Privacy Policy
Effective November 2, 2026
SD Active ("we", "us") runs sdactive.org. This policy explains what we collect and why. We keep it minimal.
What we collect
- Browsing events: nothing about you beyond standard server logs (IP address, browser type, pages requested) kept by our hosting provider for security and reliability.
- UCSD sign-in: to join the GroupMe you sign in with your @ucsd.edu Google account. Google confirms the account to us. We receive your UCSD email address and a Google account identifier. We use them only to confirm you hold a UCSD account and to keep you signed in.
- GroupMe: joining happens on GroupMe, a service we do not control. GroupMe's own privacy policy applies to what you share there.
What we don't do
- We do not sell or rent your information.
- We do not run advertising or third-party analytics.
- We do not knowingly collect information from children under 13.
Cookies and sessions
When you sign in, we set two essential cookies that keep you signed in. See our Cookie Policy.
Event photos
We post photos taken at our events. If you are in one and want it taken down, email hello@sdactive.org and we will remove it promptly. Photos are shrunk before upload and their camera data, including any location, is not kept.
Third parties
- Google provides sign-in. The Google script loads only when you click a Join button and need to sign in. See Google's privacy policy.
- Our hosting provider serves the site and processes technical logs.
- UCSD calendars are requested by our server to build the events list. Your browser contacts them only if you click an event link. Event photos load from the calendar's image host.
Your rights and choices
You can sign out at any time, which deletes your session cookies. You can ask what we hold about you, or ask us to delete it, by emailing hello@sdactive.org. California residents have rights under the CCPA/CPRA, including to know, delete and correct personal information and to not be discriminated against for exercising them. We do not sell or share personal information as those terms are defined by California law.
Security and retention
Sessions are signed, stored in HttpOnly cookies, and sent only over HTTPS. Access tokens last 15 minutes and refresh tokens last 30 days. We do not keep a database of your account. No method of transmission is perfectly secure.
Changes
We may update this policy and will change the date above when we do.