Privacy Policy
VSI Weekly Report helps lab members submit weekly research progress, project results, plans and supporting files for advisor review. This policy describes this reporting portal, not other University of Arizona services.
Information the portal processes
- Google account identifier, verified email address and account name, used to sign in and associate records with your account.
- Your selected student name and the advisor’s confirmation of its connection to your Google account.
- Projects, paper details, drafts, weekly updates, questions, uploaded files and submission timestamps.
- Session records and delivery status used to provide account access and track Google Drive delivery.
How information is used and stored
Information is used to save drafts and submissions, organize weekly work, show previous plans, confirm student identities and support advisor review. Portal records are stored in Cloudflare D1, and attachments in Cloudflare R2. Authorized lab administrators operate this storage. Student accounts can retrieve their own portal records; the application does not publish reports or attachments to the public.
Google sign-in and Google Drive
Student sign-in requests identity information; it does not request access to a student’s Google Drive. The advisor separately authorizes a server connection to the lab’s Drive account. When that connection is configured, the portal creates dated folders, uploads submitted attachments and generated text reports, and reads prior report text to display earlier plans.
The current advisor connection uses the broad Google Drive scope. That permission can technically access the authorizing account’s Drive files. The portal’s implementation uses it to check ownership and permissions of the configured reporting folders and their ancestors, deliver reports to the designated student folders, and retrieve prior reports. It does not make those folders public or grant students Drive sharing permissions. Delivery status is shown separately from portal submission status.
Service providers and data use
Google provides authentication and Drive storage; Cloudflare provides hosting, database and attachment storage. These providers process information to deliver those services and may process technical request data under their own policies. The portal does not sell user data, use it for advertising, or send reports to an AI model for training.
VSI Weekly Report’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Cookies, retention and your choices
The portal uses secure cookies for sign-in and session management. Its application code does not include advertising or analytics trackers. Reports, attachments and drafts remain stored until an administrator removes them; there is currently no automatic retention or deletion schedule.
Contact vsi.core.lab@gmail.com to request access, correction or deletion of your records. Requests require identity confirmation and administrator review, including any applicable research or institutional recordkeeping requirements. Portal records and delivered Drive copies must be considered separately. Revoking Google access or signing out does not itself delete stored reports.
You can review or revoke Google authorization through your Google Account connections. Revoking the advisor’s Drive authorization stops future Drive access until it is reauthorized.
Appropriate content and policy updates
Do not upload patient-identifiable information, passwords, access tokens or other restricted data to this general reporting portal. Changes to this policy will be posted here with an updated effective date. Questions may be sent to vsi.core.lab@gmail.com.