Privacy Policy

Black & Gold Society is a private, members-only network — it necessarily holds real information about real people so the directory, mentorship matching, and messaging can work at all. This page describes exactly what we collect and what happens to it. We don't sell your data, and we don't share it with anyone for their own advertising or marketing purposes.

Account information: your email address and password. Authentication is handled by our infrastructure provider (Supabase) — we never see or store your password in plain text.

Profile information: whatever you choose to add — name, photo, bio, graduation year, rugby position and history, occupation, company, industry, career interests, social/portfolio links, and an optional résumé upload.

Content you create: posts, messages you send to other members, and mentorship requests or notes.

Basic technical data: standard web request logs (like IP address and browser type) collected automatically by our hosting infrastructure, the same way almost any website works.

Slack connection (optional): if you choose to connect your Slack account from the Slack page, Slack shares your name and Slack user ID with us, along with a limited, read-only permission to look up other workspace members' basic profile info (name and photo only). That combination is what lets the Service open a real Slack conversation between you and another connected member, and what lets a message someone sends directly from Slack itself — not through this app — still show that person's real name and photo here, the same way it already appears inside Slack. We never see or store your Slack password, that permission cannot read the content of any Slack channel or conversation, and connecting does not give us (or anyone else) the ability to post as you anywhere in Slack beyond what you actually send through this app.

We use your information to:

• Operate the directory, mentorship matching, messaging, and opportunities board.
• Review membership applications and enforce our Terms of Service.
• Send you account-relevant emails — approval status, new messages, mentorship activity — never marketing.
• Keep the platform secure and address abuse.
• If you've connected your Slack account, let you message other members through Slack — either the shared community channel or a private conversation with another connected member.

Only approved members can see the directory, and only while signed in — none of it is public on the open internet. You have real controls over your own visibility: you can hide your profile from directory search entirely, and your résumé has its own separate visibility setting (private, open to all members, or by request only). Admins can see more than a typical member — that's necessary for reviewing applications and moderating the community — but it's bound by the same acceptable-use rules as everyone else.

The optional Slack feature works a little differently: messages you send to the shared Community channel are visible to everyone in that Slack channel — the same as any other message in a real Slack workspace, not limited to approved members of this site. A private conversation with another connected member is only visible to the two of you and the relay bot that makes the connection possible.

We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising. The only outside parties who touch your data are the infrastructure providers we use to run the Service itself, strictly as service providers acting on our instructions:

• Supabase — our database, authentication, and file storage provider. Your account and profile data lives in Supabase's infrastructure.
• Resend — our email delivery provider, used only to send the account-relevant emails described above.
• Slack — only if you choose to connect your account. We share your name and Slack user ID with Slack to open conversations on your behalf; this is entirely optional and only happens after you click "Connect Slack."

We may also disclose information if genuinely required to by law, or to protect the safety of our members.

Most of your profile is editable by you at any time from Edit Profile. To request that your account and associated data be deleted, contact an admin — we'll process the request and remove what we reasonably can, aside from anything we're required to retain for legal or security reasons (for example, records needed to investigate a policy violation).

We use access controls at the database level so members can only reach the data they're actually permitted to see, and we keep that under review as the Service changes. No system is perfectly secure, and we can't guarantee against every possible breach — but we treat this as an ongoing responsibility, not a one-time checkbox.

The Service is intended for university students, alumni, and adults connected to the program. It is not directed at children under 13, and we don't knowingly collect information from anyone that young.

If we change what we collect or how we use it in a way that matters, we'll update this page and its "last updated" date, and flag material changes clearly rather than let them slip in quietly.

Questions about this policy or a request about your data can go to an admin via Messages, or the contact link in the site footer if you're not signed in.