remains in a single location merely because the Academy operates a custom domain. ## 10. Children Account and document-preparation features are intended for adults age 18 or older. We do not knowingly seek personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action. An age statement alone does not replace safeguards or parental-consent obligations where applicable. ## 11. Policy changes and contact We will display an effective date and provide appropriate notice of material changes. Contact the Academy at the confirmed privacy address for questions or requests. The final notice must identify the actual legal operator and include any address or representative information required by applicable law. --- **Owner review before adoption:** Confirm the legal operator, location, and contact; inventory embedded cookies and provider arrangements; establish retention and deletion procedures; verify account-age controls; and update the assistant section after implementation. Do not publish this draft as an assurance that unfinished controls already exist. Review state-specific and international requirements with counsel as appropriate. **Drafting references:** [FTC consumer privacy guidance](https://www.ftc.gov/business-guidance/privacy-security/consumer-privacy); [FTC COPPA guidance](https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions); provider notices linked above. These references inform the draft and do not establish that the Academy complies with every applicable law.