Privacy Policy

PursuitHQ is built and maintained by one college student. There is no company behind it, no staff, and no support desk. Where this page says "we", it means that one person.

This page covers the PursuitHQ website and the API behind it. It does not cover anything else you might link to from inside the app.

To create an account, you give:

• Your first and last name.
• Your email address, which is also how you sign in.
• A password. It is stored only as a PBKDF2 hash, through ASP.NET Identity. The password you typed is never written down anywhere, so nobody - including whoever is running the app - can read it back.
• Your time zone, so that due dates and reminder times mean what you expect.
• The date the account was created.

Everything on your profile beyond that is optional and starts empty: your school, your major, your graduation year, your education level (not set, high school, college, university, or other) and a profile photo. You can leave all of it blank and the app still works.

PursuitHQ is a place to keep your own coursework and career material, so most of what it stores is simply what you put in it.

Coursework

• Courses and class schedules.
• Assignments, including due dates and any grades you record.
• Calendar events and notes.
• Study materials you upload: PDF, Word, PowerPoint, Excel, plain text and images.

Study tools

• Flashcard decks.
• Quizzes, and your attempts at them.
• Study guides.
• Study-chat conversations.
• Study sessions.

Career

• Resumes, including anything you type into them.
• Goals, skills and certifications.
• Job postings you save.

People

• Connection requests, and any note you attach to one.
• Direct messages and group messages.
• Reactions to messages, and any file you attach to a message.
• Group names, descriptions and photos.

Two live signals

Inside a conversation, the app shares how far you have read (read receipts) and whether you are typing right now. Other people in that conversation see both. There is no hidden way to read a message without the sender knowing.

Settings

Your notification preferences, which you can change at any time.

Four features send your content to Google's Gemini API: resume review, flashcard generation, quiz and study-guide generation, and study chat. Your data goes to Google through those features and no other part of the app.

What that means in practice

Less caution is needed than on a free plan, but not none. Your content still travels to another company, and once it has been sent it is out of PursuitHQ's hands - deleting it here does not pull it back.

Treat the AI features the way you would treat any outside service. They are the right place for your own coursework and your own resume. They are not the place for an employer's internal documents, a professor's unpublished material, or anything covered by an agreement you signed.

Skipping the AI features costs you nothing else. Courses, assignments, the calendar, messages and everything in section 3 work without them.

What is never sent

A prompt contains only the data of the student who asked for it. No other student's work, messages, profile or files ever go into your prompt, and yours never go into theirs.

Running a web app means other companies hold your data on the way through. These are all of them:

• Google (Gemini) - the AI features, as described in section 4.
• Resend - sends the email the app sends you: assignment reminders, notifications about messages and connection requests, and password resets. Resend therefore handles your email address and the text of those emails.
• Neon - hosts the PostgreSQL database, which means almost everything in sections 2 and 3 sits on their servers.
• Cloudflare R2 - stores uploaded files: study materials, message attachments and profile photos.
• Vercel - hosts the website.
• Render - hosts the API.

Each has its own privacy terms, and each is used as infrastructure: they store or move your data so the app can work. None of them is handed your data for their own advertising or marketing.

These are worth stating, because they are not what you would expect from most apps:

• There is no advertising anywhere in PursuitHQ.
• Your data is not sold, rented, or shared with anyone for marketing. There is no arrangement of that kind and no plan for one.
• There are no analytics, no tracking pixels, no third-party embeds and no advertising cookies. Nobody is following you around the web on PursuitHQ's behalf.
• There is no cookie banner, because there is nothing to consent to. The only things kept in your browser are the token that keeps you signed in and your choice of light or dark theme.
• Notification emails tell you who messaged you and which group it was in. They never quote the message. The content of what somebody sent you stays inside the app, where it is behind your password.
• Images you upload are re-encoded on the server. That strips EXIF metadata, including the GPS coordinates some phones quietly attach to photos.
• Uploaded files are never put in a public folder. Every download goes through an endpoint that checks who you are first, so knowing a file's address is not enough to open it.

You are not findable until you say so

Being listed in the student directory is off by default. Until you turn on "Let other students find me" in Settings, searching for you turns up nothing. When you do turn it on, a classmate searching sees your name, your school and your year. Your email address is never shown.

Inside a conversation

The people in a conversation with you see your messages, anything you attach, your reactions, how far you have read, and when you are typing. Group members see the group name, description and photo.

Connection requests

A note attached to a connection request is shown to the person you sent it to.

Blocking

You can block another student. Use it; it is there for exactly the reason you think.

Delete your account

Deleting your account removes your rows from the database and the files stored for you: study materials, message attachments and your profile photo. It is permanent, and there is no undo, so take a copy of anything you want to keep first.

One exception, and it is worth being precise about. Messages you have already sent to other people are not removed from their conversations. They stop being connected to you - your name comes off them and they are shown as coming from a deleted account - but the text stays where it is. Deleting them outright would mean reaching into other people’s conversations and taking messages out of the middle, leaving replies answering things that are no longer there. Any files you attached to those messages are deleted along with everything else.

Change things in Settings

• What the app emails you about, or whether it emails you at all.
• Your time zone.
• Whether other students can find you.
• Your password, and two-step verification.

Getting a copy of your data

There is no export feature yet. That is a real gap rather than a position, and it is worth saying plainly instead of burying. Until it exists, email support@pursuit-hq.com and the request will be put together by hand. One person does that by hand, so allow some days for it.

• Passwords are hashed with PBKDF2 through ASP.NET Identity and never stored in plain text.
• You can turn on two-step verification with an authenticator app, in Settings. If you do one thing from this list, do that one.
• Every database query is scoped to the signed-in student, so guessing at an id does not return somebody else's rows. Reading a conversation requires being an active member of it.
• Sign-in and registration are rate limited, which slows down anyone trying passwords in bulk.

The honest part

No system is perfectly secure, and it would be dishonest to write this section as though this one were. PursuitHQ is a student project maintained by one person. There is no security team, no audit and nobody on call at three in the morning.

So: use a password you do not use anywhere else, turn on two-step verification, and do not keep anything here that would seriously hurt you if it got out.

You have to be at least 16 to have a PursuitHQ account. If an account turns out to belong to somebody younger, it will be removed along with the data attached to it.

PursuitHQ is still being built, and what it collects will change as features are added. When that happens, this page is updated in the same breath and the date at the top changes with it. It is worth a look now and then.

Questions about any of this, a request for your data, or something on this page that does not match what you see the app doing: support@pursuit-hq.com. If you have found something that looks like a security problem, please say so in the subject line.