Privacy Policy

1. Who We Are

Fourposts is operated by Opus Vita, a Canadian company. We build tools that help tutors, counselors, students, and families navigate the college application process with clarity and confidence.

2. Who Uses Fourposts

Fourposts serves three types of users:

• Tutors and counselors who manage a roster of students and need visibility into each student's application progress.
• Students (typically ages 16–18) who track their college applications, scholarships, and recommendations.
• Parents and guardians who follow their student's progress through a read-only connection.

3. What We Collect

We collect only what is necessary to provide the service:

• Account information — your name, email address, and role (tutor, student, or parent). Authentication is handled by Supabase Auth, our database and identity provider.
• Connections — records of which tutors, students, and parents are linked together, including who initiated the connection and the sharing level.
• Application data — colleges, scholarships, recommendations, and related details that students add to track their progress.
• Error reports — when something goes wrong, we receive anonymous error messages and technical details (such as browser version and page URL) to diagnose and fix bugs. No screen recordings or personal information are included.
• Product analytics — page views and feature usage to understand how people use Fourposts and where we can improve. No session recordings. We do not sell this data.

4. How We Use Your Data

Your data is used solely to provide and improve Fourposts:

• For tutors: displaying your student roster and their application progress.
• For students: tracking your applications, scholarships, and recommendations in one place.
• For parents: showing your student's progress as shared by them.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

5. How Connections Work

Tutors generate invite links and share them with students. When a student accepts, the tutor gains read-only access to that student's application progress. Parents can be invited by students in the same way.

Students always control sharing. A student can revoke any tutor's or parent's access at any time. Tutors and parents see only what their connected students have chosen to share.

6. Where Your Data Is Stored

All user data is stored in Canada (ca-central-1 region) on Supabase infrastructure, in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA).

We use the following service providers:

• Supabase (database and authentication) — Canada (ca-central-1). Stores all user data and handles authentication with encryption at rest (AES-256) and in transit (TLS 1.3). No third-party authentication scripts are loaded.
• Sentry (error tracking) — United States. Receives anonymous error reports only (error messages, stack traces, browser version). No personal information, email addresses, or session recordings are sent to Sentry.
• PostHog (product analytics) — European Union. Receives page views and feature usage events. Session recording is disabled. Person profiles are created only for signed-in users and contain no email addresses.
• Vercel (hosting) — Global edge network. Serves the application. No persistent personal data is stored on Vercel infrastructure.

7. Users Under 18

Fourposts is designed for students who are typically 16–18 years old. We do not knowingly collect personal information from anyone under the age of 16. Tutors and parents using Fourposts are responsible adults who have consented on their own behalf.

If you believe a user under 16 has created an account, please contact us at privacy@opusvita.org and we will promptly delete their data.

8. Your Rights

Under PIPEDA, you have the right to:

• Access your personal information held by Fourposts.
• Correct inaccurate or incomplete information.
• Delete your account and all associated data. When you delete your account, all your data — including profile information, connections, and application data — is permanently removed within 30 days.
• Withdraw consent to a connection at any time. Students can revoke tutor or parent access instantly. Tutors can disconnect from students at any time.

To exercise any of these rights, contact us at privacy@opusvita.org.

9. Data Retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently erased within 30 days. Connection event logs (which record when connections were created, accepted, or revoked) are deleted along with the associated connection.

• Supabase — profiles, connections, and audit events are deleted immediately on account deletion.
• Sentry — anonymous error reports are retained for 90 days, then automatically deleted.
• PostHog — analytics events are retained in the EU per PostHog's data retention policy.

10. Security

We protect your data with industry-standard measures including encryption at rest and in transit, row-level security on all database tables, and strict access controls. Only you (and the connections you approve) can access your data.

11. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify you by email at least 30 days before the changes take effect. Continued use of Fourposts after changes take effect constitutes acceptance of the updated policy.

12. Complaints

If you have concerns about how we handle your personal information, please contact us first at privacy@opusvita.org. If we are unable to resolve your concern, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.