Privacy Policy

Black & Gold Society (the "Service") has two parts. The first is a public club website (the home page, Games, Teams, News, Give and FAQ pages) that anyone can read and search engines can index. The second is a members-only network (the directory, profiles, feed, mentorship, opportunities and messages) that only approved members can see while signed in.

This page describes what we collect in both parts, who can see it, and what happens to it. We don't sell your personal information, we don't show advertising, and we don't share your information with anyone for their own marketing.

Account information: your email address and password. Sign-in is handled by our infrastructure provider, Supabase; we never see or store your password in plain text. If your account was created with Google sign-in, Google shared your name and email address with us to start your profile, and that account has no separate password with us. We also record when you agreed to these policies and which version you agreed to.

Profile information: whatever you choose to add. That can include your name, nickname, pronouns, photo, role, school, major, graduation year, city, rugby position, years played and rugby story, occupation, company, industry, bio, phone number, a public contact email, LinkedIn, Instagram, website and portfolio links, what you're offering, available for or looking for, mentorship preferences and notes, skills and interests, and a resume.

Content you create: feed posts and the images attached to them, comments, likes, saved posts and listings, opportunity listings and comments on them, direct messages with their reactions and file attachments, mentorship requests, notes and feedback, resume access requests, and any report you make about another member.

Activity we record: when you were last active on the site (updated about once a minute while it is open), whether you're online right now, and a log of your notifications. A message notification stores a short preview of the message (its first 140 characters).

Technical information: standard request logs (such as IP address, browser type and the pages requested) kept by our hosting and database providers, the way almost any website works.

Slack (optional): if you connect your Slack account from the Slack page, we store your Slack user ID, your Slack display name, the date you connected, and an access token from Slack, until you disconnect. That token's permission is set by the club's Slack configuration. It is used to look up the names and photos of people posting in the club's Slack channel so they can be shown here, and yours may be the token used for those lookups when any member views the channel. It is not used to read your Slack conversations. We never see your Slack password.

Information about people who aren't members: the public Teams page lists each squad's players (first and last name, class year, position and, if one has been added, a headshot), and News and Give pages can include names, photos and quotes. Club admins enter this information, and the people in it may not have accounts here. The Slack page also shows the names and photos of people posting in the club's Slack channel, who may not be members either.

We use your information to:

• Run the directory, profiles, feed, mentorship, opportunities board and messaging.
• Review membership applications, moderate the community and enforce our Terms of Service.
• Match new job and housing listings to members automatically. When someone posts one, the Service compares it with each member's industry, career interests, skills and goals, and tells members whose profiles fit.
• Let you post to the club's Slack channel, and, if you've connected Slack, message other connected members through it.
• Keep the Service secure and deal with abuse.
• Send you notifications and email, as described below.

Email. The Service can email you about: new direct messages (about 30 minutes after they arrive, unless you've already opened the notification); mentorship requests, offers and replies; comments on your posts and listings; job and housing listings that match your profile; announcements from club admins, such as events, reunions or fundraising; reminders to finish setting up your profile; your membership being approved; and a password change. Sign-up confirmation and password-reset emails are sent when you ask for them. Emails can include the other person's name and an excerpt of the message or comment they're about.

Most of these are on by default. You can turn email, in-app notices or both on or off for each category (messages, mentorship, jobs, housing, feed, announcements and security) at Notification preferences, which every email links to. Sign-up confirmation, password-reset links, your approval notice and profile reminders can't currently be turned off there.

The public website. Anyone, signed in or not, and search engines can see the home page, Games, Teams, News, Give and FAQ pages, including the rosters, news and photos described in section 2. The Give page shows donation totals and donor counts, never donor names.

Other members. Only approved members who are signed in can reach the members-only network. They can see your full profile, including your phone number and public contact email if you've added them; your posts, comments, likes and opportunity listings; whether you're online; and when you were last active. We don't display the email address you sign in with on your profile or in the directory.

Hiding from the directory. You can hide your profile from directory search and browsing and from suggestions to other members. Your profile can still be opened by a member who has a direct link to it. Your name and photo still appear on things you post, and if you offer or are looking for mentorship you still appear in the mentorship lists for other members.

Your resume has two settings: "By request only" (the default), where a member can open it after you approve their request, or "Anyone in the network". Admins can always open it.

Photos. Your profile photo and any images you attach to feed posts are stored at web addresses that don't require signing in, so anyone who gets hold of one of those links can open the image. Resumes and message attachments are stored privately and are only opened through short-lived links.

Messages and mentorship. Direct messages and their attachments can only be read by the people in the conversation. Mentorship requests and records are visible to the mentor, the mentee and admins. Feedback a mentee leaves is visible to the mentor it's about and to admins.

Admins can see more than members, which they need to review applications and moderate: every profile, every resume, reports, mentorship feedback, and the notification records described in section 2, including their short message previews. Admins can't open your conversations in the app, but they do have access to those previews. They're bound by the same rules as everyone else.

Slack. Anything posted to the club's Slack channel from the Slack page, which any approved member can do without connecting Slack, is posted by our bot with your name. It is stored in that Slack workspace and visible to everyone in the channel, who may not be members of this site. A private Slack conversation with another connected member is visible to the two of you and to the relay bot that makes the connection.

We share information only with the services we use to run the Service, acting on our instructions, and with services you choose to use through it:

• Supabase: our database, sign-in and file storage, and the sender of sign-up confirmation and password-reset emails. Your account, profile and content are stored with Supabase.
• Vercel: hosts the website and keeps standard request logs.
• Resend: delivers our notification emails. It receives your email address and the content of each email, including names and message or comment excerpts.
• Google Fonts: supplies the site's typefaces. Your browser fetches them from Google on every page, which shares your IP address and browser details with Google. Some email apps do the same when they load our emails.
• YouTube: the public home page shows the club's YouTube videos. Video thumbnails load from YouTube's servers, and playing a video uses YouTube's privacy-enhanced player.
• Slack: receives whatever you post to the club's Slack channel, your name with it, and, if you connect your account, what's needed to open conversations on your behalf.
• Google: only for accounts that sign in with Google. Google knows you used your Google account to sign in here.

Donations made from the Give page go through UC Santa Cruz's own giving site. We don't receive your payment details, and UC Santa Cruz's privacy policy covers your donation. Links to other outside sites (LinkedIn, maps, live streams, application links on listings) share nothing with them unless you follow the link.

We may also disclose information if the law genuinely requires it, or to protect the safety of our members.

We use one essential cookie, set by Supabase, to keep you signed in; it can last up to about 400 days unless you sign out. A short-lived cookie is also used during sign-up, sign-in links and password resets. The site saves a few preferences in your browser: night mode, your last few feed searches, which opportunities you marked as applied, and your mentorship view. These stay on that device after you sign out, until you clear your browser's site data. We don't use analytics or advertising cookies.

You can edit most of your profile at any time from Edit Profile, hide yourself from the directory, change your notification settings, and disconnect Slack from the Slack page. Disconnecting deletes your Slack token from our database; to revoke it in Slack as well, remove the app in your Slack settings.

How long we keep things. We keep your information for as long as your account exists; there is no automatic expiry. Declined mentorship requests are cleared after about a week, and ending a mentorship deletes it and its feedback. If an application is declined or a member is banned, we keep the account so the decision can be enforced, unless you ask us to delete it.

Deleting your account. There's no self-serve delete button yet, so ask an admin (see section 11). Deleting an account permanently removes your profile, your posts, comments, likes, saves, listings, mentorships and alumni story, the replies other members left on your posts and listings, any reports involving you, your Slack connection, and the messages you sent, including from the other person's view of the conversation. We also delete your sign-in account and the files you've uploaded (your photo, resume, post images and attachments).

What can remain. Copies of your messages inside notifications already delivered to other people, emails that were already sent, anything posted to Slack (which stays in that Slack workspace), and anything we're required to keep by law. Note also that replacing or removing a photo or resume, or deleting a post or message, doesn't delete the underlying file; ask an admin if you want a file removed.

We use access rules in the database so that, as far as possible, people can only reach what they're meant to, and we keep resumes and message attachments in private storage. No system is perfectly secure, and we can't guarantee against every breach, but we treat security as an ongoing job and fix problems as we find them.

The Service is for university students, alumni and adults connected to the program. It isn't directed at children under 13, and we don't knowingly collect information from anyone that young.

When we change what we collect or how we use it, we update this page and its "last updated" date. For significant changes we also tell members with an announcement, so they don't slip in quietly.

Questions about this policy, or a request about your data (including deleting your account, or changing or removing your details from a public roster or page), can go to an admin via Messages, or through the contact link in the site footer if you're not a member.