Privacy policy

Who is responsible

WhiteCoat is provided by [FILL IN: legal entity name, address, company number]. We are the data controller for everything below. You can reach us at privacy@whitecoat.study.

What we collect, and why

Only what is needed to fetch your own study material and make something useful of it. For each kind of data: why we have it, and on what legal basis.

• Your name and email address, through Google Firebase Authentication. So the account is yours. Basis: performance of the contract.
• Your Canvas token, stored encrypted. To fetch your courses, documents, lectures and grades. Basis: performance of the contract, after you paste the token yourself.
• If you use the browser extension: the cookies of your UvA sign-in, stored encrypted. Solely to fetch your recorded lectures, because those live in Panopto and a Canvas token cannot reach them. Basis: your consent, given by pressing the button in the extension.
• Your programme, your year of study and the fields you say you are interested in. To order your study plan and to choose the setting of practice questions. Basis: your consent, given when you fill them in.
• What you do in the app: which topics you open, which practice questions you got right and wrong, how sure you said you were, and which days you used it. Your repetition schedule and your progress run on this. Basis: performance of the contract.
• Your grades and exam results from Canvas and Ans. To show you where you lost marks. Basis: performance of the contract.

What we do not collect

• Your password. Not for WhiteCoat and not for the university: the extension never touches the UvA sign-in page.
• Your browsing history, the content of other websites, your location, your keystrokes.
• Cookies for any site other than the seven UvA services named below.
• We use no advertising trackers, no third-party analytics and no fingerprinting.

The browser extension

The extension does one thing: hand your own UvA sign-in to your own WhiteCoat account, so that we can fetch your recorded lectures.

• It reads cookies only for canvas.uva.nl, login.uva.nl, ans.uva.nl, hva-uva.cloud.panopto.eu, video-kaf.ic.uva.nl, sso.canvaslms.com and the UvA studiegids tool. Nothing else.
• It asks the browser for cookies one host at a time, never for all of them at once. So it never holds a cookie for another site — not briefly, not in memory.
• Nothing is sent until you press “Share my UvA sign-in” yourself. Nothing happens in the background, nothing on install, nothing on visiting a page.
• Before you press it, the extension shows how many cookies were found and which hosts they belong to.
• The extension executes no remotely hosted code. Everything it runs ships in the package.

Limited use

Our use of data received through the extension complies with the Chrome Web Store Limited Use policy and with Mozilla's data practices for add-ons. Specifically:

• We use this data only for the purpose stated above: fetching your material to build your study tools.
• We do not sell it, to anyone, ever.
• We do not transfer it to third parties, other than to the processors listed below who process it on our behalf, or where the law requires it.
• We do not use it for advertising, for creditworthiness, or for any profile beyond your studies.
• No human reads your stored sign-in. It is decrypted only inside an automated job, for the duration of that job. Human inspection happens only if you ask us to look at a fault, if it is necessary for security, or where the law requires it.

Who processes it on our behalf

We outsource as little as possible. This is the complete list.

• DigitalOcean — servers and database, in the Amsterdam (ams3) data centre, the Netherlands.
• Google (Firebase Authentication) — your sign-in and your email address.
• OpenRouter, and the language model it routes to — excerpts of your study material go here, together with the fields of interest you chose, to write summaries and practice questions. This is the only processing that may take place outside the EU. Your name, your email address, your grades and your credentials never go here.
• Meaning-based search runs on our own servers. No third party is involved in it.

How it is secured

• Your Canvas token and your shared sign-in are stored encrypted with AES-256-GCM. The key exists only on our own servers, never in a browser.
• The encryption is bound to your account: a copied encrypted value works on no other account.
• They never go back to a browser. Not even to you: you can see that they are there, when you shared them, which hosts they cover and how many there are — never their contents.
• All traffic travels over HTTPS.
• Your study material can only be read while signed in. None of it is open on the internet.

How long we keep it

• Your account and your progress: for as long as you have an account.
• Your shared UvA sign-in: until you share a new one. A university session expires by itself after a few days and stops working.
• Your Canvas token: until you remove it with us or revoke it in Canvas.
• If you ask us to delete your account, we remove everything attached to you.

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, objection and portability. Where we rely on your consent you may withdraw it at any time — by removing the extension, revoking your Canvas token, or asking us.

• Write to privacy@whitecoat.study and we will deal with it. We reply within one month.
• If you disagree with how we handle it, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Study material and copyright

The material of your courses remains the property of the faculty that makes it. It is not open on the internet and can only be read while signed in with your own account. We summarise it for your own study; we do not publish it and we do not distribute it beyond the students of that course.

If this policy changes

Changes appear on this page with a new date at the top. If anything material changes about what we collect or why, we will ask for your consent again before it takes effect.

Contact

Questions, or a request to see or delete your data: privacy@whitecoat.study