Data & security
What the Aceversity API and connectors can access, how credentials are protected, what is logged, and how members stay in control.
What a connected app can see
Only the member's own study data, and only with the scopes they approved:
Readable (read) |
Changeable (write) |
|---|---|
| Name, email, time zone, streak, membership status | — |
| Courses, including syllabus text | Courses (create, edit, delete) |
| Exams, quizzes, assignments and their dates | Same |
| Study-plan milestones | Same |
| Grade categories, scores, current grade | Same |
| Practice accuracy by topic | — |
| Flashcard decks and terms | Create and delete decks |
Never accessible through the API: passwords, payment and billing details, uploaded files, study-group posts, other students' data, instructor or admin features.
How credentials are protected
- Keys, codes and tokens are random 192–256-bit secrets; only their SHA-256 hashes are stored.
- Access tokens expire after 1 hour; refresh tokens after 60 days and are rotated on every use.
- PKCE (S256) is mandatory; authorization codes are single-use and expire in 10 minutes.
- Consent pages can't be framed (clickjacking protection) and only accept same-origin form posts bound to the signed-in member.
- All traffic is HTTPS with HSTS.
- Every query is scoped to the credential's member; requests for anyone else's objects return
404.
What we log
Per request: request id, operation, HTTP status, duration and credential type. Not request or response bodies. Logs are kept by our hosting provider for its standard retention period. Last-used times are kept on keys and tokens so members can spot unused ones.
Member controls
- https://api.aceversity.com/keys lists every API key and connected app with last-used dates.
- Revoke a key or Disconnect an app — effective immediately.
- Deleting the Aceversity account deletes all keys, tokens and data.
For privacy policies and directory forms
Suggested addition to the Aceversity privacy policy:
Connected apps and the API. If you connect Aceversity to another service (for example Claude, ChatGPT or an automation tool) or create an API key, that service can read — and, if you allow it, change — your courses, deadlines, study plan, grades, practice statistics and flashcards, as you approved on the consent screen. It cannot see your password or payment details. The other service's own privacy policy governs what it does with that data. You can disconnect apps and revoke keys at any time at api.aceversity.com/keys.
Reporting a vulnerability
Email security@aceversity.com with steps to reproduce. Please don't access other people's data or degrade the service while testing.