CAPHALegal
Privacy Policy
Last updated October 2026.
What we collect
Booking form (/book): your name, email address, university or school, and an optional note to your advisor.
Contact form: your name, email address and message. These are emailed to CAPHA's inbox; we don't store them in our database.
Visit counting: when you view a page, we record which page it was and an anonymous ID that changes every day. The ID is a one-way scramble of your IP address, browser and the date, so we can count how many different people visited without storing your IP or following you from one day to the next. We use no advertising or tracking cookies.
IP address: used briefly to stop abuse (form spam, page-view floods, repeated sign-in attempts). Those anti-abuse records hold only a scrambled form of it and are deleted within about a day. Cloudflare Turnstile also sees your IP when it checks that you're human.
CAPHA team members
If you're on the CAPHA team, we store your name, email, username, role and, if you have one, your public card on this site (photo, school, short bio). Team chat messages and your Daily Word results are visible to other team members. Advisors who take bookings see their own booking requests (student name, university, time and note).
Sign-in attempts are logged with the email, IP address and time, for security, and kept for 90 days. Actions admins take on accounts and site content are logged too. Signing in sets cookies that keep you signed in; we use no other cookies.
New team members get a sign-in email with a temporary password. It works for 7 days and stops working as soon as they choose their own.
Why we collect it
To schedule mentorship sessions, answer messages sent through the contact form, keep the site and team accounts secure, and see roughly how many people the site reaches. We do not use it for marketing, newsletters, or anything beyond that.
Who it's shared with
A booking request goes to the advisor you picked and to the CAPHA team members who coordinate sessions, so they can prepare for and confirm it. We do not sell your information or share it with anyone outside CAPHA, except the service providers below that run the site for us.
Third parties involved
- Supabase — our database and sign-in provider.
- Netlify — hosts the website and sees standard web request data.
- Cloudflare Turnstile — checks that form submissions and sign-ins come from a person, not a bot; sees your IP address while it checks.
- Google / Gmail — sends all CAPHA emails (booking confirmations, contact-form messages, team sign-in and password emails).
How long we keep it
Bookings are deleted 12 months after the session date. Sign-in logs are deleted after 90 days. Page-visit records are deleted after 13 months. Anti-abuse records are deleted within about a day. Team chat stays until it's deleted or the account is removed. Ask us any time and we'll delete your information sooner.
Questions or deletion requests
Email us at capha0925@gmail.com with any questions about this policy, or to request that we delete your information.