Hayez Privacy Policy

1Who we are and what this policy covers

Hayez is a campus app for university life: your classes and study, campus maps, events, clubs, campus resources, opportunities and your student society. It is rolling out campus by campus. It is made by Threeward Technologies Inc. (“Threeward”, “we”, “us”), a company based in Burnaby, British Columbia, Canada. Threeward is responsible for the personal information Hayez collects and has a Privacy Officer who is accountable for this policy (see section 22).

This policy covers:

• the Hayez app on iPhone, iPad and Android, and the web version of the app;
• our website, hayez-tw.org, including its contact form;
• club websites that Hayez publishes at hayez-tw.org/c/<club>.

Hayez is an independent app. It is not operated by, affiliated with, or endorsed by any university. Clubs, departmental student unions and your university’s student society (“the student society”) use Hayez to run their own activities. They are separate organizations, and they are responsible for how they use information you give them outside Hayez. Your university’s own systems that Hayez connects to, such as Canvas and the library’s room booking, have their own privacy policies.

We handle personal information in line with British Columbia’s Personal Information Protection Act (PIPA) and, where it applies, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). “Personal information” means information about an identifiable person.

2Who can use Hayez

Hayez is for students and staff of the universities it supports. To create an account you need an email address from one of them. Our servers check this when an account is created or its email is changed.

Some screens, such as events, offers and club pages, can be browsed without signing in. Anything that saves information to an account needs one.

Hayez is not intended for children. See section 18.

What each kind of user shares

Every student

An account, a profile, and whatever you choose to add: classes, notes, study material, posts. Most of it stays private to you (section 9).

Club execs

Also a seat on a club, which the club’s other execs and student society staff can see, and the club’s workspace: plans, minutes, budgets, reimbursements and the club’s public page (section 3.9).

Student society staff

Also a staff seat, the decisions you record and any alerts you turn on. Staff tools show club rosters and student requests for student society work only (section 3.11).

Businesses and vendors

Also verification details and evidence, seen by student society staff, and a public badge or listing once approved (section 3.12).

3What we collect, feature by feature

Hayez does a lot, so this section goes through it feature by feature. For each one it says what is collected, where it is kept (see section 6 for what those places mean) and who else can see it. Section 8 covers what is sent to AI providers.

3.1Your account

• Email address and password. Your university email and the password you choose. Passwords are handled by our authentication provider (Supabase) and stored in hashed form; we can’t read them.
• Your name, as you enter it when signing up.
• Password reset codes. If you reset your password, we email you a one-time code.
• Your signed-in session is stored on your device so you stay signed in.

3.2Your profile and setup

When you first set up Hayez, and later on Profile, you can give us:

• your name, year of study, campus and major (from which we record your faculty and program);
• your interests, used to suggest clubs and events;
• how you want Ze to be: its name, face, tone, how long its briefs are and what they cover, and an optional short “about me” note you write for it;
• your Home layout, the four shortcuts you pick, appearance settings and notification preferences;
• an avatar: an emoji (which syncs to your account) or a photo (which stays on that phone only and is never uploaded);
• optional details that tailor campus resources and opportunities to you, such as whether you are an international student, whether you need help with study or work permits, whether you are in co-op, or whether you are looking for funding;
• grades you enter in the GPA tools.

Your name, faculty, program, year and the date you finished setup are stored in your profile. The rest is kept on your phone and in your account. Your profile is private to you; other users can’t look it up. Places where your name does appear to others are listed in section 9.

3.3Your classes and calendar

• Classes you add: course codes, titles, sections, meeting times and rooms. Courses you’re enrolled in are also recorded in our database so you can join that course’s discussions.
• Connecting Canvas. If you choose to connect Canvas, you sign in on your university’s own sign-in pages inside a private browser window. Hayez never sees your Canvas password. It reads your list of current courses and your Canvas calendar feed link. The course list stays on your phone.
• Calendar feed links. A calendar feed link (from Canvas, Google Calendar, Outlook or iCloud) lets Hayez keep your assignments and events up to date. The link contains a private code that gives read access to that calendar, so treat it like a password. We keep it in your account so all your devices stay in step. Hayez refreshes the feed when you open the app. Our server fetches the feed from your calendar provider and passes it back without storing it; if our server can’t reach it, your phone fetches it directly. Canvas does not let you change this link, so if you no longer want Hayez to read it, disconnect it in Hayez.
• Course information. To fill in class times and course outlines, your phone asks your university’s public course outline service for your courses. The university receives the course codes being looked up, not your name.
• Calendar items: deadlines and events imported from your feed, items you add yourself, and changes you make to them.
• Room bookings you make through Hayez, and library room availability (see section 11).

3.4The Study Suite

Everything below is private to you unless you share it with a group (section 3.14).

• Notes: the text you type, handwriting and drawings (stored as pen strokes), the tags you put on lines (such as key point, likely on the exam, still unclear) and to-dos. Photos and scanned pages inside notes stay on that phone and are not synced.
• Slides and documents: when you add slides or a PDF, PowerPoint or Word file, our server converts it to text and returns it without keeping a copy. Slide text and your annotations are saved in your account. Slide page images are uploaded to private storage that only your account can open, through links that expire, so your slides appear on your other devices.
• Syllabi, readings and other course material: text from syllabi and sources you add (saved in your account), and readings. A reading’s summary card is saved in your account, while its full text stays on your phone. If you add a reading by web link, our server fetches that page for you; the website sees our server, not you. The page is read in memory and not kept; only its text comes back to you. This works only while you are signed in.
• What Hayez makes from your material: week summaries, flashcards and your review history, exam questions and your self-marking, study guides, “explain it back” attempts, learning objectives and your week-by-week course plan.
• Lecture recordings: the audio is saved only on the phone that recorded it. Its title, class, week, length, transcript and the name of the phone it was recorded on are saved in your account so the recording shows on your other devices. If you tap Transcribe, the audio file is sent once, through our server, to our speech-to-text provider (section 8). Recordings are for your personal study only. See section 19.
• Assignments and projects: the assignment sheet or brief, the steps Hayez plans, your drafts and step work, code output, screenshots you attach as evidence (these stay on your phone) and when you hand work in. Exported Word, PDF or PowerPoint files are made on our server and are not kept there.
• Study sessions: focus timers and what you parked during them, kept on your phone. A session summary is saved with your study history.
• Week episodes (a spoken recap of your week): built from your week’s material. If an episode is built only from shared course material such as slides and readings, and not from your own notes, its script may be saved on our server so a classmate with the same material can play it without building it again. It is not shown with your name. Episodes that use your own notes stay on your phone.
• Read-aloud voices and pronunciations: your voice choices and any pronunciation fixes you make.

3.5Ze, the assistant

Ze answers questions about your day, your classes and the app, and tutors you in the Study Suite. Many answers are worked out on your phone from information Hayez already has. When an answer needs an AI model, section 8 explains exactly what is sent.

• Questions you ask, typed or spoken. A spoken question is recorded on your phone and sent for transcription only while you hold the button.
• Conversations: the main Ask Ze conversation is not saved after you leave that screen. Tutor answers are saved on your phone (your last 24 conversations) and are not synced.
• The daily brief on Home is written by AI from your day: your next class and room, what is due, today’s campus events and, if you have tapped how your day went, whether yesterday was rough. You choose which sections it covers.
• Mood check-ins: if you tap how your day went, Hayez keeps the last 120 days in your account, so the brief can be gentler after a rough day.

3.6The Resource Hub

• Searching: a search of one or a few words runs on your phone. If you write a sentence describing your situation and tap the arrow, up to 800 characters are sent through our server to an AI model to match you with the right campus services. This request is not linked to your account and is not stored. We keep only a count of how many times you have asked.
• Sensitive topics: if you look for help because you feel unsafe, Hayez does not record that.
• Services you open: Hayez records which campus services you open and when, and any visits you plan, in your account. This is private to you. It lets Hayez avoid repeating suggestions, follow up once on a visit you planned, and count services used in your monthly recap.
• One suggestion a day: Home shows at most one resource suggestion a day, picked from calendar facts such as fee deadlines rather than from watching what you do.

3.7Opportunities and your career kit

• Job and volunteering listings: our server asks Adzuna (jobs) and VolunteerConnector (volunteering) for listings near your campus. For jobs, it sends the search terms and the roles you’re targeting, never your name or account.
• What you save: saved roles, whether you applied and how it went, the lines you write about your experience, roles you dismissed.
• Your career kit: your resume text (pasted, or read from a file you choose), Hayez’s review of it, your target roles, practice interview answers and mock interview results. Resume files are converted to text on our server and not kept there.

All of this is private to you. Applying for a job happens on the employer’s or listing site, under their privacy policy.

3.8Events

• “I’m going” on an event is private to you. Others see only how many people are going.
• Registering for an event sends the host club your name and account email, plus your answers to the host’s questions. Hosts write their own questions. They can ask, for example, for your student number, faculty and year, dietary needs and allergies, accessibility needs, photo consent, membership status, a guest’s name, an emergency contact, or how you heard about the event. Only answer what you are comfortable sharing. Your registration can be seen by you and by the hosting club’s execs who run events.
• Your event pass is a QR code that contains only a ticket number, never your name or email. When the host scans it or you check yourself in, your arrival time is recorded on your registration.
• Add to calendar writes the event into your phone’s calendar (see section 4).
• Event discussions: messages in an event’s discussion can be read by anyone viewing that event.

3.9Clubs and the exec workspace

Joining a club in Hayez is private. It is saved to your account so Home can show the club’s news. The club is not told.

If you hold an exec seat, the club workspace collects more:

• Claiming a seat: the role you claim, the email and note you enter. The club’s chair can vouch for you, and student society staff verify claims. Both see your name and account email.
• Your seat: role, title, verification status and any authority to book rooms, spend funds or email members. These are visible to the club’s other execs and to student society staff.
• Workspace content: event plans, tasks, handoffs between seats, contribution points, polls and chat, marketing drafts, budgets, and meeting minutes, which can record attendance by name, movers and seconders. All execs of that club can see the workspace.
• Reimbursements: who paid, the amount, the item and a receipt photo. These go to the student society as part of the cheque request. Receipt photos are kept in private storage that only the club’s execs and student society staff can open, through links that expire after an hour.
• Handing over a seat: the incoming exec’s name and email.
• Club pages and websites: execs can publish a club page (also shown as a public website at hayez-tw.org/c/<club>) with a “meet the team” section of names, roles, notes and photos. Club pages, club posts and published events are public.
• Saving minutes to Google Drive: if a club sets this up, minutes are sent to that club’s own Google Apps Script and saved in its Google Drive, under Google’s terms.
• Who did what: changes to who holds which seat are logged, so the club and the student society can see who made them.

3.10The student society space

• Requests: questions, complaints, requests for a record, committee applications and new club proposals. A request holds its title, your message and, depending on the kind, extra details. A record request can include your student number (optional). A club proposal includes the co-founder’s email. A committee application includes why you want to join and when you are available.
• Who sees them: you and student society staff. Requests, including complaints, are not anonymous: staff can tell they came from your account. Your clubs never see them. You can edit or withdraw a request until a staff member picks it up.
• Notices: if you are a club exec, the student society can see whether you have read a notice it sent your club.

3.11If you are student society staff

• Your staff seat and desk, and the decisions you make. Decisions are recorded in a student society log with your name, for accountability.
• Notes you write about clubs, visible to other student society staff except staff who sit on that club.
• If you turn on desk alerts, your phone’s push token, so we can notify you of new requests.
• Staff tools show club rosters with execs’ names and emails, seat claims with claimants’ account emails, club submissions, student requests, business and vendor applications, and reports about offers. Use them only for student society work.

3.12Businesses, offers and vendors

Student offers and Rewards are paused at launch. No offers can be posted, saved or redeemed while they are paused, so the offer items below collect nothing until they reopen. We will update this policy before they do.

• Business verification: legal and trading name, category, description, products and prices, BC registration number, GST/HST number, website and social links, address or online-only status, phone, your account email and photos that prove the business is real. This is visible to you and student society staff only. Evidence photos are kept in private storage.
• The public badge: once verified, the trading name, category, description, products, website and links, and verification date are shown to students.
• Offers that clubs or businesses post are public.
• Redeeming an offer: the student’s receipt code and the time are shared with the offer’s host. Hosts see no names. Your saved offers and claims are kept in your account.
• Reporting an offer: your reason and details, visible to you and student society staff.
• Vendors (selling on campus): your vendor listing, including the name, description and contact email you enter, becomes public once approved. Confirmed booking dates are public too.

3.13Posts, pins, reports and votes

• Explore board posts and replies: your text, any place you mention, any photo you add and your first name. These are public, including to people without an account, until removed. Your account itself is not shown, so a post can’t be linked to your other activity.
• Photos you upload (to a post, an event, a club page, an offer, a receipt or a business application): before a photo leaves your phone, Hayez removes its hidden details: where it was taken, the phone that took it, when, and any author or editing information. Only which way is up is kept. This covers JPEG and PNG photos. Videos are uploaded as they are, so turn off location tagging in your camera before posting a video.
• Reactions, poll votes, showdown votes and likes: private to you. Others see only totals.
• Map pins: the title, notes and position of a pin you drop are public while the pin is active, shown without your name or account.
• Busy, price and rating reports for rooms and food spots: shown to others only as combined levels and averages, not with your name. A room’s busy report is shown for 90 minutes.
• Reporting a post: the report and your account are visible only to the Hayez team. A post reported by three people is hidden automatically while we review it.

3.14Group work, crews and meeting up

• Group projects: you invite groupmates by their university email. Everyone who accepts sees the whole group page: members’ names and emails, the assignment brief, roles, tasks and who owns them, the group agreement, the group chat, shared study material and the group record. The record only grows: entries can’t be edited away, so the group has a fair account of who did what. Private nudges (marked “Only you see this”) are shown only to you. A group project belongs to the person who started it: if they delete their account, the group page is deleted for everyone in it.
• Crews: a crew’s name, your friends’ names and emails as you enter them, goals, check-ins and cheers are kept in your account only. Invitations go out from your own email or share sheet.
• Meet me halfway: while a session is open, your name and an approximate position (snapped to a point in the building, never your raw GPS) are shared every few seconds with people who have your four-character code. Nothing is saved after the session ends.
• Course discussions: messages in a course’s discussion can be read by students enrolled in that course.

3.15Contacting us, and our website

• Contact form on hayez-tw.org: your name, email and message, stored by our website host (Netlify) so we can reply.
• Email you send us, and our replies.
• Visiting our website or a club website: we don’t run analytics or set tracking cookies. Pages load their fonts from Google Fonts, so Google receives your IP address and browser details. Our hosts keep standard technical logs (section 5).

4Permissions on your phone

Hayez asks for a permission only when you first use a feature that needs it. You can say no, and you can change your mind later in your phone’s settings. The rest of the app keeps working without that permission.

Hayez does not use your contacts, Bluetooth, background location, reminders, Face ID, your advertising identifier or app tracking, and the app does not ask for them.

5Information collected automatically

• Crash details. If something goes wrong in the app, Hayez notes the screen, the error message, your platform and the time. When you are signed in, these notes are saved to your account so we can fix problems you report. They record what went wrong, not the content of your notes or messages.
• AI usage counts. To share our AI capacity fairly and keep costs in check, our server keeps a daily total of how much AI each account used (the number of words processed and the cost), never what was asked.
• A random install number. The app makes its own random number for each installation so it can tell your devices apart when syncing recordings. It is not an advertising identifier.
• Technical logs. Like any online service, our hosting providers (Supabase and Netlify) record standard request information such as IP addresses, times and the type of device or browser, for security and to keep the service running. Our own AI gateway logs only technical details such as response codes and request sizes, never the content.
• What we don’t collect. No analytics or advertising software, no device fingerprinting and no tracking across other apps or websites.

6Where your information is kept

Information in Hayez lives in one of four places:

Only on your phone

Lecture audio, photo avatars, photos and scans inside notes, assignment screenshots, the full text of readings, tutor conversations, your location and stride length, map search history, reminder settings and caches. It is removed when you delete it or uninstall Hayez. It is not backed up by us.

In your account (private)

A private copy of your settings, profile details, classes, calendar items and feed link, notes, study material, career kit, saved items, mood check-ins, resource history and similar, kept in sync across your devices. Only your account can read it, and our database enforces that.

In shared spaces

Things you send to a specific group: a group project, a club’s workspace, an event host, the student society, a course discussion. The people in that space can see it (section 9).

Public

Club pages and websites, club posts, events, Explore board posts and replies, map pins, offers, verified business badges, approved vendor listings, event discussions and combined totals such as how many people are going.

The full inventory

Every kind of personal information Hayez handles, in one table. “Your account” means our servers (section 12), readable only by your account. “Database” means our servers, readable by the people named.

7How we use your information, and your consent

We use personal information to:

• run the features you use: show your schedule and deadlines, build study material from your notes, answer your questions, register you for events and pass your requests to the student society;
• keep your information in step across your devices;
• personalize what you see, such as clubs that match your interests and major, or resources relevant to you;
• send reminders and alerts you have turned on;
• keep Hayez secure, prevent misuse, enforce limits and investigate reports;
• fix problems and improve the app;
• respond to you when you contact us;
• meet legal obligations and respond to lawful requests.

We do not sell or rent personal information, use it for advertising, or share it with data brokers. We don’t use your content to train AI models.

Consent. We rely on your consent. You give it when you create an account, when you choose to use a feature (for example, connecting Canvas or registering for an event), and through your phone’s permission prompts. You can withdraw consent at any time by turning off a permission, removing the information, disconnecting a service or deleting your account. If you do, the features that depend on it stop working. We may still keep or use information where the law requires or allows it.

We use information only for the purposes in this policy, or for a new purpose that we tell you about and, where required, ask your consent for.

How Hayez personalizes what you see

• Clubs are suggested from the interests and major you chose, worked out on your phone.
• Home leads with your next class and what is due, from your own schedule.
• Campus resources: at most one suggestion a day, picked from dated facts such as fee and aid deadlines, never from watching what you do. A suggestion you ignore for a few days stops appearing.
• Opportunities are matched to the roles you target and your campus area.
• Ze’s daily brief is written from your day, in the tone and length you chose (section 8).

None of this decides anything about you. It only changes what Hayez shows you first, and you can change the inputs at any time.

8Ze and AI features

What is worked out on your phone, without AI

Many of Ze’s answers come straight from information already in Hayez: your next class and room, what is due, free rooms, events, clubs, how to use the app, and questions about wellbeing, which return a list of campus services. Badges, your monthly recap, Home suggestions and most recommendations are also worked out on your phone.

What may be sent to an AI provider

Who the AI providers are

Requests normally go to Groq. When Groq is busy, a request may go to Cerebras or DeepInfra instead. Speech to text is done by Groq. All three are based in the United States. According to their published terms at the time of writing, none of them uses requests sent through its API to train models. Cerebras and DeepInfra say they don’t keep requests once answered, and Groq says it may keep them for up to 30 days only for troubleshooting and abuse checks.

Reading aloud

By default, Hayez reads text aloud with a voice that runs on your phone (downloaded once, over Wi-Fi). If your phone can’t run it, or on the web, the text is sent through our server to DeepInfra or Microsoft Azure to make the audio. To save work, we keep these audio clips in private storage, identified only by a code made from the text and voice, not linked to any account.

Limits of AI

AI answers can be wrong. Check anything important, such as deadlines, grades or rules, against the source. Hayez does not use AI to make decisions about you that have legal or similarly significant effects. Drafts such as a group fairness report stay yours to edit or discard.

9Who can see your information

Only you

Your profile, settings, notes and study material, classes and calendar, career kit, saved items, mood check-ins, resource history, crews, likes, votes and “I’m going”.

Your groupmates

Everything on a group project page you share (section 3.14).

Students in your course

Messages you post in that course’s discussion.

People with your Meet code

Your name and approximate position while the session is open.

Club execs

For their club only: your event registrations (name, account email, answers, arrival time), receipt codes when you redeem their offers, your seat claim, and, if you are an exec, your seat and the workspace.

Student society staff

Your student society requests, exec seat claims (with your name and account email), club rosters with execs’ names and emails, club submissions including reimbursements, business and vendor applications, offer reports, and whether execs read student society notices.

Businesses

Only the receipt code and time when you redeem their offer.

Everyone

The public items listed in section 6, including Explore posts with your first name and any club page that lists you on its team.

Your university

Nothing from your Hayez account. Its services see only the lookups described in sections 3.3 and 11.

The Hayez team

A small number of Threeward staff can access our systems to run, secure and fix Hayez. We don’t look at your notes, messages or other content unless you ask us to help with something, we need to investigate a report, misuse or a security problem, or the law requires it.

We may also disclose personal information:

• to the service providers in section 10, only so they can provide their service to us;
• when the law requires it, such as a warrant, court order or subpoena that we have reviewed, or when the law permits it, such as in an emergency that threatens someone’s life, health or safety, or to investigate a breach of an agreement or the law. We disclose only what the request requires and, where the law allows, we tell you first so you can respond;
• to a buyer or successor if Threeward or Hayez is sold, merged or reorganized, on condition that they keep protecting it as this policy describes. We will tell you before that happens.

Combined numbers. Hayez shows, and may share, totals that can’t identify anyone, such as how many students are going to an event, how busy a room is, or how many times an offer has been redeemed.

10Service providers

These companies process personal information on our behalf. We give them only what they need for their part of the service.

11Other services you meet inside Hayez

Some content in Hayez comes straight from other services. When it loads, that service receives your IP address and basic device or browser details, and handles them under its own privacy policy.

• Instagram and TikTok: when a club’s post in Explore is an Instagram or TikTok post, it plays in that platform’s own embedded player, which may use its own cookies and tracking.
• Jamendo and Openverse: music on club reels streams from Jamendo; its cover art loads from Openverse.
• Map labels: the map’s label fonts load from the OpenMapTiles font server.
• Your university: course outlines (section 3.3) and library room availability. Room availability is usually fetched by our server, but your phone may ask the library’s booking system directly if that fails. Booking a room opens the university’s booking site.
• Canvas and your calendar provider: see section 3.3.
• GitHub: the on-phone voice is downloaded from GitHub.
• VolunteerConnector: our server fetches volunteering listings; nothing about you is sent.
• Links to websites, email and phone numbers open outside Hayez.

12Information stored or processed outside Canada

Your account and everything stored with it are hosted by Supabase on Amazon Web Services servers in Northern Virginia, in the United States (region us-east-1). Several of our other service providers are also in the United States, and some information is processed there or elsewhere outside Canada (see section 10). While it is there, it is subject to the laws of that country, and authorities there may be able to access it under those laws. We choose providers with strong security and contractual protections, and we send them only what they need.

13How long we keep it

We keep personal information only as long as we need it for the purposes in this policy, or as the law requires.

If we use personal information to make a decision that directly affects you, we keep it for at least one year after that decision, as BC law requires, so you have a chance to ask for it.

14Your choices and controls

• Permissions: turn location, camera, photos, microphone, notifications, motion and calendar on or off in your phone’s settings.
• Notifications: turn each kind of reminder on or off in Hayez. Reminders can show your next class, its room or what is due; if others can see your lock screen, turn off notification previews in your phone’s settings.
• Ze: choose what the daily brief covers, edit or clear your “about me” note, and decide what to ask.
• Your content: edit or delete notes, recordings, slides, saved items, posts, pins and other things you add. Deleting something in Hayez removes it from your account on all your devices.
• Canvas and calendar feeds: disconnect them at any time.
• Events and requests: cancel a registration; edit or withdraw a student society request until a staff member picks it up.
• What you share: you decide what to post publicly and what to answer on event forms.
• Sync status: the Account screen shows whether this device is syncing with your account.

What each notification shows

15Your rights

You have the right to:

• access the personal information we hold about you, and learn how it has been used and to whom it has been disclosed;
• correct information that is wrong or incomplete;
• withdraw consent, as described in section 7;
• ask us to delete your information (section 16);
• complain to us, and to a privacy regulator.

To make a request, email us at the address in section 22 from your university email address, or tell us how to confirm it is you. We will respond within 30 days, as BC law requires, or tell you if we need more time and why. Access requests are free. If we can’t give you some information, for example because it would reveal information about someone else, we will tell you why, as far as the law allows.

Keeping it accurate. Most of your information is yours to edit directly: your name, profile, classes, notes and settings. For anything you can’t edit, such as a record a club or the student society keeps about you, tell us or them and it will be corrected or a note added that you disagree.

If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca) or, where federal law applies, the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you live outside Canada, the laws where you live may give you further rights, and you can use the same address to exercise them.

16Deleting your account

You can delete your account in Hayez at Profile → Account → Delete my account, or by emailing us from your university email address.

When you confirm in the app, our server deletes your account straight away:

• your sign-in record, your profile and everything synced to your account;
• your classes and course enrolments, your “I’m going” list, event registrations, room bookings, student society requests, offer redemptions and reports, crews, mood check-ins and the rest of your private information;
• your public posts, replies and map pins, your busy and rating reports, your likes and votes, and your discussion messages;
• the files you uploaded for yourself: Explore photos, slide pages and business evidence;
• invitations waiting for your email address, your exec seats and the authorities that came with them, and your AI usage totals;
• your business and vendor listings, if you have them. Offers posted by your business close.

Then the app clears the phone you deleted from: everything Hayez stored on it, including lecture recordings, slide pages, saved files and your Canvas access.

If the server can’t finish, nothing is deleted, and the app tells you. Try again, or email us and we will complete the deletion within 30 days.

What stays, and why

• Records that belong to a club or the student society: club posts, events and links you published for a club, club media and receipts, meeting minutes, submissions you made on behalf of a club, and the student society’s log of decisions about seats and requests. They stay with the club or the student society and are no longer linked to your account. Your name stays where it was written into them, so their history stays accurate.
• Group projects: a group project you started is deleted for everyone in it. A group project you joined stays with the group, and your name and your entries stay in its record.
• Discussions you started stay, because they hold other people’s messages. Your own messages are deleted.
• Your other devices keep what Hayez stored on them, such as lecture audio, until you delete it or remove Hayez.
• Backups: our hosting provider’s encrypted backups roll over within a short time, after which the deleted information is gone from them too.
• Legal holds: information we must keep by law.

17How we protect your information

• Information travels between the app, our servers and our providers over encrypted connections.
• Our database checks every request against rules about who may read or change each kind of record, so, for example, only your account can read your private account data.
• Private files, such as your slide pages, receipt photos and business evidence, are kept in private storage and opened through links that expire.
• Photos have their hidden details, such as location, removed on your phone before they upload.
• Account identifiers are not shown to other users or the public, so your posts, pins and reports can’t be linked together.
• Account deletion runs on our server, so it completes in one step instead of leaving pieces behind.
• Keys for AI and other services are kept on our servers, never in the app.
• Features that run on our servers for you, such as Ze, the resource matcher, reading a web link or an uploaded file, and drawing a card you share, work only for signed-in students, with a limit on how often each student can use them.
• Only email addresses from the universities Hayez supports can create accounts. The one exception is a single account we hold so Apple can review the app; it is a test account with no special access.
• Your password is handled by our sign-in provider and stored hashed. Your Canvas password is never seen by Hayez.
• Staff access is limited to what is needed to run and support Hayez.

No system is perfectly secure. Keep your password private, lock your phone, and treat calendar feed links like passwords. If a breach of security creates a real risk of significant harm to you, we will notify you, and the regulators, as the law requires.

18Children

Hayez is made for university students and staff, and an account needs a university email address. It is not directed at children, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

19Other people’s information

Some features let you enter information about other people. Please do so responsibly:

• Lecture recordings capture your instructor and classmates. Record only where your university’s policies and your instructor allow it, use recordings for your own study, and don’t share them.
• Club team pages: ask people before listing their name, role or photo on a public club page.
• Minutes, rosters and reimbursements: record only what your club needs, as your club’s and the student society’s rules require.
• Groupmates and crew members: only invite people who expect to hear from you.
• Event hosts: ask only for what you need to run the event, use the answers only for that event, and keep sensitive answers (such as health, accessibility or emergency contacts) to the people who need them.
• Emergency contacts: let the person know before you give their details to a host.

20Cookies and device storage

The app keeps you signed in and remembers your settings using storage on your device, not advertising cookies. The web version of the app uses your browser’s storage the same way. Our website and club websites don’t set tracking cookies. Embedded Instagram and TikTok players, and Google Fonts, may set or read their own cookies under their policies.

21Changes to this policy

We will update this policy when Hayez changes. The date at the top shows the latest version. If we make a significant change, such as collecting a new kind of information, sharing it with someone new or using it for a new purpose, we will tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.

22Contact us

For questions, requests or complaints about privacy, contact our Privacy Officer:

Please put “Privacy” in the subject line so your message reaches the right person.