How Your Data is Stored and Used
Last updated:
This document describes how Scholars-success handles account profiles, organization workspaces, and application data.
What we collect and why
We collect your email address, display name, age confirmation (18+), and workspace choice to create and administer your account. When you sign in, an email address and a sign-in record are kept to run your session, and a verification code email is sent from the support mailbox (support@avelynx.net). Verification codes and temporary sign-in challenges are stored solely as unreadable cryptographic hashes and are removed within a day. Your IP address is used solely for rate limiting and abuse prevention, and is kept only as an unreadable cryptographic hash removed within a day. If sign-up is declined due to age confirmation, only an unlinked refusal record and timestamp are stored. For tracked scholarships, we store the title, funder, link URL, amount, deadline date, deadline note, requirements, notes, tracking status, and sharing visibility that you enter by hand.
Who can see it
Workspaces are strictly isolated. A workspace can only be seen and accessed by its designated members and administrators according to their assigned roles. In a personal workspace, all tracked scholarship entries are private to you. In an organization workspace, an entry is private to the member who created it by default, and that member can share it with the organization. Shared entries are visible to all members of that organization workspace. Organization administrators can see shared entries and unshare or remove them, but cannot see another member's private entries.
Where it is kept, and how long
Account profile, workspace membership, and tracked scholarship records are stored in our application database. When you delete a tracked scholarship entry, it is removed from the database immediately (hard delete), leaving only an audit log record of the deletion action in your workspace history. Active session records store a cryptographic hash of your session token, your email, sign-in provider, and timestamps; sessions expire after 24 hours of inactivity or after 14 days maximum, and expired session records are removed within a day.
How to get a copy, correct it, or have it deleted
You may request an export of your stored data, correct your account details, or request account deletion by emailing support@avelynx.net.
Date last updated and change history
Last updated: October 13, 2026. Updated for Phase 3 manual scholarship tracker with personal and organization workspace visibility rules and immediate deletion.