Introduction
RUSniper ("we", "our", or "us") is a free, student-built course sniping tool for Rutgers University students. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.
By using RUSniper — whether through our Discord bot, website, or any future services — you agree to the practices described in this policy.
Information We Collect
To function correctly, RUSniper collects and stores the following data:
- Discord User ID Collected when you log in with Discord. Used to identify your account and send you DM notifications when a course opens.
- Google Account ID Collected when you log in with Google. Used to identify your account. We store your Google sub ID, display name, and profile picture URL.
- Email Address Collected automatically when you log in with Google (your Google-verified address). For Discord-only accounts, you may optionally add an email via
/settings. Used solely to send course availability alerts via Resend. - Course Index Numbers To track which course sections you are watching.
- Command Usage Logs For debugging, performance monitoring, and improving the service.
- Web Session Data A temporary session token is stored to keep you authenticated. No passwords are stored.
- IP Address Standard web server logs may capture your IP address for security and abuse prevention purposes.
- FCM Device Token When you use the RUSniper mobile app and grant notification permission, a Firebase Cloud Messaging (FCM) device token is collected and stored to deliver push notifications to your device. Multiple devices per account are supported. Tokens are removed when you log out or disable push notifications.
The following data is linked to your identity in our database: Discord User ID, Google Account ID, email address, profile information, and FCM device tokens. Command usage logs and IP addresses are collected for security purposes but are not linked to a named identity beyond the session.
How We Use Your Data
Your data is used exclusively to operate and improve RUSniper:
- Discord User ID Used to send DM notifications when a watched course opens, and to associate your watchlist with your account.
- Google Account ID / Profile Used to identify your account and display your name and avatar in the dashboard. Never used for advertising or shared beyond what is required to operate the service.
- Course Index Numbers Used to monitor Rutgers' Schedule of Classes API on your behalf.
- Email Address Used only to send course opening alerts via Resend. Never used for marketing or shared with any third party beyond Resend for delivery purposes.
- Command Usage Logs Used internally for debugging and service improvements. Never shared externally.
- Session Data Used to authenticate you on the RUSniper website.
- FCM Device Token Used solely to deliver push notifications to your device when a watched course section opens. Never used for analytics or advertising. Automatically removed on logout or when you disable push notifications.
We do not sell, rent, trade, or share your personal data with any third parties for commercial purposes. We do not use your data for advertising, behavioral tracking, or cross-app profiling. We do not use Firebase Analytics, Firebase Crashlytics, or any third-party analytics SDK.
Data Retention
| Data Type | Retention Period |
|---|---|
| Active Snipes | Retained until the section opens and you are notified, after which the snipe becomes inactive |
| Inactive Snipes | Retained until manually deleted via /delete or the web dashboard |
| Email Address | Retained until you remove it via /settings or request deletion |
| Command Logs | Up to 90 days for debugging purposes |
| Session Tokens | Expire automatically after your session ends |
| IP Logs | Up to 30 days |
| FCM Device Tokens | Retained until you log out, disable push notifications, or delete your account |
Notification Channels
When you provide an email address via /settings, the following applies:
- Storage Your email address is stored securely in our database and is only used to send course availability alerts.
- Opt-out You can remove your email and disable email notifications at any time via
/settingsin Discord. Your address will be permanently deleted from our database. - No spam We will never send marketing emails or share your address with any third party beyond Resend for message delivery.
- Delivery provider Emails are sent via Resend (resend.com). Your address is passed to Resend solely for the purpose of delivering course alert emails. See Resend's Privacy Policy.
- Sender address Alerts are sent from
no-reply@rusniper.com. Do not reply to these emails as the address is unmonitored.
Push Notifications (Mobile App)
When you use the RUSniper mobile app (Android or iOS) and grant notification permission, the following applies:
- Permission On Android 13+, the app prompts for notification permission at first login. On iOS, a system permission prompt appears on first launch. You may deny or revoke this permission at any time in your device's system settings.
- Device token A Firebase Cloud Messaging (FCM) token uniquely identifying your device is stored in our database. It is used only to route push notifications to your device.
- Opt-out You can disable push notifications at any time from the app's Settings screen or from your device's system notification settings (Settings → Apps → RUSniper → Notifications). Either method immediately stops push delivery. Using the in-app toggle also removes your device token from our backend.
- Multi-device If you log in on multiple devices (Android or iOS), each device token is stored separately. All tokens are removed when you log out or delete your account.
- Delivery provider Push alerts are sent via Firebase Cloud Messaging (Google) on both Android and iOS. Your device token is passed to Firebase solely for notification delivery. See Firebase Privacy Policy.
Third-Party Services
RUSniper interacts with the following third-party services:
- Discord Our bot operates within the Discord platform. When you log in with Discord, we receive your username and user ID via OAuth2. By using RUSniper, you also agree to Discord's Privacy Policy.
- Google When you log in with Google, we receive your Google Account ID, display name, profile picture, and email address via OAuth2. By using Google login, you also agree to Google's Privacy Policy.
- Rutgers SoC API We query this public API to check course availability. No personal data is sent to Rutgers.
- MongoDB Atlas Your data is stored in a cloud-hosted MongoDB database, encrypted at rest and in transit.
- Resend Used to deliver email notifications when a course opens. Your email address is shared with Resend solely for delivery purposes. See Resend's Privacy Policy.
- Firebase Cloud Messaging (Google) Used to deliver push notifications to your Android and iOS devices via the mobile app. When you grant notification permission, your device's FCM token is sent to Google's Firebase servers for notification routing. Google does not use FCM tokens for advertising or analytics on your behalf. You can opt out at any time by disabling push notifications in the app. See Firebase Privacy Policy.
- AWS (Amazon Web Services) Our backend server and secrets management run on AWS infrastructure. Data in transit to and from our server is encrypted via TLS 1.2 or higher. No personal data is stored directly in AWS outside of encrypted environment variables.
Security
We take reasonable precautions to protect your data:
- Encryption All database connections use TLS encryption. Data is encrypted at rest and in transit.
- Session security Web sessions are secured with signed, encrypted session tokens.
- OAuth tokens Discord and Google OAuth2 access tokens are not logged or stored beyond their immediate use.
- Access control Database access is restricted to authorized systems only.
No system is 100% secure. If you believe your data has been compromised, please contact us immediately. In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of becoming aware of the breach, via Discord announcement and/or email where available.
App permissions used: The RUSniper Android app requests the following permissions: INTERNET (required for all API and OAuth calls) and POST_NOTIFICATIONS (required on Android 13+ to display push notifications — you are prompted before this is granted). No other device permissions are requested. The iOS app requests notification permission via the system prompt only.
Your Rights & Data Deletion
You have the right to access, delete, or correct any data we hold about you. We will process all deletion requests within 7 days.
You may withdraw consent for any non-essential data processing at any time. Withdrawing consent for essential data (such as your account identifier) will require account deletion, as the service cannot function without it.
- Delete account (in-app) Open the app → Settings → scroll to Danger Zone → tap "Delete account". This permanently and immediately deletes your account, all snipes, your email address, and all FCM device tokens. No contact required.
- Remove email Settings → Notification Email → clear the field and save, or use
/settingsin Discord. Instant, no contact required. - Disable push notifications Settings → Push Notifications toggle → off. Your FCM token is removed from our backend immediately.
- Full data export or manual deletion request Contact us via the channels below. We will respond within 7 days.
For full account deletion or other data requests, reach out via one of the following:
Children's Privacy
RUSniper is intended for use by Rutgers University students aged 18 and older. We do not knowingly collect data from anyone under the age of 13. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and post an announcement in our Discord server.
Continued use of RUSniper after changes are posted constitutes acceptance of the updated policy.
Contact
For privacy concerns, data deletion requests, or any questions about this policy: