The Life At app and its Life at Carolina and Life at NC State campus services form an independent student-built dashboard. This policy explains what the app collects, why, and the choices you have. It describes what the app actually does.
What the app collects
- Your account. Creating an account stores your email and your password as a salted hash; the password itself is never stored or logged. Browsing as a guest stores neither: a guest board runs under a random identifier tied to a cookie in your browser, and when that cookie expires or is cleared there is no way back to it.
- What you put in your workspace. Goals, tasks, calendar events, and the class schedule you choose to import. You provide this, and the app stores it so it persists.
- Chat messages you post in the shared student chat or a friend group, and reports you file in the shared student chat.
- A profile photo you choose to add to your public friend profile.
- Your public friend profile. The app stores the name on your board and assigns a permanent six digit # number. It also stores friend requests, friendships, group membership, and your sharing choices.
- A home or living location, only if you add one. If you enter an address, it is sent to the U.S. Census geocoder to place a pin. A location you mark private is stored with your own account so your map works across your devices and is kept out of vault exports. It reaches a friend or group only while Home sharing is on for that view, and Home starts private. A pin captured from your device cannot be shared.
- Anonymous click counts. The website and the app keep a daily tally of which buttons and tabs get pressed, so we know what to improve. A tally holds the screen and the control's name, never your account, a guest id, your network address, or anything you typed.
- Canvas, only if you install the Life At extension. The extension runs in your own browser while you are signed in to Canvas. It reads your dashboard, your courses, upcoming work and announcements, missing work, and your courses' syllabus files, then sends your classes, due dates, and syllabus deadlines to your board. Your grades stay in your browser. It never opens quiz, exam, or submission pages, and the only change it makes in Canvas is marking an item done when you click it. Choose Unlink this browser in its Account section, or remove the extension, to stop it. Deleting your account removes its link.
What the app does not do
- It does not sell your data.
- It does not put personal data in URLs or query strings.
- It does not log your address or your chat contents to third parties.
- It does not track your device location. Friend map pins come from saved schedules. If nothing shared is scheduled, the map shows no current pin.
- It never asks for your Canvas password or a Canvas access token. Your class schedule comes from a file you export yourself, and Canvas due dates come from a calendar feed link you paste or from the Life At extension, if you install it.
How your data is stored and protected
- Workspace, friend, group, and chat data are stored in the app's database.
- API responses are marked private and are not cached by shared caches.
- Address lookups go only to the fixed U.S. Census endpoint.
- To slow down password guessing, the app counts recent failed sign-ins against a one-way hash of the network address and the email that was tried. The counters cannot be read back as an address or an email, they clear when you sign in, and they are discarded within a day.
- To limit friend search and request abuse across app servers, the app keeps recent request counts under one-way hashes of the account key and network address. Old windows are cleared during later use, and account deletion clears that account's counters.
- After account deletion, the app keeps only an opaque internal account key and a one-way proxy identity link. They contain no email, profile, workspace, messages, or friend data. They stop an old session or delayed request from restoring deleted data. Contact the address below if you later want to start again with the same upstream sign-in.
Third parties
- Map tiles come from OpenStreetMap. Loading the map sends tile requests to OpenStreetMap, subject to their policy. "© OpenStreetMap contributors" is shown.
- Address geocoding uses the U.S. Census Geocoder for addresses you enter.
- Public campus search for organizations, events, research, courses, professors, and careers queries public sources for the campus you selected and links you back to the source. You sign in at the source, not here.
- Anthropic runs the app's AI features, like reading a syllabus. When you use one, the app sends Anthropic what that feature needs: the syllabus file or its text, your question, and the class details it refers to. Nothing goes to Anthropic unless you use an AI feature, and Anthropic does not train its models on what the app sends.
Your choices
- Edit or delete anything in your workspace at any time.
- Choose what friends can see. Class schedules and other plans start shared with friends you add. Home and scheduled places start private. Each has a control: set a main rule, then change it for one friend or group. Turning off all sharing overrides every other setting. On October 26, 2026, Home and scheduled places were switched to private for every account. Anything you had set for one friend or group stayed as it was.
- Delete your account and personal data. The Profile area erases your workspace, friend links, requests, groups, messages, feedback, reports, seat watches, seat alerts, and push tokens. Only the security keys described above remain.
Seat alerts
Seat alerts are for UNC-Chapel Hill classes and need an account. This is everything they keep, why, who handles it, and how long it stays.
- Your watches. The term, course, section, class number, and title you watch, when you made each watch, when it ends, and the latest public seat count for it. I use them to know which sections to check and who to tell.
- Your alerts. Each opening I told you about: the section, the seat count and the time UNC's class search showed it, when the phone alert went out, and when you saw it. They make the history on your seat list and keep you from getting the same alert twice.
- Your email address. Seat alerts do not email you for now, and they keep no copy of your address.
- Your phone's push token, only if you allow notifications. The iPhone app sends the token Apple gives it, the app's build number, and when it was last seen, so Apple can deliver alerts to that phone. The phone keeps a copy of the token too.
- Nothing about you goes to UNC. The checks run on Life at Carolina's servers and ask UNC's public class search about a course or a section, never about a person. UNC does not get your name, email, or watches from me.
Who handles it:
- Cloudflare runs the database and the checks.
- Apple delivers phone alerts through its push service (APNs), which receives your phone's token and the words of the alert.
How long it stays:
- Checks for a Spring 2027 watch end after Jan 12, the last day to add a class. Ended watches stay on your list until you remove them or delete your account.
- Stopping or removing a watch deletes it and any alert from it you have not seen yet. Alerts you have already seen are kept, out of sight, until you delete your account.
- A push token is deleted when you sign out of the iPhone app, turn seat alerts off there, sign in to another account on that phone, when Apple says the token no longer works, or when you delete your account.
- Deleting your account deletes all of it: watches, alerts, and push tokens.
To stop, use STOP on your seat list, or turn off notifications for Life At on your phone or in your browser. To have your seat data deleted without deleting your account, write to support@lifeatcarolina.com.
Children
The app is intended for university students and is not directed to children under 13.
Chat safety
Slurs are blocked and profanity is masked automatically. Messages in the shared campus chat and friend-group chat can be reported, and their authors blocked, on both campuses. Reports are reviewed within 24 hours. If the app becomes aware of child sexual abuse material, it will report it to the National Center for Missing & Exploited Children as required by law.
Changes
Material changes to this policy will be posted here with a new date.
Contact
Questions about this policy, a data request, or something to report: email liam.gergen@gmail.com.