Data Policy

Wat2Do is a website that shows students what's happening at their school. Students at the University of Waterloo started it, and we run it from Canada. In this policy, "Wat2Do", "we" and "us" mean the people who run it.

Our founder is the person in charge of protecting personal information (our privacy officer) and is responsible for how Wat2Do handles it. You can reach them at team@wat2do.io.

Our privacy officer approves how we collect and use personal information, answers requests and complaints, keeps a register of privacy incidents and reviews this policy at least once a year.

What we collect depends on how you use Wat2Do. You can browse events, clubs and positions without an account, and an account needs only your email address; everything else you add is up to you. We collect this information from you:

• Your account. Your email address, which you sign in with by a one-time code or link, or through Google. With Google sign-in we keep only your verified email address, not your Google name or photo. We never ask for a password.
• Your profile. Your school, which we take from the school site you sign up on, and anything you add: a photo, your faculty, your interests, whether you're in first year and your language.
• What you do on Wat2Do. Events you save or turn on Notify me for, positions you save, clubs you follow, tickets you get, when a club checks you in and refund requests you send.
• What you send us. Events, positions and clubs you submit, with your email address so we can tell you our decision, posters you ask us to read and events you report.
• If you run a club. The club you manage and your role in it, the email addresses of people you invite, the proof you upload when you claim a club, and your club's payout email if it takes part in club payouts.
• If you promote Wat2Do. Your payout email, when you accepted the promoter terms and the posters you make.
• Messages. What you write in our contact and business nomination forms, which reach our email inboxes, and messages you send to our Instagram accounts.

We collect some information automatically:

• How you use the site. Clicks, event views and shares, linked to your account when you're signed in and otherwise to a random ID that lasts for one browser tab. We also keep the words you search for and the filters you use, without linking them to you.
• Device and network. A scrambled (hashed) form of your IP address, which we use to limit abuse and spot fake clicks and poster scans. We don't store your IP address itself in our database, but the companies that deliver the site see it, and our server logs record it when a request goes over our rate limits. For poster scans we also keep your browser and system type, such as Chrome on iOS.
• Location, only if you allow it. When you scan a Wat2Do poster that has no location yet, your browser may ask to share your location. If you allow it, we save it as the poster's location, not with your scan or your account.

We also collect information from public sources:

• Club posts. We read student clubs' public Instagram posts to list their events and positions. We keep each post's text, images and video, the account that posted it and the usernames tagged in it, and we copy clubs' profile pictures to use as their logos.
• Club contact details. We collect the email addresses clubs publish on their own pages and in school directories, so we can invite them to claim their Wat2Do page.
• Instagram accounts. Our school accounts receive notifications and messages, and we read the lists of accounts that clubs follow to find other clubs. We keep the handles and names of public accounts we might follow.
• Public posts about student apps. We read public posts on X and Reddit about apps like ours to learn what students want, and keep each post, its author's handle and its link.

We use personal information only for these purposes:

• To run your account, sign you in and keep you signed in.
• To show you what's on at your school, and the events you've saved, turned on Notify me for or have tickets for.
• To send the emails you control: the morning email of events, reminders before events you turned on Notify me for and alerts when one of them changes. We also send emails you need, such as sign-in codes, tickets and our decisions on your submissions.
• To issue tickets and let clubs check you in.
• To pay promoters and clubs in our payout programs, and to keep the records the law requires.
• To keep Wat2Do safe: to limit abuse, detect fake accounts, clicks and scans, and look into problems.
• To count visits and see which pages and features people use, with Google Analytics and our own click records, so we can fix and improve them.
• To list club events, invite clubs to claim their pages and answer messages to our Instagram accounts.
• To follow the law and answer lawful requests.

Some of this work uses AI. Claude, a model made by Anthropic, reads public club posts and the messages our Instagram accounts receive, to list events and help decide how to reply. OpenAI's models read the posters you ask us to read. None of this decides anything about you with legal or similarly significant effects.

We don't use your personal information to train AI models.

We don't sell or rent personal information, and we don't use it for advertising.

We send two kinds of email. Emails you need, such as sign-in codes, tickets, decisions on your submissions and replies to you, always arrive. Notification emails about events (the morning email, reminders and change alerts) are on when you sign up, and you can turn each one off in Settings or with the unsubscribe link in it. We stop within 10 business days, and usually right away.

We also keep a short copy of these emails, and of emails about your tickets, submissions and club invitations, in your notifications on Wat2Do (behind the bell icon), and delete each copy after 90 days.

We also email clubs at the addresses they publish, about their own Wat2Do page. A club can ask us to stop at any time.

Some of what you do on Wat2Do is visible to others:

• Nobody else sees which events you turn on Notify me for. An event shows only how many people did.
• When you hold a ticket, the club running the event sees your name (or the start of your email address), your email address, your ticket code, when you were checked in and any refund request.
• People who manage the same club see each other's names, email addresses and photos.
• Events, positions and clubs we publish from your submissions are public, but your email address isn't.

We share personal information with companies that run parts of Wat2Do for us, and only what each one needs for that work:

• Amazon Web Services: hosts the website and sends our emails, from Canada.
• Cloudflare: delivers the site and stores images and videos, in North America.
• Google: Google sign-in, Google Analytics and the maps on event pages.
• Anthropic and OpenAI: read posts, posters and messages, as described above.
• Stripe: takes payment when a club sells tickets. Stripe receives the buyer's email address and card details and also uses them under its own privacy policy; we never see or store card numbers.
• GitHub: processes the notifications our school Instagram accounts receive.
• Meta: runs Instagram, where we post to our school accounts.
• OpenStreetMap services: provide map images and find event addresses on the map.
• Our bank: sends Interac e-Transfer payouts.

We may also share personal information when the law requires it, to protect someone's safety, rights or property, or as part of a merger or sale of Wat2Do, in which case this policy keeps applying to it.

We use these cookies and browser storage:

• Sign-in cookies: keep you signed in for up to 30 days and let pages know you're signed in. Google sign-in adds one that lasts 10 minutes.
• Theme cookie: remembers light or dark mode for a year.
• Poster visitor cookie: a random ID, kept for two years, that lets us count unique poster scans without knowing who you are.
• Browser storage: keeps your language, a copy of your profile so pages load faster, and details for one browser tab, such as your filters.
• Google Analytics: sets its own cookies to measure how many people visit and which pages they use. We remove codes, links and email addresses from the page addresses we send it.

You can block or delete cookies in your browser settings, though you need the sign-in cookies to stay signed in. To opt out of Google Analytics on every site, use Google's opt-out browser add-on or block its cookies.

Our pages load maps from Google and OpenFreeMap, and Google Analytics measures visits, so those companies receive your IP address and browser details under their own privacy policies. We don't use advertising networks, and Wat2Do doesn't change what it collects in response to Do Not Track or Global Privacy Control signals.

Our database runs on our own server in Canada. Our website and email services run on Amazon Web Services in Canada, and Cloudflare stores images and videos in North America. Some of the companies we work with, such as Google, Anthropic, OpenAI, Stripe, GitHub and Meta, process information in the United States or elsewhere.

Information processed outside Canada is subject to that country's laws, and its courts, police and security agencies may be able to access it. We choose providers that protect personal information, and we send each one only what it needs.

If you're in Quebec, your personal information may be communicated outside Quebec, as described above. To learn which providers outside Canada handle your information and why, email team@wat2do.io.

We keep personal information only as long as we need it for the purposes above, or as long as the law requires:

• Your account and profile: until you ask us to delete your account, which we do within 30 days.
• Sign-in codes and sessions: codes expire after 15 minutes, and a session ends 30 days after you last use it.
• Notify me, saved events and positions, follows and tickets: until you remove them or delete your account.
• Clicks, searches and poster scans: we keep them without your name, and when you delete your account we unlink your clicks from it.
• Email records: while your account exists, we keep a record of which emails we sent you, without their content.
• Payout records: six years after the payout, as Canadian tax law requires.
• Club contact details: with our notes on whether we contacted the club. If a club asks, we stop contacting it and delete its contact details.
• Messages: as long as we need them to answer you and keep a record of the conversation.
• Logs: our website's logs are deleted after 14 days. Our server's own logs can hold IP addresses or email addresses, and we keep them only as long as we need them to run and fix Wat2Do.

We protect personal information with safeguards that fit how sensitive it is: encrypted connections, sign-in without passwords, hashed sign-in codes, session tokens and IP addresses, database rules that keep each person's records private, and access limited to the people who need it.

No system is perfectly secure. If a breach of our safeguards involving your personal information creates a real risk of significant harm to you, we'll tell you and the Office of the Privacy Commissioner of Canada, as the law requires.

On your own, you can:

• Turn off the morning email, reminders and change alerts in Settings, or with the unsubscribe link in any of them. Sign-in codes and tickets still arrive, because you need them.
• Change your photo, school, faculty, interests and language in Settings.
• Turn off Notify me, remove saved events and unfollow clubs whenever you like.
• Block Google Analytics cookies in your browser.

You can also ask us to:

• Tell you what personal information we hold about you, how we use it and who we've shared it with.
• Give you a copy of the information you gave us, in a common format a computer can read.
• Correct information that is wrong or incomplete.
• Delete your account and your personal information.
• Stop using your information for a purpose you agreed to, unless the law requires us to keep it.
• Stop showing your information publicly, or have it de-indexed, where the law gives you that right.

Email team@wat2do.io from the address on your account. It's free, and we reply within 30 days. We may need to confirm it's you, and we may keep some information the law requires us to keep, such as payout records.

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. In Quebec you can also go to the Commission d'accès à l'information, and in Alberta or British Columbia to that province's Information and Privacy Commissioner.

Some information we hold is about people who don't use Wat2Do: usernames tagged in a club's public post, messages sent to our Instagram accounts and club email addresses published online.

When you message one of our Instagram accounts, we read your message and any post you share in order to answer it, and AI helps decide how. We keep a short record of each conversation (the account name and the latest message) so we know which ones we've answered, and a club's words when it asks us to fix one of its listings. We never write message text into our logs.

You have the same rights as anyone else: you can ask what we hold about you and ask us to remove it. A club can also ask us to leave it out of our Instagram posts, or to stop contacting it.

Wat2Do is for university and college students. It isn't meant for children under 13, and we don't knowingly collect their information. In Quebec, anyone under 14 needs a parent's or guardian's consent before giving us personal information. If you think a child has given us personal information without the consent they need, email us and we'll delete it.

We post every change on this page with a new effective date, and we keep past versions, which we'll send you if you ask. Before a significant change applies, such as a new use of your information, we'll tell you by email or on Wat2Do and ask for your consent where the law requires it. We won't use information we already hold in a new way without the consent the law requires.

Send questions, requests and complaints about privacy to team@wat2do.io.