Privacy policy

We collect the minimum we need to run the service. To measure whether our paid ads on Reddit produce signups, we load Reddit's measurement pixel — it sees standard browser metadata (IP address, user agent, page URL) and a “purchase” signal with the amount paid, with no other data attached. Full details and opt-out instructions in §4. No advertising is shown to you on Unfull, no data brokers, no profiling. This page tells you exactly what we hold and how to get rid of it.

1. Who is responsible

Unfull is operated by Aiden Hyun (an individual). Contact: aiden.hyun.business@gmail.com. For any privacy question or request — access, correction, deletion — use that address.

2. What we collect

• Your email address. Provided by you at checkout. Used to deliver alerts and your manage link.
• Course code and term. What you asked us to watch.
• Subscription status. Whether your alert is active, paused, or cancelled.
• Payment reference. An order id returned by Polar (our payment processor). We never see or store your card number, name on card, or billing address — those stay with Polar.
• Notification records. When we sent you an alert and whether delivery succeeded. Used for deduplication and refund claims.
• Standard server logs. Hosting providers (Vercel, Fly.io) keep request logs containing IP addresses and user agents for short periods as part of their normal operation.

We do not collect: your real name, your student ID, your transcript, your grades, your location, or your phone number. We do not run general-purpose analytics. The only third-party measurement we run is the Reddit Pixel for paid-ad attribution — see §4.

3. Why we collect it

• To deliver the alert you paid for.
• To let you manage and cancel your subscription.
• To handle refund claims.
• To investigate abuse and keep the service running.

That is the entire list. There is no marketing, profiling, or AI training use.

4. Who we share it with

We use a small number of service providers (sub-processors) to run Unfull. They only receive what they need to do their job:

• Polar (payments and tax). Receives your email and payment details. Acts as merchant of record.
• Resend (email delivery). Receives your email address and the alert content to deliver.
• Google Cloud / Firestore (database). Stores your subscription record.
• Vercel (web hosting). Serves the unfull.org site and processes requests you make.
• Fly.io (worker hosting). Runs the background process that polls course registries and triggers alerts.
• Reddit(ad measurement — the “Reddit Pixel”). Our pages load Reddit's pixel script (pixel.js). On every page view it reports a generic “page visited” event; on a successful checkout it reports a “purchase” event with the amount paid (CA$1.99 or US$1.49) and the currency.
  
  What we explicitly send: the conversion amount and currency. That's it. No email, no course code, no school, no CRN, no name.
  
  What Reddit's pixel collects from your browser automatically: your IP address, user agent, the page URL, the referrer, and Reddit-issued cookies that let Reddit recognize the same browser across visits. If you are signed into Reddit in the same browser, Reddit may match these signals to your Reddit account for their own ad-personalization purposes. Reddit acts as an independent data controller for this data; their handling of it is governed by Reddit's Privacy Policy.
  
  How to opt out:
  • Use any standard ad-blocker (uBlock Origin, Brave shields, Firefox's built-in tracking protection, etc.) — works without any effect on the alert service.
  • Enable “Global Privacy Control” (GPC) in your browser. Reddit honours GPC as a “do not sell or share” signal.
  • Adjust your Reddit ad-personalization preferences at reddit.com/settings/account.
  • Clear / block third-party cookies in your browser settings.

We do not sell your data. We do not show advertising to you on Unfull. We may disclose data if required by law (e.g., a valid court order), but we will resist requests we believe are overbroad.

For California residents: under CCPA/CPRA, the Reddit Pixel arrangement may be considered “sharing for cross-context behavioral advertising.” You have the right to opt out. The fastest way is to enable Global Privacy Control in your browser (see opt-out list above) — Reddit honours it automatically. You can also email us at aiden.hyun.business@gmail.com and we'll confirm receipt.

5. Where it lives

Unfull is operated from South Korea. The web app is hosted on Vercel (multi-region). The poller runs on Fly.io in Toronto, Canada (yyz region). Firestore data is stored in Google Cloud's northamerica-northeast1 (Montreal) region. Email is delivered via Resend (United States).

By using the service you understand that your information will be transferred between these jurisdictions as needed to operate it.

6. How long we keep it

• Active subscriptions: kept while your subscription is active or paused.
• Cancelled subscriptions: kept for 12 months after cancellation for refund disputes and accounting, then deleted.
• Notification records: kept for 12 months for the same reason.
• Pending (abandoned checkout) records: deleted automatically about 1 hour after creation.

You can ask for earlier deletion at any time (see §8).

7. Security

We use HTTPS everywhere, encrypted-at-rest databases, and a minimum-access model — only the operator has production credentials. Your manage URL contains a randomly generated token; without that token nobody can read or modify your subscriptions through the public app. Don't share that link.

No system is perfectly secure. If we ever experience a breach affecting your data, we will notify you by email without undue delay.

8. Your rights

Email us and we'll act on these within a reasonable time (target: 7 days, hard limit: 30):

• Access. A copy of the data we hold about you.
• Correction.If something is wrong, we'll fix it.
• Deletion.We'll delete your record. Note that payment records held by our payment processor are subject to their retention rules, not ours.
• Withdraw consent. Stop using the service and ask for deletion.
• Opt out of ad measurement.Block the Reddit Pixel via any of the methods listed in §4. This works locally in your browser and doesn't affect the alert service.
• Do Not Sell or Share (California). Enable Global Privacy Control in your browser, or email us. See §4 for details.
• Complain.If we mishandle your data, you can complain to the Office of the Privacy Commissioner of Canada (or, in Quebec, the Commission d'accès à l'information), or the California Privacy Protection Agency.

9. Children

Unfull is intended for university students. We do not knowingly collect data from anyone under 13. If you believe a minor has subscribed, contact us and we will delete the record.

10. Changes

We may update this policy. Material changes will be reflected in the “Last updated” date at the top of this page and, where we have your email, communicated to you.

11. Contact

Privacy questions, deletion requests, or anything else: aiden.hyun.business@gmail.com.