The short version
- Your notes and reflections are private. Not your school, not other students: the database itself stops any other account from seeing them. They aren't encrypted from us, so the person running the database could technically open them, but we don't read them.
- We keep as little as we can: your email, an estimated birth year, a rough area (about 1 km), and what you write in the app.
- Your exact address is never stored on our servers.
- Nothing you write is sent to an AI. The coach is a set of questions written by people.
- We never email anyone for you, and we don't sell, share or advertise with your data.
- You can delete everything, any time, with one button in Settings.
Who is responsible
CAS Finder is a free, non-commercial project run by Tejas Yadav, an IB Diploma student based in Paris, with a small team of IB students. Tejas is responsible for your data (the "data controller" under the GDPR, the EU's data protection law).
For anything about your data, write to hello@casfinder.org.
What we keep, and why
We only keep what the app needs to work for you. The legal basis is providing the service you signed up for, unless the table says otherwise.
| What | Why |
|---|---|
| Your email address | To sign you in with a one-time code. We don't send newsletters or marketing. |
| An estimated birth year, worked out from the age you give | To check you're 15 or over, and to show which places take people your age. Not your birthday. |
| A rough area | A point rounded to about 1 km and the name of your town or arrondissement, to find places near you. |
| Your CAS experiences and plans | So you can plan and track your CAS, including your CAS project. |
| Your notes and reflections | So the coach can quote your notes back to you and build a reflection from your answers. |
| A supervisor's name and email, if you add them | Only to write the confirmation message you send yourself. We never contact them. |
| Names of people on your CAS project, if you add them | To show who you're working with on your project. |
| A ManageBac link, if you add one | So the app can open your experience in ManageBac. |
| Places you save | So you can find them again. |
| When you start and finish a reflection | To show your progress. We also look at anonymous totals, like how long the coach takes on average, to improve the app (legitimate interest). These totals contain no names, emails or text. |
| Your IP address, the robot check and technical logs | To protect accounts and keep the app running (legitimate interest). |
You need an email address and your age to have an account. Everything else is optional, but some features won't work without it.
The only automatic decision in CAS Finder is the age check, which stops under-15s from signing up. Nothing else about you is decided by software alone.
What we never keep
- Your exact address. If you type it, it only goes to the French government's address service, to find your town (see below), and isn't kept. The exact point is kept only on your device, to show distances. Our servers get a point rounded to about 1 km.
- Areas you search on the map. When you tap "Search this area", our servers get the middle of the map, rounded to about 1 km, to find places there. It isn't saved, and your home area doesn't change.
- Your voice. In the phone app (coming later), voice typing turns your voice into text on your phone, then throws the recording away. It's never saved or sent anywhere. The mic on your phone's own keyboard is different: that belongs to Apple or Google, and their privacy terms apply.
- Anything for advertising. There are no ads, no trackers and no analytics tools in CAS Finder or on this website.
Where it's stored
Your account, notes and reflections are stored by Supabase, on servers in the European Union (Ireland). Each student can only read their own data: this is enforced by the database itself, not just by the app.
We don't sell your data, share it with your school or anyone else, or use it for advertising.
Other services involved
A few outside services help the app work. Each only gets what it needs. Apart from Supabase, which stores them, none of these services gets your notes or reflections.
| Service | What it does, and what it receives |
|---|---|
| Cloudflare (USA) | Hosts this website and the web app, and runs the "I'm not a robot" check at sign-in. It receives your IP address and basic browser information, for security. If you add a session reminder, it also makes the calendar file from the experience's title, the day and the time: we don't keep them, and your notes are never part of it. |
| Supabase (servers in Ireland, EU) | Stores your account and everything you write in the app. |
| Brevo (France) | Sends the sign-in code to your email address. |
| Base Adresse Nationale (French government) | Turns the address or place you type into a town or arrondissement when you set your area. When you use your location instead, it only receives a point rounded to about 1 km. We don't keep what you type. |
| OpenFreeMap | Provides the map images. Like any website, it receives your IP address when the map loads, and which part of the map you're looking at. |
| OpenStreetMap's Overpass search (run by volunteers) | Our servers ask it for clubs and places around an area, using only a point rounded to about 5 km. It never receives anything about you. |
| Hugging Face (USA) | In the phone app only (coming later), the first time you use voice typing, the speech model is downloaded from there. Like any download, it sees your IP address; nothing else is sent. |
| Google (Gmail, USA) | Emails you send to hello@casfinder.org are forwarded by Cloudflare to the inbox where we read and answer them. |
Volunteer missions come from API Engagement, the French government's volunteering service. Our servers ask it once a day for missions around the areas students use, using only an area's rounded centre; none of your data is sent to it. When you tap a mission's sign-up link, the link passes through API Engagement, which counts the visit and sends you on to the organisation's page. Like any link, it sees your IP address when you tap it.
Some of these services are run by companies outside the EU: Cloudflare and Google in the US, and Supabase's operator in Singapore and the US (your data itself is stored in Ireland). For Supabase, the safeguard is the European Commission's standard contractual clauses. For Cloudflare, it's the EU–US Data Privacy Framework. Google is only involved if you email us, under the safeguards in Google's own terms. Hugging Face isn't in use yet: it starts with the phone app, and we'll add its safeguard here first. Write to hello@casfinder.org for a copy of these safeguards.
Age
CAS Finder is for students aged 15 and over. We chose 15 because French law lets you consent on your own to the use of your data online from that age. The app asks your age before anything else. If you say you're under 15, it stops there and keeps nothing. We rely on your answer: if we learn an account belongs to someone under 15, we delete it. Parents can write to hello@casfinder.org.
How long we keep it
We keep your data while you use CAS Finder. We plan to delete accounts unused for 2 years, since by then your IB Diploma is over. This automatic deletion isn't running yet; it will be before the first accounts reach 2 years, in autumn 2028. Until then, Delete my data works at any time.
When you tap Delete my data in Settings, your account, notes, reflections, experiences and any supervisor details are deleted straight away. Copies in our database host's short-term safety backups disappear as those backups expire. The services above may keep technical logs (like IP addresses) for a short time for security, as they need to.
Your rights
Under the GDPR you can ask to see the data we have about you, correct it, get a copy of it, limit how it's used, object to how it's used, or delete it. Most of this you can do in the app; for the rest, write to hello@casfinder.org and we'll answer within a month.
After your death: you can tell us what should happen to your data (delete it, keep it, or pass it to someone you name) by writing to hello@casfinder.org. Without instructions, your heirs can ask us to close your account.
If you think we've got something wrong, you can complain to the CNIL, France's data protection authority, at cnil.fr/fr/plaintes.
Changes
If we change this policy, we'll update the date at the top. If a change matters for your data, we'll tell you in the app before it applies.