Privacy Policy

Introduction

RUSniper ("we", "our", or "us") is a free, student-built course sniping tool for Rutgers University students. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

By using RUSniper — whether through our Discord bot, website, mobile app, or any future services — you agree to the practices described in this policy.

Information We Collect

To function correctly, RUSniper collects and stores the following data:

• Discord User ID Collected when you log in with Discord. Used to identify your account and send you DM notifications when a course opens.
• Google Account ID Collected when you log in with Google. Used to identify your account. We store your Google sub ID, display name, and profile picture URL.
• Email Address Collected automatically when you log in with Google (your Google-verified address). For Discord-only accounts, you may optionally add an email via /settings. Used solely to send course availability alerts via Resend.
• Course Index Numbers To track which course sections you are watching.
• Command Usage Logs For debugging, performance monitoring, and improving the service.
• Web Session Data A temporary session token is stored to keep you authenticated. No passwords are stored.
• IP Address Standard web server logs may capture your IP address for security and abuse prevention purposes.
• Apple User ID & Profile When you sign in with Apple on iOS, Apple provides a unique Apple User ID, your display name (first sign-in only), and an email address (real or Apple relay). Stored to identify your account and send course alerts. You may disable email notifications at any time in Settings.
• FCM Device Token When you use the RUSniper mobile app and grant notification permission, a Firebase Cloud Messaging (FCM) device token is collected and stored to deliver push notifications to your device. Multiple devices per account are supported. Tokens are removed when you log out or disable push notifications.

The following data is linked to your identity in our database: Discord User ID, Google Account ID, Apple User ID, email address, profile information, and FCM device tokens. Command usage logs and IP addresses are collected for security purposes but are not linked to a named identity beyond the session.

How We Use Your Data

Your data is used exclusively to operate and improve RUSniper:

• Discord User ID Used to send DM notifications when a watched course opens, and to associate your watchlist with your account.
• Google Account ID / Profile Used to identify your account and display your name and avatar in the dashboard. Never used for advertising or shared beyond what is required to operate the service.
• Course Index Numbers Used to monitor Rutgers' Schedule of Classes API on your behalf.
• Email Address Used only to send course opening alerts via Resend. Never used for marketing or shared with any third party beyond Resend for delivery purposes.
• Command Usage Logs Used internally for debugging and service improvements. Never shared externally.
• Session Data Used to authenticate you on the RUSniper website.
• Apple User ID / Profile Used to identify your account and display your name in the app. The email Apple provides is used for course alert delivery in the same way as a Google-verified email. Never used for advertising or shared beyond what is required to operate the service.
• FCM Device Token Used solely to deliver push notifications to your device when a watched course section opens. Never used for analytics or advertising. Automatically removed on logout or when you disable push notifications.

We do not sell, rent, trade, or share your personal data with any third parties for commercial purposes. We do not use your data for advertising, behavioral tracking, or cross-app profiling. We do not use Firebase Analytics, Firebase Crashlytics, or any third-party analytics SDK.

Data Retention

Notification Channels

Email

When you provide an email address via /settings, the following applies:

• Storage Your email address is stored securely in our database and is only used to send course availability alerts.
• Opt-out You can remove your email and disable email notifications at any time via /settings in Discord or the app's Settings. Your address will be permanently deleted from our database.
• No spam We will never send marketing emails or share your address with any third party beyond Resend for message delivery.
• Delivery provider Emails are sent via Resend (resend.com). Your address is passed to Resend solely for the purpose of delivering course alert emails. See Resend's Privacy Policy.
• Sender address Alerts are sent from no-reply@rusniper.com. Do not reply to these emails as the address is unmonitored.

Push Notifications (Mobile App)

When you use the RUSniper mobile app (Android or iOS) and grant notification permission, the following applies:

• Permission On Android 13+, the app prompts for notification permission at first login. On iOS, a system permission prompt appears on first launch. You may deny or revoke this permission at any time in your device's system settings.
• Device token A Firebase Cloud Messaging (FCM) token uniquely identifying your device is stored in our database. It is used only to route push notifications to your device.
• Opt-out You can disable push notifications at any time from the app's Settings screen or from your device's system notification settings (Settings → Apps → RUSniper → Notifications). Either method immediately stops push delivery. Using the in-app toggle also removes your device token from our backend.
• Multi-device If you log in on multiple devices (Android or iOS), each device token is stored separately. All tokens are removed when you log out or delete your account.
• Delivery provider Push alerts are sent via Firebase Cloud Messaging (Google) on both Android and iOS. Your device token is passed to Firebase solely for notification delivery. See Firebase Privacy Policy.

Third-Party Services

RUSniper interacts with the following third-party services:

• Discord Our bot operates within the Discord platform. When you log in with Discord, we receive your username and user ID via OAuth2. By using RUSniper, you also agree to Discord's Privacy Policy.
• Google When you log in with Google, we receive your Google Account ID, display name, profile picture, and email address via OAuth2. By using Google login, you also agree to Google's Privacy Policy.
• Rutgers SoC API We query this public API to check course availability. No personal data is sent to Rutgers.
• MongoDB Atlas Your data is stored in a cloud-hosted MongoDB database, encrypted at rest and in transit.
• Resend Used to deliver email notifications when a course opens. Your email address is shared with Resend solely for delivery purposes. See Resend's Privacy Policy.
• Firebase Cloud Messaging Used to deliver push notifications to your Android and iOS devices via the mobile app. When you grant notification permission, your device's FCM token is sent to Google's Firebase servers for notification routing. Google does not use FCM tokens for advertising or analytics on your behalf. You can opt out at any time by disabling push notifications in the app. See Firebase Privacy Policy.
• Apple On iOS, Sign in with Apple is handled through Apple's identity services. Apple provides RUSniper with a user identifier, display name, and email (real or relay). By signing in with Apple, you also agree to Apple's Privacy Policy.
• AWS (Amazon Web Services) Our backend server and secrets management run on AWS infrastructure. Data in transit to and from our server is encrypted via TLS 1.2 or higher. No personal data is stored directly in AWS outside of encrypted environment variables.

Security

We take reasonable precautions to protect your data:

• Encryption All database connections use TLS encryption. Data is encrypted at rest and in transit.
• Session security Web sessions are secured with signed, encrypted session tokens.
• OAuth tokens Discord, Google, and Apple OAuth tokens are not logged or stored beyond their immediate use.
• Access control Database access is restricted to authorized systems only.

No system is 100% secure. If you believe your data has been compromised, please contact us immediately. In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of becoming aware of the breach, via Discord announcement and/or email where available.

App permissions used: The Android app requests INTERNET (required for all API and OAuth calls) and POST_NOTIFICATIONS (required on Android 13+ — you are prompted before this is granted). The iOS app requests notification permission and, optionally, foreground location permission ("While Using the App") solely for the Transit tab to rank nearby bus stops. Location permission is never required to use any other feature. Both apps request no other device permissions.

Your Rights & Data Deletion

You have the right to access, delete, or correct any data we hold about you. We will process all deletion requests within 7 days.

You may withdraw consent for any non-essential data processing at any time. Withdrawing consent for essential data (such as your account identifier) will require account deletion, as the service cannot function without it.

• Delete account (in-app) Open the app → Settings → scroll to Danger Zone → tap "Delete account". This permanently and immediately deletes your account, all snipes, your email address, and all FCM device tokens. No contact required.
• Remove email Settings → Notification Email → clear the field and save, or use /settings in Discord. Instant, no contact required.
• Disable push notifications Settings → Push Notifications toggle → off. Your FCM token is removed from our backend immediately.
• Full data export or manual deletion request Contact us via the channels below. We will respond within 7 days.

For full account deletion or other data requests, reach out via one of the following:

Cookies

The RUSniper website uses one type of cookie:

• Session cookie (strictly necessary) A short-lived cookie is set when you log in to the web dashboard. It stores an encrypted session token used solely to keep you authenticated during your visit. No password is stored in this cookie. It expires when your browser session ends or when you log out.

We do not use analytics cookies, advertising cookies, tracking pixels, or any third-party cookies of any kind. Because the only cookie we use is strictly necessary for the service to function, no cookie consent banner is displayed — this is consistent with CCPA, the EU ePrivacy Directive, and all other applicable cookie regulations.

You can block or delete cookies in your browser settings at any time. Blocking the session cookie will prevent you from staying logged in to the dashboard.

Children's Privacy

RUSniper is intended for use by Rutgers University students aged 18 and older. We do not knowingly collect data from anyone under the age of 13. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), to the extent they apply:

• Right to Know You have the right to request disclosure of the categories and specific pieces of personal information we collect about you, the purposes for which we use it, and whether we disclose it to third parties.
• Right to Delete You have the right to request deletion of personal information we have collected from you, subject to certain exceptions. You can do this instantly in-app via Settings → Danger Zone → Delete Account, or by contacting us.
• Right to Correct You have the right to request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing We do not sell, share, or disclose your personal information to third parties for cross-context behavioral advertising. There is nothing to opt out of.
• Right to Limit Use of Sensitive Personal Information We do not collect sensitive personal information as defined by the CPRA (e.g., precise geolocation, financial data, biometrics). Location is processed on-device only and never transmitted to our servers.
• Right to Non-Discrimination We will not discriminate against you for exercising any of these rights. Because RUSniper is entirely free, exercising your rights cannot affect any paid service level.

To exercise any of these rights, contact us via the channels in Section 13. We will respond within 45 days as required by California law. We may ask you to verify your identity before processing your request.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and post an announcement in our Discord server.

Continued use of RUSniper after changes are posted constitutes acceptance of the updated policy.

Contact

For privacy concerns, data deletion requests, or any questions about this policy: