DueHub Privacy Policy

Introduction

DueHub is a study-planning application for K-12 and college students, available at https://app.getduehub.com, operated by JDS Educational Services, LLC, a Virginia limited liability company (“JDS,” “DueHub,” “we,” “our,” “us”). This Privacy Policy describes how DueHub accesses, uses, stores, shares, retains, and deletes user data — including data obtained from Google through OAuth, data you create within the app, and data shared between linked student and parent accounts — when you use the application.

If you have questions about this policy or want to exercise your rights regarding your data, contact us at admin@getduehub.com.

Limited Use of Google User Data

DueHub's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• DueHub uses Google user data only to provide and improve user-facing features that you have explicitly enabled by connecting your Google account and using the application.
• DueHub does not use Google user data for advertising.
• DueHub does not sell, rent, or transfer Google user data to third parties for any independent use.
• DueHub does not use Google user data to train generalized or third-party AI/ML models.
• DueHub does not use Google user data for research purposes of any kind, whether internal or external.
• DueHub does not allow humans to read your Google user data, except (a) with your explicit consent (e.g., when you initiate a support request and share specific data with us), (b) when necessary for security purposes such as investigating abuse, or (c) to comply with applicable law.

Data Accessed

Data from your Google account (student accounts only)

When you connect your Google account, DueHub requests the following OAuth scopes:

The specific Google API endpoints DueHub calls are:

• POST https://oauth2.googleapis.com/token — OAuth code exchange and refresh-token exchange.
• GET https://www.googleapis.com/calendar/v3/users/me/calendarList — list your calendars so you can choose which to sync.
• GET https://www.googleapis.com/calendar/v3/calendars/{calendarId}/events — read events from calendars you have selected.
• POST, PATCH, and DELETE on https://www.googleapis.com/calendar/v3/calendars/{calendarId}/events — create, modify, or delete events that DueHub itself has created.

The specific fields DueHub reads are:

• From the OAuth ID token: sub (Google user ID) and email.
• From calendarList.list: id, summary, primary flag, backgroundColor, selected flag, and accessRole.
• From events.list: id, summary (event title), description, location, htmlLink, status, start, and end.

DueHub does not access any other Google scopes or services. DueHub does not request or read Gmail, Drive, Contacts, People API, Photos, YouTube, or Workspace admin APIs.

Data from other services you connect (student accounts only)

If you connect Canvas or StudentVUE, DueHub reads your assignments, courses, grades, and (for StudentVUE) class schedule using credentials you provide. If you subscribe to an iCal feed, DueHub reads the calendar events from that feed URL. These credentials are stored encrypted, using the same protections described in “Data Storage & Protection” below.

Data you create in DueHub

Content you create in DueHub — study sessions, assignments (including any “planned day” you set for scheduling an assignment), courses, schools, bell schedules, feedback messages you submit through the in-app form — is stored under your account. Assignments carry two date fields, a due date and an optional planned day; both are ordinary user content.

Account and identity data

DueHub stores your Clerk-authenticated email address and, for student accounts, your date of birth (used only to enforce the minimum age requirement — see “Children's Privacy” below). Parent accounts provide only an email address; parents do not provide a date of birth. Additional profile fields (school, grade level, preferences) are stored if you enter them.

Family access data

If you use Family access (see “Data Sharing” below):

• Link codes you generate as a student are stored only as a SHA-256 hash. DueHub never retains the plaintext code.
• Link recordsbetween a student and a parent are stored with the student's user ID, the parent's user ID, the scopes the student selected, and timestamps for creation and revocation (including which side revoked, for audit purposes).
• Parents' and students' display names/emails shown across a link are read from Clerk at display time — DueHub does not copy them into its own database.

Data Usage

DueHub is a study planner. We use the data you provide for the following narrowly scoped purposes:

• Identity (Google sub and email): to associate your Google connection with your DueHub account and to display “Connected as <email>” on Settings → Connections. Not used for marketing, analytics, or advertising.
• Calendar list (Google read scope): to populate the calendar picker so you can toggle which Google Calendars to sync.
• Calendar events (Google read scope):rendered on DueHub's calendar grid and Today view alongside your DueHub study sessions. Sync window: 30 days back through 90 days forward.
• Calendar events (Google write scope, opt-in per session): when you toggle “Also add to Google Calendar” on a study session, DueHub creates a corresponding event on your chosen Google Calendar. Subsequent edits or deletions mirror to that event. DueHub never modifies events it did not create.
• Content you create in DueHub (assignments, planned days, study sessions, courses, schools, bell schedules): rendered across the app so you can plan and track your work.
• Data from Canvas, StudentVUE, and iCal feeds: rendered in the Today view, calendar, and course pages so you can see school content alongside DueHub content.
• Push notification tokens (if you enable notifications on iOS): used only to deliver notifications you asked for through Apple Push Notification service.
• Feedback messages you submit(in-app “Send feedback”): read by the developer to respond and to improve the product.

Research and product improvement (opt-in)

If you affirmatively opt in from Settings → Privacy, we may use DueHub-native content in your account — including assignments and their planned days, study sessions, and how you use DueHub's features — for research aimed at understanding study habits and improving DueHub. This research may be conducted internally by DueHub or in collaboration with academic institutions.

Any such research uses only aggregated or fully de-identified data. Outputs shared with collaborators, and any results discussed publicly, will not identify you individually.

The following are always excluded from research use, regardless of your opt-in status:

• Data obtained from Google APIs, including calendar events and identity claims. This exclusion is required by Google's Limited Use Policy and applies without exception.
• Grades data imported from Canvas or StudentVUE. Grades are never used for research.

Data used for research is never sold, transferred to third parties for their independent use, or used to train external AI or machine learning models.

You may withdraw your opt-in at any time from Settings → Privacy. Withdrawal stops any further use of your data for research going forward. Research participation applies only to data collected after you opt in.

Regardless of opt-in status, we do not use your data for advertising, profiling for third-party targeting, or training external AI or machine learning models.

Data Sharing

DueHub does not sell, rent, or share your data with any third party for advertising or any other independent purpose. Data leaves your DueHub account only in the two ways described below: through the infrastructure providers we use to run the service, and through Family access sharing that you, as a student, control.

Infrastructure providers (data processors under our direction)

There are no third-party trackers, advertising networks, data brokers, or analytics vendors loaded by DueHub's frontend or backend.

Family access (student-directed sharing)

DueHub lets students share a read-only view of parts of their DueHub account with a parent. This is the only way that data crosses from one DueHub account to another, and it is always initiated and controlled by the student.

How linking works.A parent creates their own DueHub account (a “parent account”). The student generates an 8-character link code from Settings → Family access; the code is single-use, valid for 15 minutes, and is stored only as a SHA-256 hash. The student sees exactly which scopes will be shared before the code is generated. Nothing is shared until the parent redeems the code. A student may link to more than one parent, and a parent may link to more than one student.

What a parent can see, controlled by the student per-parent, in Settings → Family access:

• Today: to-dos and assignments due soon.
• Grades:the student's grades imported from Canvas or StudentVUE, if the student has connected either.
• Calendar:the student's calendar, class schedule, and Canvas events. Within Calendar, separate opt-ins control whether Google Calendar events and iCal feed events appear in the parent's view.

The student can narrow scopes or revoke a link entirely at any time; changes take effect on the parent's next request. The parent can also unlink themselves.

What a parent can never see, regardless of scope:

• The student's credentials for connected accounts (Canvas, StudentVUE, Google). Parents only learn whether a grades source is connected, not the credentials themselves.
• The student's notification settings.
• The student's data export.
• Account deletion or account settings.
• Anything about any other student the parent may or may not be linked to.

How parent access is enforced.Parent access flows through dedicated read-only endpoints on our servers. There is no path by which a parent can create, modify, or delete anything in the student's account.

Switching account type.If an account type is switched between student and parent, all of that account's existing links are automatically revoked.

Family access and third parties. Family access is student-to-parent sharing entirely inside DueHub. No student data goes to any new third party as a result of Family access.

Data Storage & Protection

Encryption at rest (third-party credentials): access tokens, refresh tokens, and other stored credentials are encrypted using AES-256-GCM with a master key held only in environment variables on the production hosting platform. Each ciphertext has its own random 12-byte initialization vector and a 16-byte authentication tag that is verified on decryption (which fails closed on any tampering). A leaked database row alone cannot be decrypted without the separately held master key.

Encryption in transit: all network traffic uses HTTPS/TLS. DueHub sends a strict transport security header (Strict-Transport-Security: max-age=31536000; includeSubDomains; preload). Additional security headers include X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a restrictive Permissions-Policy disabling geolocation, microphone, camera, payment, USB, magnetometer, accelerometer, and gyroscope APIs.

Tenant isolation: every database row that holds user data carries an explicit user_id column. Database-level composite foreign keys require that child rows reference a parent row owned by the same user, enforcing tenant isolation at the database layer. Family access links between two accounts flow through dedicated read-only endpoints that check both the existence of an active link and the specific scope granted before serving any data.

Application-level access control:every API route validates the user's authenticated session via Clerk before reading any data. Internal-only endpoints use bearer-token authentication with constant-time comparison. During DueHub's closed beta, an allowlist further restricts access at the middleware layer.

Rate limiting: sensitive endpoints are rate-limited. Examples include the allowlist gate (30 requests/minute per user), credential configuration endpoints (10 attempts per 10 minutes), the account deletion endpoint (3 attempts per hour), the Family-access link-redemption endpoint (rate-limited to prevent brute-force redemption of link codes), and the internal sync trigger (5 requests/minute).

Logging hygiene: OAuth token-exchange and refresh requests do not log request or response bodies. Application error logs extract only error message strings rather than raw error objects, to avoid accidental token or response-body leakage.

Pre-beta security review: a structured security review was conducted on 2026-05-01, covering authentication, tenant scoping, token encryption, server-side request forgery defenses, PII in logs, security headers, and rate limiting.

Hosting location and data residency: DueHub uses Neon Postgres (US-East AWS region) for its database and Render (US-East) for its application server. Both providers are US-based, and DueHub stores and processes user data exclusively in the United States. We do not currently transfer user data outside of the United States; if that ever changes, this policy will be updated and existing users will be notified through the application.

Data Retention & Deletion

You can remove your data from DueHub at any time using the self-service actions below:

1. Disconnect Google(Settings → Connections → Disconnect): immediately deletes your Google credentials row (encrypted access and refresh tokens, calendar list metadata, and identity columns) and all of your cached event rows. Clears your write-target calendar setting. Removes the Google event ID linkage from your DueHub study sessions. Before deletion, DueHub makes a best-effort revocation of your refresh token at Google's /revoke endpoint.
2. Disconnect Google with delete-events option: identical to (1), and additionally deletes the events DueHub created from your Google Calendar via the events.deleteAPI. You choose between “delete N events from Google” and “leave events” in a confirmation prompt; the default is to leave events.
3. Revoke or narrow a Family access link(Settings → Family access): a student can narrow the scopes shared with a linked parent, or revoke the link entirely, at any time. Revocation takes effect on the parent's next request. A parent can also unlink themselves from a student.
4. Account deletion (Settings → Account → Delete account, with type-DELETE confirmation): hard-deletes every database row associated with your account — including third-party credentials, cached events, study sessions, assignments (including planned days), courses, preferences, notification settings and history, push notification device tokens, schedule-import records, feedback you submitted, and rate-limit counters — atomically in a single transaction. All Family access link records involving your account (as either student or parent) are also deleted, immediately severing any active links. Your Clerk authentication account is then deleted. An optional toggle deletes DueHub-created events from your Google Calendar before the database wipe. This endpoint is rate-limited to 3 attempts per hour.
5. Data export (Settings → Account → Export my data): downloads a JSON copy of all data DueHub has stored about you. Encrypted credential ciphertext is excluded from the export; push notification device tokens are masked to their last characters.

Automatic retention windows (enforced by a daily cleanup job):

• Soft-deleted user content (assignments, courses, study sessions, schools, bell schedules, school schedules, iCal feeds): hard-deleted 30 days after the row's deleted_at timestamp, so that you can restore content from your in-app Trash within that period.
• Sync log rows: pruned 30 days after creation. These rows record sync timing and outcome only.
• Auth-expired credential rows (Google and other third-party connections): hard-deleted 7 days after the most recent successful sync timestamp on rows where authentication has expired. For Google specifically, your cached events are deleted at the same time.
• Family access link codes: spent or expired link codes (which are stored only as SHA-256 hashes and never as plaintext) are purged by the daily cleanup job, typically within 24 hours. Unredeemed link codes expire after 15 minutes.
• Family access link records: revoked link records are retained as audit rows for the lifetime of the involved accounts, so that a user can see the history of who was linked when. All link records involving an account are hard-deleted when that account is deleted.
• Database point-in-time recovery (PITR): Neon retains backups for up to 7 days for disaster-recovery purposes. Deleted data may be recoverable by Neon-administrative action during this window. There is no application-level interface to restore from PITR.
• Sentry event retention: error events stored in Sentry are retained for 30 days.

How to request deletion: the in-app deletion controls described above are self-service and immediate. You may also email admin@getduehub.com to request deletion; email requests will be honored within a reasonable business window.

Children's Privacy

Age requirement. DueHub is intended for students aged 13 and older. When you create a student account, you provide your date of birth so we can confirm you meet this age requirement. Parent accounts do not require a date of birth because parent accounts have no access to sensitive integrations or age-gated features.

Under-13 users. DueHub does not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have collected personal information from a child under 13 without such consent, we will delete that information. Parents of children under 13 who believe their child has provided personal information to DueHub, or who wish to inquire about a future consent process, may contact us at admin@getduehub.com.

Parental involvement (Family access).DueHub provides a Family access feature that lets students share a read-only view of parts of their DueHub account with a parent. This feature is described in detail in “Data Sharing” above. Family access is initiated by the student, scoped by the student, and revocable by the student at any time.

FERPA note.DueHub is a consumer product used directly by students; it is not provided under contract with a school and does not act as a “school official” under FERPA. When a student imports assignments or grades from Canvas or StudentVUE, the student is authorizing DueHub — as the student — to fetch that data using the student's own credentials. Schools that wish to provide DueHub to students under a formal FERPA arrangement should contact admin@getduehub.com.

State student-data laws.A number of U.S. states have laws governing the handling of student personal information (for example, California's SOPIPA and similar laws in other states). Where applicable, DueHub:

• does not sell student personal information;
• does not use student personal information to serve targeted advertising;
• does not create profiles of students for purposes other than providing DueHub's services; and
• honors deletion requests as described in “Data Retention & Deletion” above.

Research use, if a student has opted in to it, is subject to the constraints described in “Research and product improvement” above, including the exclusion of Google-obtained data and grades data, and the requirement that any external sharing be aggregated or de-identified.

Parents' rights. A parent of a DueHub student may:

• Ask us to review the personal information we have collected from their child, by contacting admin@getduehub.com.
• Ask us to delete their child's account, by contacting admin@getduehub.com.
• Refuse to permit further collection of their child's personal information by asking us to delete the child's account.

For under-13 users specifically, verifiable parental consent would be required before we could collect personal information from the child in the first place; that consent mechanism is not yet implemented, which is why DueHub currently requires an age of 13 or older to create a student account.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date and request your re-acceptance from within the application. The currently published version at https://app.getduehub.com/privacy is authoritative.

Contact

For privacy questions, deletion requests, parental inquiries, or to exercise any of the rights described above:

admin@getduehub.com