Privacy
Last updated 1 Oct 2026
What we collect
We collect the minimum needed to run the platform: what it takes to create an account, what you write yourself, and what is needed to keep the service usable against abuse.
- When you create an account: your email address and the display name you choose. We ask for no university email, no phone number, no student ID and no document proving enrolment.
- Your password: stored only as a derived digest. The password itself is never written anywhere in the platform.
- Your reviews: the text and ratings you publish, the semester, and whether you later edited the review.
- Votes: we record that you found a review helpful so the same vote cannot be counted twice. That connection is never shown publicly.
- Reports: the reason and any details you send when reporting a review.
- Rate limits: to make bulk automated submission impractical we keep a counter derived from your account id, or from a network address for anonymous requests. The identity is never stored in its raw form, only as a hash keyed with a server-side secret, so the counters cannot be used to build a visitor log.
What is shown publicly
Your display name, and only your display name, appears next to your reviews. Your email address is never shown to a visitor or to another student, and cannot be searched for.
On your own account page you see your address in masked form (for example a***z@example.com), so you can confirm which account you are signed into. That view is yours alone.
Your review text and rating are public, and any visitor can read them and search engines can index them. Write with that in mind.
We publish no list of who found a review helpful, no reporter identities, and nothing about your activity beyond what is described here.
How your account is protected
Passwords are hashed with scrypt, a memory-hard key-derivation function, using a separate random salt for each password; only the digest is stored. The derivation parameters are stored alongside the digest, so they can be raised later without invalidating existing passwords.
Password checks are a constant-time comparison, so the response reveals nothing about how close a wrong password was, and a wrong password is indistinguishable from a missing account.
Sessions: signing in creates a random token that is stored in the database only as a hash, so a leaked database does not contain anything that can be used to sign in. Changing your password revokes every existing session, and signing out revokes the current one.
Where the data is held
In a local deployment the data is held in a file on the machine running the site. In a hosted deployment it may be held in a managed PostgreSQL database alongside a managed authentication service.
Either way, we do not sell your data, do not share it with advertisers, do not use it for advertising, and do not disclose it to anyone else unless the law requires it.
How long it is kept
Account data and reviews are kept for as long as the account exists, or until you ask for deletion.
Deleting an account removes your email address, your password and your sessions, and detaches your identity from your reviews so they are no longer attributed to you. The review text itself stays published without your name: deleting it would erase an experience other students have drawn on, and its text was never tied to your real name in the first place.
Expired and revoked sessions, spent reset tokens, and old rate-limit records are cleaned up periodically.
Your rights
Most of your data you can manage yourself from your account page; for anything without a tool in the interface, write to us.
- Change your display name at any time.
- Edit or withdraw your reviews from your account page, or ask us to if that fails.
- Request a copy of your data, a correction, or complete deletion.
- Request removal of a review that is about you personally, as opposed to a review whose rating you dislike.
- Change your password immediately if you think someone else knows it, and tell us so we can look into it.
Who this notice covers
The platform is intended for students in Libyan higher education and for those advising them. If you are below the age at which the law allows you to enter into an agreement of use, use the platform only with the consent and supervision of a parent or guardian, who should be the one to contact us about data requests in that case.
Changes and contact
This notice is updated whenever what we collect, or the way we use it, changes; the date at the top of the page shows the last revision, and any substantive change is announced on the site.
For any question about this notice, or for a request about your data, write to the address below:
Email us
hello@example.com