Privacy Policy
Updated October 4, 2026
DropThatClass is an independent class and instructor review app operated by Aaryan Dehade. This page describes the current app, not a promise of anonymity or complete security.
Information the app stores
- University email, password hash, selected student or instructor role, generated username, university association, and account/session information.
- Review text, uploaded images, class and instructor details, biographies, reactions, reports, and AI summaries. Reviews, images, class and instructor details, and biographies are publicly readable without an account. Reviews show usernames; text and images can identify you. AI summaries require sign-in.
- Email verification records, abuse-prevention counters, deletion requests, and operational logs. Hosting and service providers may process network addresses and request details.
How information is used
Data supports sign-in, university-scoped reviews, email verification and password resets, uploads, reports, and abuse prevention. We do not currently offer social login or newsletters. A supported university email does not prove current enrollment or instructor identity. Roles are self-selected.
Service providers and AI
The app runs on a privately managed VPS using Coolify. MongoDB stores application data, Cloudflare R2 stores images, and Resend delivers transactional emails. Cloudflare DNS and any enabled proxy process traffic according to their configuration. Provider processing can occur outside your country.
When AI is enabled, OpenRouter and its selected model provider receive bounded review text and class/instructor names for summaries and report classification. Account passwords, emails, and images are not included in those AI prompts. Requests exclude providers marked as collecting data, but we do not promise that all processing or technical logs are absent. AI can produce incorrect results and is not enrollment verification.
Optional cookies and measurement
Essential cookies support authentication and save consent choices. Optional preference cookies remember appearance settings. Optional measurement records daily page-view totals without sending usernames, emails, review content, or URL query strings. Self-hosted Umami at analytics.aaryandehade.com also receives approved page paths and the website ID after the same consent. Browser connections expose network information to that server. Analytics are off until you opt in. Manage choices at any time using Cookie & accessibility settings in the footer or Privacy & accessibility in the app menu. See Cookie Policy.
Retention and your choices
Account and submitted content remain until removed or reviewed through a deletion request. Verification codes expire after 15 minutes; expiration prevents use, and database cleanup may occur later. Abuse counters expire according to their window. Optional daily page-view totals expire after 180 days through database cleanup. Provider logs and backups can have separate retention periods; we do not promise immediate removal from every backup.
You can edit your profile, delete your own reviews, remove your profile image, or delete your account in account settings. Current account deletion alone does not delete all reviews, images, reactions, or biographies. Use Request data deletion for review of those records or to request access/correction. We verify account ownership before acting on requests. Requests are handled manually; legal or security reasons may require retaining some records.
Contact and changes
Contact aaryanadehade@gmail.com. Do not send passwords, API keys, transcripts, or identity documents. We update this page when practices change. Rights and response deadlines depend on applicable law; this page does not certify compliance with every jurisdiction.