Legal

Privacy Policy

Last updated: July 18, 2026

Your Data, Your Control

EmberGround is built on trust. We only collect what we need to connect you with mentors, events, and opportunities. We never sell your data, and you can delete your account at any time.

What We Collect

Account data: name, email, profile photo, Firebase UID.
Profile data: university, company, job title, skills, tracks, bio, location (country/city).
Event data: registrations, attendance, feedback forms.
Usage data: pages visited, clicks, time on platform (anonymized analytics).
Communications: messages, forum posts, comments, mentor session notes.

How We Use Your Data

Connect you with mentors, peers, and events matching your profile.
Send event reminders, challenge announcements, and newsletters (opt-out anytime).
Improve our platform through aggregated, anonymized analytics.
Prevent fraud, abuse, and spam across the community.
Comply with legal obligations and respond to valid law enforcement requests.

Cookies & Tracking

Essential cookies: authentication, session management, security.
Analytics cookies: Google Analytics and PostHog for platform usage insights.
Preference cookies: language, theme, notification settings.
You can disable non-essential cookies in your browser settings.

Data Sharing & Third Parties

We do not sell your personal data to advertisers or data brokers.
Firebase Auth & Google Cloud handle authentication and storage securely.
Event sponsors may receive anonymized aggregate attendance stats (never individual emails).
University partners receive leaderboard data and anonymized cohort performance.
Legal disclosure: we may share data if required by law or to protect our rights.

Google OAuth & Calendar Integration

When you sign in with Google, we collect your name, email address, and profile photo through Firebase Authentication.
If you schedule or attend office hours as a mentor, we request limited Google Calendar access to create event invites and send them to registered participants.
We cannot see, edit, or delete any events in your personal calendar outside of office hours created through EmberGround.
You can disconnect Google authentication and revoke calendar access at any time from your Account Settings, or directly via your Google Account security page.

Security Measures

All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
Role-based access control limits who can view sensitive profile fields.
Regular security audits and dependency updates via automated CI/CD.
Incident response plan in place. Users are notified of breaches within 72 hours.

Data Retention

Active accounts: data retained indefinitely until you delete your account.
Inactive accounts: soft-deleted after 24 months of no login.
Event data: retained for 3 years for leaderboard and alumni network purposes.
Anonymized analytics: retained indefinitely (no personal identifiers).

Your Rights (GDPR & CCPA)

Access: request a copy of all data we hold about you.

Correction: update inaccurate or incomplete profile information.

Deletion: erase your account and all associated data.

Portability: export your data in a machine-readable format.

Objection: opt out of non-essential communications and analytics.

Restriction: temporarily limit how we process your data.

Privacy Questions?

Contact our Data Protection Officer for access requests, deletion, or any privacy concerns. We respond within 48 hours.

Contact DPO