Privacy Policy

1. Who this policy covers

The Service is available to the public. It is used by job-seeking candidates (students and other users), instructors or mentors who help candidates, and visitors who browse the site without signing in.

2. Information we collect

Account and profile information. When you create an account (typically by signing in with GitHub), we may collect your name, email address, profile image, and GitHub account identifiers. You may also provide school, major, expected graduation date, LeetCode username, career goals, and similar profile details.

Activity you enter in the Service. This can include job applications and outreach notes, networking contacts and notes, open-source progress and related links or responses, partnership selections, and monthly meeting booking details.

Instructor accounts. Instructors sign in with credentials we issue. Instructors may set a display name, contact email, meeting location details, and weekly availability windows used for student booking.

Google Calendar information (instructors who choose to connect). If an instructor connects Google Calendar, we receive and process Google user data as described in Section 3.

Communications. We may send transactional emails related to the Service (for example, meeting confirmations, calendar invites, inactivity notices, or booking reminders) to the email address associated with your account.

Technical data. Like most websites, we automatically receive standard technical information such as IP address, browser type, device information, and pages visited. We use session cookies and similar technologies needed to keep you signed in and operate the Service. We do not use advertising cookies to track you across other sites.

3. Google user data

Some instructors may connect their Google account so Open Source Resume can sync monthly 1:1 meetings with Google Calendar. This connection is optional and initiated by the instructor.

Google data we access.With the instructor's consent, we request:

• https://www.googleapis.com/auth/calendar.events — to read calendar events on the instructor's primary calendar (so we can show busy times and avoid double-booking), and to create, update, and delete calendar events for Open Source Resume monthly 1:1 meetings.
• https://www.googleapis.com/auth/userinfo.email — to identify the Google account that was connected.

How we use Google user data. We use this data only to provide the instructor-facing calendar connection and student meeting-scheduling features in the Service: checking availability, creating recurring monthly meeting events, moving or canceling those meetings, and displaying connection status (including the connected Google email).

How we store Google user data.We store OAuth access and refresh tokens in encrypted form in our database, along with the connected Google email address and related connection metadata (such as token expiry and granted scopes). Meeting records in our database may include Google Calendar event IDs needed to update or remove those events. We do not download or permanently store the full contents of an instructor's calendar beyond what is needed to operate scheduling in the Service.

Sharing of Google user data. We do not sell Google user data. We do not share Google user data with third parties for advertising, marketing, or data brokerage. Limited technical processing may occur through our infrastructure providers (for example, hosting and database services) solely to operate the Service, under obligations to protect the data.

Google API Services User Data Policy / Limited Use.Open Source Resume's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve user-facing features that are prominent in the Service (calendar sync and meeting scheduling).
• We do not use Google user data for serving advertisements, personalized ads, or credit-worthiness decisions.
• We do not sell Google user data or transfer it except as needed to provide the Service with user consent, for security, to comply with law, or as part of a merger or sale after obtaining required consent.
• We do not use Google user data to train generalized artificial intelligence or machine learning models.
• Human access to Google user data is limited to cases such as user-requested support with consent, security investigations, or legal compliance.

Disconnecting Google. Instructors can disconnect Google Calendar from the instructor dashboard. After disconnect, we stop using that Google account for new calendar operations and remove or invalidate stored Google OAuth tokens associated with the connection. Instructors can also revoke access at Google Account permissions.

4. How we use information (generally)

We use personal information to:

• Provide, maintain, and improve the Service
• Authenticate users and secure accounts
• Track candidate progress, applications, networking, and open-source work
• Schedule and manage monthly meetings between candidates and instructors
• Send service-related emails and notifications
• Respond to support requests and enforce our Terms of Service
• Comply with legal obligations

5. How we share information

We may share information in these situations:

• Within the Service.Instructors and authorized mentors may see candidate progress and meeting information needed to coach users. Meeting details may appear on an instructor's connected Google Calendar.
• Service providers. Vendors that host our application, database, or email delivery may process data on our behalf to run the Service.
• Legal and safety. If required by law, or to protect rights, safety, or the integrity of the Service.
• Business transfers. If we are involved in a merger, acquisition, or asset sale, information may be transferred subject to this policy and applicable consent requirements (including for Google user data).

We do not sell personal information.

6. Data retention

We retain account and activity data for as long as your account remains active or as needed to provide the Service, resolve disputes, and meet legal requirements. Meeting and calendar-related records are kept while needed for scheduling history and operations. Encrypted Google OAuth tokens are retained only while an instructor's Google Calendar remains connected (or briefly thereafter while cleanup completes).

7. Your choices and rights

You may update certain profile information in your account settings. You may request access to, correction of, or deletion of your personal information by emailing usaha@csumb.edu. We will respond within a reasonable time. California residents may have additional rights under the CCPA/CPRA; to exercise them, contact us at the same email. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

8. Security

We use reasonable administrative and technical safeguards, including encrypted storage of Google OAuth tokens and access controls for instructor and user accounts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

10. International users

The Service is operated from the United States. If you access it from another country, your information may be processed in the United States, where laws may differ from those in your jurisdiction.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the effective date. If we change how we use Google user data in a material way, we will provide notice and obtain any consent required before using that data for the new purpose.

12. Contact

Open Source Resume
California, United States
Email: usaha@csumb.edu