← Back to Facultory

Privacy & Data Collection Policy

Effective July 8, 2026 · Last updated July 8, 2026

Facultory is a workspace for the academic role — research, teaching, service, and the record that ties them together. Because that work involves sensitive information about you and about other people (students, advisees, collaborators), we try to be plain about exactly what we collect, why, who it is shared with, and the control you keep over it.

1. Who we are & what this covers

Facultory (the “Platform” or the “Service”) is operated by Freyja Labs (“Freyja Labs,” “we,” “us,” or “our”). This policy explains how we handle information across the whole Platform: the public site at the root (including each faculty member's public pages and intake forms) and the signed-in faculty suite at /app.

Two kinds of people interact with Facultory, and this policy covers both:

• Account holders — faculty and staff who sign in to use the tools. Access is by invitation and administered by the account owner/administrators for a given deployment.
• Visitors — students, colleagues, and members of the public who use an account holder's public pages (for example, to book office hours, request a letter, apply to a research group, or RSVP to a seminar) without signing in.

For most information an account holder enters about other people, that account holder decides what to collect and why; Freyja Labs stores and processes it on their behalf as part of running the Service.

2. Information we collect

Account & identity information

Sign-in is handled by Cloudflare Zero Trust Access using an identity provider your institution or administrator configures (such as a university SSO or Google account). We do not create or store passwords. From your verified sign-in we receive and store your email address, and your display name where provided. An account can have several linked sign-in emails that resolve to one profile. Each account carries a role (owner, admin, member, or viewer) that governs what tools and data it can reach.

Content you create and import

The heart of Facultory is the content you put into it. Depending on the tools you use, this can include: your research/CV profile, grant pursuits and drafts, full AI ideation transcripts, projects and work products, publications and citation metrics, syllabi and course schedules, rubrics and feedback, lab SOPs, BPC/broader- impacts plans, annual reports, travel and effort records, seminar/event details, and more. This content is private to you by default and shared only when you choose to share, publish, or export it.

Connected accounts & synced data

When you link an external source, we fetch and store data from it on your behalf:

• Scholarly record — your works, citation counts, and author metrics from ORCID, OpenAlex, Crossref, Semantic Scholar, Google Scholar, and DBLP when you provide the relevant identifiers.
• Calendar availability — if you connect a published Outlook/Office 365 calendar feed, we read your busy times to hide conflicting slots on your public pages. The feed URL is stored encrypted.
• Version control — if you connect a GitHub repository, we mirror selected text items and schemas into it (never records about other people — see below).

Credentials & secrets

You may store your own API keys (for example Anthropic or OpenAlex), email-provider credentials (Resend, SendGrid, Mailgun, or Postmark), a GitHub personal access token, and your calendar feed URL. These secrets are envelope-encrypted and stored write-only — the interface lets you set or replace them but never displays them back.

Public form submissions

When a Visitor uses a public page, we collect what that form asks for so the account holder can respond — for example: office-hours bookings (name, email, chosen time); recommendation-letter requests (candidate details and an uploaded resume, extracted to text in your browser); senior-design requests (project pitch and the full team roster); prospective-student applications (level, program, GPA, availability, a resume, and short answers); seminar RSVPs; and course-scheduler feedback or availability surveys. Booking and cancellation emails, including calendar invitations, are sent to the parties involved.

Authenticity signals on certain forms

On the prospective-student application, where short answers must be typed, we collect typing telemetry — such as keystroke counts, elapsed time, and blocked paste attempts — and share it with the faculty reviewer as a signal of authenticity against AI-generated boilerplate. Paste and drag-and-drop are disabled on those fields.

Technical & usage information

Like any web service, we process basic technical data needed to operate securely: IP addresses (used, for example, to rate-limit public forms), request metadata, and approximate timing. We keep an internal, append-only audit log of consequential actions taken in the Service (who did what, and when) for security and accountability. We do not use third-party advertising or cross-site tracking cookies.

3. Information about other people

Several tools are designed to help you manage relationships and records that necessarily involve other people — a Collaborator CRM, an Advisee & Student Progress Tracker, a Letters Manager, prospective-student intake, senior-design rosters, and co-author data derived from your publications. When you enter or import this information:

• You confirm you have a legitimate basis to record it (for example, an advising or professional relationship, or the person's request), and that doing so is consistent with your institution's policies and applicable law.
• Freyja Labs processes it on your behalf to provide the Service. We do not use it for our own purposes.
• The most sensitive records are walled off. Letters, CRM contacts, advisee records, and student submissions are never included in the optional git-sync mirror, and several of these tools have no administrator read path — they are visible only to the account holder who owns them.

4. How we use information

We use the information described above to:

• Provide, maintain, and secure the Platform and its tools;
• Authenticate you and enforce role- and tool-based access controls;
• Run the features you invoke — AI drafting, publication and calendar syncs, deadline reminders, email delivery of invites and confirmations, weekly funding-opportunity ingest, and public-page booking/intake;
• Keep an audit trail and diagnose problems, prevent abuse, and enforce our Terms;
• Communicate with you about the Service (for example, transactional confirmations).

We do not sell personal data, and we do not use your content or the personal data you manage to build advertising profiles.

5. AI features & your data

Facultory's “✨” actions are optional and run only when you invoke them. When you do, the relevant context (for example, the text of a draft, a rubric, or a profile) is sent to an AI model to produce the requested output. You have three ways to run these, and you choose which:

• Platform / your own API key — the request is sent to Anthropic's Claude API. Anthropic states that data submitted through its API is not used to train its models; its handling is governed by Anthropic's terms. If you supply your own key, the usage bills to you.
• Bring your own GenAI — the app copies a self-contained prompt to your clipboard to paste into any assistant (ChatGPT, Claude, Gemini, or Copilot); nothing is sent to an AI provider by us. Your use of that assistant is governed by its own terms.
• Claude Web Bridge — you complete exported tasks on your own claude.ai subscription and paste the answer back.

AI output can be inaccurate and must be reviewed before you rely on it (see the Terms).

6. How information is shared

We share information only in these circumstances:

• Sharing you initiate. You can invite collaborators to a specific grant pursuit (as co-PI, collaborator, or viewer), publish public pages under your handle, export a repository mirror, or send emails to the people a workflow involves. These disclosures happen because you asked for them.
• Service providers (subprocessors). We use the vendors listed below to host and run the Platform. They process data only to provide their service to us.
• Legal & safety. We may disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of users or the public.
• Business transfers. If Freyja Labs is involved in a merger, acquisition, or asset sale, information may transfer as part of that transaction, subject to this policy.

7. Third-party services we rely on

The Platform depends on the following categories of providers. Some are core to running it; others are used only when you enable a feature or connect an account.

Each provider is governed by its own terms and privacy policy. When you supply your own key or connect your own account, that connection and its usage are attributable to you.

8. How long we keep information

We keep your account and content for as long as your account is active or as needed to provide the Service. You can delete most content directly in the app; many tools keep per-version history and a recoverable trash/hidden state, so a “delete” may be reversible for a period before it is permanent. Audit-log entries are retained for security and accountability. When an account is closed, we delete or de-identify its associated personal data within a reasonable period, except where we must retain it to comply with law, resolve disputes, or enforce our agreements. Data mirrored to a repository or calendar you control remains under your control there.

9. How we protect information

• Encrypted secrets. API keys, email-provider credentials, tokens, and calendar feed URLs are envelope-encrypted and stored write-only.
• Authenticated, gated access. The signed-in suite and its APIs sit behind Cloudflare Zero Trust Access and are additionally verified in code (requests without a valid identity fail closed).
• Least-privilege by design. Role- and tool-based permissions, private-by-default content, and per-pursuit sharing limit who can see what; the most sensitive tools have no administrator read path.
• Encryption in transit across the network, and an append-only audit log for accountability.

No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information using safeguards appropriate to its sensitivity.

10. Your choices & rights

You have meaningful control over your information:

• Access & correction. You can view and edit your profile and content directly in the app.
• Export. Many items can be downloaded (for example, generated documents and CV output), and the optional git-sync mirrors much of your text content to a repository you own.
• Deletion. You can delete content in the app, and you can ask us to close your account and delete associated personal data.
• Sharing controls. You decide what to publish or share and can revoke access to shared pursuits or unpublish public pages.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act, the Florida Digital Bill of Rights, or the EU/UK GDPR — including rights to access, correct, delete, or port your personal data, and to object to certain processing. To exercise any of these, contact us at legal@freyjalabs.com. Where an account holder entered information about you into the Service, we may direct your request to that account holder, who controls that data. We will not discriminate against you for exercising your rights.

11. Student & education records (FERPA)

Some tools are used with student information (for example, recommendation letters, prospective-student applications, advisee records, and senior-design rosters). These may constitute education records under the U.S. Family Educational Rights and Privacy Act (FERPA) or similar laws. Facultory provides features intended to keep such records confidential — private ownership, no administrator read path, and exclusion from external mirrors. Account holders and their institutions remain responsible for handling education records in accordance with FERPA and institutional policy.

12. Children

Facultory is intended for use by faculty, university students, and other adults in a higher-education setting. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

13. Where your data is processed

The Platform runs on Cloudflare's global network, and data may be processed in the United States and other countries where our providers operate. By using the Service you understand your information may be processed in the United States. We rely on appropriate safeguards for any cross-border transfers where required.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

15. Contact us

Questions, requests, or concerns about privacy? Contact Freyja Labs at legal@freyjalabs.com. Learn more about us at freyjalabs.com.