Privacy Policy

Effective Date: March 15, 2026

This Privacy Policy describes how undrstdy (“we,” “us,” or “our”) collects, uses, protects, and handles your information when you use undrstdy.org (the “Platform”). We are committed to protecting your privacy and providing you with control over your data.

1. Our Commitment to Your Privacy

We do not sell, rent, trade, or otherwise share your personal information with third parties for their marketing purposes. We do not monetize your data. The information you provide to us is used solely to provide and improve the Platform services for you.

Additionally, we offer you the option to encrypt your data at the source using a show code that only you control. When you enable this encryption option, your data is encrypted before it reaches our servers. We cannot decrypt or access your encrypted data without your show code. You are solely responsible for maintaining the confidentiality of your show code. If you lose your show code, we cannot recover your encrypted data.

2. Information We Collect

We collect the following categories of information:

• Account Information: When you create an account using Google authentication, we collect your name, email address, and profile picture as provided by Google.
• User Content: We collect and store the content you create, upload, or transmit through the Platform, including show details, participant submissions, images, and program content. If you choose to enable encryption, participant submissions are encrypted using your show code before storage.
• Authentication Cookies: We use cookies solely for authentication purposes, including keeping you signed in, providing cross-site request forgery (CSRF) protection, and storing redirect URLs during OAuth authentication flows. We do not use cookies for tracking, analytics, or advertising purposes.

3. How We Collect Information

Information is collected in the following ways:

• Directly From You: When you register for an account, complete forms, upload content, or submit participant information.
• Automatically: Through authentication cookies when you use the Platform.
• From Third Parties: We receive your name, email address, and profile picture from Google when you log in through Google OAuth.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the Platform services.
• To create and manage your account.
• To process your requests and transactions.
• To communicate with you about the Platform, including sending a welcome email when you first create your account.
• To detect, prevent, and address technical issues, fraud, and security vulnerabilities.
• To comply with legal obligations and enforce our Terms of Use.

5. Information Sharing

We do not sell or share your personal information for marketing purposes. We may share information only in the following limited circumstances:

• Service Providers: We may share information with third-party service providers who perform services on our behalf, such as hosting and data storage. These providers are contractually obligated to protect your information and use it only for the purposes we specify.
• Legal Requirements: We may disclose information if required to do so by law or in response to valid requests by public authorities, including to meet law enforcement requirements.
• Protection of Rights: We may disclose information to protect our rights, property, or safety, or the rights, property, or safety of our users or others, including to enforce our agreements and policies.
• With Your Consent: We may share information for any other purpose with your consent.

Important Note on Encrypted Data: If you enable encryption using your show code, we cannot access or share your encrypted content, even in the circumstances described above, because we do not have the ability to decrypt it without your code.

6. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit using industry-standard protocols, secure storage systems, and access controls.

When you enable end-to-end encryption using your show code, participant submissions are encrypted before transmission to our servers. We store only the encrypted version of this data and cannot decrypt it without your show code. This provides an additional layer of security and ensures that your encrypted data remains private even from us.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and show code.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. Show data and participant submissions are retained as long as the show exists. Directors may delete their shows at any time. Published programs are publicly accessible until removed by the director or an administrator.

If you have enabled encryption, your encrypted data will be deleted according to the same retention policy. Because we cannot decrypt your data without your show code, deletion of encrypted data is permanent and irreversible.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

• Access: You may request access to the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete information.
• Deletion: You may request that we delete your personal information, subject to certain exceptions. Directors may delete their shows directly through the Platform.

9. Cookies

We use cookies strictly for authentication purposes only. Specifically, we use cookies to:

• Keep you signed in to your account across sessions.
• Provide cross-site request forgery (CSRF) protection to secure your account against unauthorized actions.
• Store redirect URLs during OAuth authentication flows when you authenticate using Google.

We do not use cookies for tracking your browsing activities, analytics, advertising, or any other purpose beyond authentication and security. We do not use web beacons, tracking pixels, or similar technologies.

You can control cookies through your browser settings. However, if you block or delete authentication cookies, you will need to sign in each time you visit the Platform.

We do not currently respond to Do Not Track signals because we do not track users.

10. Children's Privacy

The Platform is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe we have collected information from a child under 13, please contact us using the information below.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on the Platform and updating the “Effective Date” at the top of this policy.

Your continued use of the Platform after the effective date of the revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at [email protected].