Agora privacy policy

Effective: November 13, 2026

This page says in plain words what Agora keeps about you, where it is kept, who can see it, and for how long. It describes the service as it runs on the effective date above; where something is planned and not built, it says so.

1. Who runs Agora

Agora is developed and operated by Daedalus Data Labs, LLC, a California limited liability company. In this policy, "Agora" means the service and that company. Access to Agora's systems is limited to the people who need it to run the service. You can write to Agora about anything in this policy at hello@agoraoncampus.com, which is the same address shown in the footer of the site.

2. What an account is, and what is collected when you sign up

An Agora account belongs to one campus, and what places it there is an email address on that campus's domain and a six-digit code sent to that address, which is good for fifteen minutes. Only the part of your address after the @ is looked up, against a list of university domains; addresses at consumer webmail and disposable providers are refused. Addresses under a listed domain, such as a department's own subdomain, are treated as that campus's.

At signup Agora records your email address, the name you give, your username, and your password, which is stored only in a scrambled form that cannot be read back, and not as the password itself. It also records when you ticked the box agreeing to the terms and the community guidelines, at signup or, if your account is older than the terms, when you agreed to them afterwards. Your affiliation (student, faculty, staff or alumni) is what you chose at onboarding, or alumni once you say you have graduated, and is shown with where that choice came from: your word alone, or your word agreeing with your address's default; a faculty or staff choice nothing backs is not shown on your profile at all, and nothing is shown as confirmed by any university. If you add a personal backup email address in your account settings, Agora keeps it once you prove it with a code mailed to it, and uses it for one thing: a password-reset link, sent there when you ask with that address or when mail to your university address has bounced. It is not shown to other members, and removing it in settings removes it.

3. What you may add

You may add profile fields (a bio, major, class year, pronouns, hometown, interests, a photo and a cover picture), posts with up to ten pictures and their alt text, comments, reactions, messages (with up to four pictures a message where pictures are kept in the private store described in section 5, a quote of an earlier message you are answering, and reactions to messages, all seen only by the people in the conversation, and by moderators if that message is reported), a name for a group conversation, groups and student organization pages, events, and reports about content you think should not be there. Agora also keeps the connections and choices you make: friend requests and friendships, who you follow, blocks, bookmarks, the people you @mention, your answers to events and their reminders, the courses you say you take, officer seats in organizations, invitations you send and answer, appeals you write, and, for a campus admin, requests to add an email domain. If you turn on two-factor sign-in, Agora also keeps your authenticator's secret, encrypted, and your ten recovery codes, as hashes.

4. What is recorded without asking

For each session you open, Agora records the browser's user agent string, the IP address the request arrived from, and when the session was last used; you can see these on your account page and end any session from there. Agora's mail provider reports what became of each mail it sends: delivered, delayed, bounced, or marked unwanted. Agora keeps each report, with the address and the subject, for thirty days, including reports about an address no account holds; a bounce or a complaint is also recorded on your account so that it stops mailing you. Agora also records when you were last active, which your campus's admins and Agora staff can see. When a sign-in fails, Agora counts the failures in a row for that address, whether or not an account holds it, so that it can lock the address for a while from the fifth; the count is forgotten a day after the last failure. Server errors are counted in a table that is not tied to any account, though an error's own message can be stored with it. An account whose address is never confirmed with its code is deleted after seven days. If someone tries to sign up with an address that already has an account, Agora mails that address to say so, and creates nothing. Where a campus takes new accounts by invitation only, you can ask for a place on its waitlist from the signup page: Agora then keeps the address you typed, the campus it belongs to and when you asked, and nothing else, without an account. That campus's admins and Agora staff can see the waitlist. Nothing is mailed to the address until an admin admits it, and then one invitation is. The address is deleted from the waitlist when it gets an account or when an admin removes it; otherwise it is deleted a year after you asked, or, once you have been invited, thirty days after the invitation. When an admin invites an address by name, Agora keeps that address on the invitation, with when it was made, when it runs out and whether it was used, and deletes the invitation ninety days after it runs out or is withdrawn. If you turn push notifications on in a browser, Agora records that browser's push endpoint and keys, and in the iPhone app it records the phone's device token; either is tied to the session you turned it on in, so signing out stops it. Push in browsers is switched off in production today, so nothing of that kind is recorded for a browser; push in the iPhone app is on. The iPhone app is the site itself, opened inside the app, and apart from that token it records nothing the site does not. It asks to use the camera only when you take a photo to post, send or use as your picture, and adds an event to your calendar only when you ask, without reading the calendar.

The iPhone app also keeps some things on the phone itself, outside the site: the names of profiles, groups and events you opened, for iPhone search, for thirty days at most; your unread counts and the events you are going to, for the widgets; copies of up to thirty pages you read, so you can read them without a connection and so the feed shows at once when the app opens; something you shared into Agora from another app, until you open it; your first name, your campus's color and, for a co-branded campus, its logo, for the screen the app opens with; and your sign-in cookie, in the phone's keychain. None of it is sent to Agora, apart from the sign-in cookie, which the app's notification extension sends only to Agora, to show a picture in a notification. On an iPad, each window also keeps the address of the page it last showed, so it can reopen there. The app also remembers on the phone whether its Face ID lock is on; that setting is not sent to Agora and stays after you sign out. The rest is deleted when you sign out. In any browser, the app's included, a message you write with no connection is kept on that device until it is sent, a day passes, or you sign out.

Agora does not ask for a date of birth, Social Security number, student ID number, payment detail or government identifier.

As of the effective date above, Agora does not keep a record of which posts you have viewed or for how long: there is no impressions table, no dwell time, no marker of which posts you have seen, and no log of what you clicked. The company that hosts Agora keeps a short log of requests, described in section 6. The campus feed's sorted view orders what it shows by when a post was written, whether it is from a group you joined, from a friend or from someone you follow, and how many people reacted or commented on it — facts about the post and about connections you made yourself — and it does not read the words of any post.

In a conversation, Agora records when you last opened it or wrote in it, and the moment you last typed in it. The others in the conversation are shown the first as "Seen" under what they wrote, and the second as a sign that you are typing, for six seconds after you last typed. Read receipts are on until you turn them off on your notification settings page; while they are off, nobody is shown when you have read their messages, and you are not shown when anybody has read yours. The moment you last opened a conversation is recorded either way. Neither is shown of someone who has not yet answered a first message, or of someone you have blocked.

5. Who sees what

Agora is built so that what you post, your profile, your groups and your events are shown only to signed-in members of your campus: every record carries a campus, every read is filtered to the reader's campus, and a request for something on another campus is answered as if it did not exist. The limits on that are described in this section. The moderators and admins of your campus see the reports filed there and the log of actions taken on them, and Agora's own staff, one account, may read any campus's queue and log, with every action they take written to that campus's log. Agora staff can also look up any member on any campus: their email address, their open sessions (device, IP address and last use), the mail provider's reports about their address, and what moderators have done about their account; each lookup is written to that campus's log. Where pictures are kept in the private store, your campus's moderators and admins can open any picture posted on the campus, private groups and removed posts included, and Agora staff any picture on any campus; a picture in a message is the exception, which they can open only once that message has been reported. A campus admin can see the list of members of the campus with their email addresses, and every such read is written to the audit log with the count and filters, and not the search term.

Two limits you should know about. Pictures are stored today in a public store under long random names: the address of a picture is not guessable, but anyone who has it can fetch the picture, including someone outside your campus. Agora can instead keep pictures in a private store, where a picture is shown only to a signed-in member allowed to see what it belongs to, and photos in messages are offered only then; the site does not use it today. Agora's servers can read stored posts, comments, messages and profile fields, because they have to show them to you; these are protected in transit and by the campus boundary, and Agora does not offer end-to-end encryption. What you post or send can also be copied, saved or passed on by the people who can see it, and Agora cannot control that.

You can block another member, and a block hides each of you from the other in feeds, events, search and suggestions.

Anyone in a group conversation can give it a name, which everyone in it sees. Only the member who started a group conversation can take someone out of it; the person taken out is not told, and the conversation leaves their list.

A first message from someone who is not your friend waits in your Requests list until you answer it. Until then it raises no badge, no notification to your phone and no mail that arrives at once, and the notice Agora writes for you carries no part of what was written. You can read it and report it before you answer and after you decline, and declining tells the sender nothing.

When a message is reported, Agora keeps a copy of up to its first 1,000 characters with the report, so it can be judged even if it is later deleted. Moderators of the campus and Agora staff can read that copy, the message as it reads now, and its photos. The copy stays with the report, which is kept indefinitely today, including after either account is erased.

The supplemental notice "Who can see your messages" (/privacy/messages), which forms part of this policy, describes in full who may access the content of your messages, under what conditions, and how Agora responds to requests for that content. Agora does not provide any university or other educational institution with access to the content of members' messages, whether in bulk or conversation by conversation, and does not permit any campus to browse, search, monitor or export them; a person acting as a moderator or administrator of a campus on Agora, whether or not employed by the university, may view a message only after a participant in the conversation has reported it, and only to the extent necessary to review that report.

A request from a law enforcement agency, a court or anyone else for the content of messages should be sent to Agora rather than to any university. Agora reviews each request for legal validity, and gives the content of your messages to anyone outside the conversation only in these cases: when a search warrant or other legal order that the law says can compel it requires it; when Agora believes in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay; when the law requires or allows a report of the sexual exploitation of a child; with the consent of someone in the conversation, which includes a participant reporting a message; or when it is needed to protect the rights or property of Agora. What a particular order can reach depends on the law that applies to the agency asking, and Agora gives no more than that law allows.

Apart from the content of messages, Agora may keep and disclose account information and content when the law requires it, to answer a valid legal order, to enforce its terms, to investigate abuse or a security problem, or to protect the safety, rights or property of its members, of Agora or of others. Agora tries to tell you by email when a legal request names your account, unless the law or a court forbids it, the request concerns the exploitation of a child, there is an emergency, or telling you would put someone in danger.

If Agora or the company that operates it is sold, merged or reorganized, the information it holds may pass to the new owner, who must follow this policy or tell you before changing it.

6. Where it is kept, and who processes it

The application runs on Vercel in its Ohio region, the database is a Neon PostgreSQL project in the same region (AWS us-east-2), pictures are in a Vercel Blob store, mail is sent through Resend, Cloudflare holds the domain's DNS records and runs the operator's check that the site is up, and GitHub runs the tests on every change. Resend sends Agora's mail from its North Virginia region (us-east-1), and an Upstash Redis store keeps the counters that limit repeated requests. The picture store is in Vercel's Ohio region as well. As of the effective date above, there is no analytics code, no advertising code and no third-party script on the site. Agora does not sell personal information and does not share it for advertising: Agora gives the companies named here information only so that they can run the service for it. Agora does not track you across other sites, and no other company collects information about your activity on Agora for that purpose, so Agora does nothing different when your browser sends a Do Not Track or Global Privacy Control signal. Agora plans to show advertising in the future. Before it does, this policy will be updated to say which companies are involved and what they receive, and you will be told as section 12 describes. Mail about a message says who sent it and quotes up to its first 90 characters, and passes through Resend like all of Agora's mail. Vercel keeps a log of requests to the site, with the IP address and the page asked for, for as long as its plan keeps them, which is one day. Upstash is given a one-way hash of an IP address or of a typed email address, and not the address itself. A notification sent to the iPhone app passes through Apple's push service, which is given its title, a summary of at most 180 characters, the address of the page it is about, an identifier that groups one conversation's notifications together, the number shown on the app's icon, and, where someone did what the notification is about, that person's name and the address of their profile picture; for a message or a friend request, Apple is also given the notification's id and whether it can be answered with Reply or Accept from the notification itself.

Agora is offered to people at the United States campuses it lists, and is run from and stored in the United States. It is not directed to people in other countries. If you use it from elsewhere, your information is handled in the United States under this policy.

7. How long it is kept

Expired and ended sessions, and used sign-in codes and reset tokens, are deleted thirty days after they stop being useful. Notifications are kept for 180 days, and ones you have read for 90. Posts and comments that a moderator removed, and the moderation log, are kept indefinitely today; the photos of a removed post, and of a deleted message, are deleted thirty days after removal. When you delete a post yourself, it is hidden from everyone at once, but its words stay in the database, marked deleted; its photos are deleted after thirty days. When you delete a message yourself, it is hidden from everyone at once, and its words, photos and files are erased after thirty days; a report filed about it keeps its copy. A comment you delete is deleted outright, unless others have replied to it, in which case it is hidden and its words are kept the same way. If you delete your account from your account settings, it is hidden at once, every session is ended, and your profile is no longer shown; signing in within thirty days cancels the deletion. After thirty days the account is erased. Agora may keep information longer where the law requires it, to answer a legal order, or to resolve a dispute or a safety report, and copies in backups last until the backups expire. Your address, name, username, profile, photos, connections, sessions, notifications, settings and the mail provider's reports about your address are deleted. These stay, shown as written by "Former member" under one lasting account number: your posts, comments and messages (deleted ones included, and still visible to the people you sent them to), your reactions, group memberships and event answers, the reports and appeals you filed, and the moderation record about your account, which may include moderators' notes. Posts by other people that mention you are not changed. You can download your data from your account settings: one file with your profile, what you wrote, the messages you sent and your settings, and your photos.

If Agora learns of content that appears to show the sexual exploitation of a child, it removes it, reports it to the National Center for Missing & Exploited Children as the law requires, and keeps a copy of what it reported, its words and its pictures, apart from the site for at least one year after the report, or longer where the law requires or allows. The person who posted it is not told, and the copy is kept even if their account is erased.

Agora keeps backups. The database keeps its own history for six hours so that it can be restored to an earlier moment, and a restore copy made for a repair is deleted when the repair is done. Every night a list of the picture store's contents is written into the store, and thirty such lists are kept. Once a month the operator copies the whole picture store and keeps the copy outside the store; a photo the store no longer has is deleted from that copy thirty days after the copy first finds it missing, at the next monthly copy after that.

Where this policy gives no period, Agora keeps information for as long as your account is open and for as long afterwards as it needs for the purposes described here.

Agora uses reasonable measures to protect your information, described in this policy, but no service can promise that information will stay secure. Use a password you use nowhere else, and write to hello@agoraoncampus.com if you think someone else has entered your account. If a security incident affects your information, Agora will tell you where the law requires it.

8. Mail

Agora sends you a sign-in code when you sign up and a reset link when you ask for one. It sends notification mail about ten kinds of activity (the ninth, reports reaching a queue, only to moderators, admins and Agora staff; the tenth, the developer hub, only to developers and Agora staff), each of which you can set to arrive right away, once a day in a digest, or not at all; a notice from a moderator about your own account is always sent, unless your address has hard-bounced (section 4); every notification mail but such a notice carries a one-click link that stops all of them.

9. Universities

Agora shows universities under their own names, and says this beside them: University names, colors and marks are the property of their respective institutions. Agora is an independent service and is not affiliated with, endorsed by, or sponsored by any university shown here. That notice is shown wherever a campus's name and colors appear on the signed-out pages and on the appearance settings page. Nothing about you comes from your university: no roster, no directory, no sign-in through your university's login, and no feed from its register of student organizations. If that changes, this policy will be updated to say which of two things is happening: that you are signing in through your own university's login and choosing what it releases, or that your university has supplied a record under an agreement with the operator, of which there is none today.

10. Who may use Agora

Anyone with an address on a university domain Agora recognizes may sign up while that campus's signups are open, and, where the campus takes new accounts by invitation only, with an invitation. Agora does not ask your age or date of birth. Agora is for adults: you must be 18 or older to hold an account, and Agora is not directed to children. Agora does not knowingly collect information from anyone under 13; if it learns that an account belongs to someone under 13, it deletes the account and what it holds. If it learns that an account belongs to someone under 18, it closes the account. Anyone who posted on Agora while under 18 can delete what they posted, or write to hello@agoraoncampus.com to have it removed from view; removal hides it from others and does not always erase every copy.

11. Intimate images shared without consent

If an intimate picture or video of you, real or made to look real, has been posted or sent on Agora without your consent, write to hello@agoraoncampus.com or use Report on it. Say where it is, with enough detail for Agora to find it, that it shows you, and that you did not agree to its being shared, and sign with your name; a typed name is enough. You do not need an account to ask. Agora removes it, and the identical copies of it that it can find, within 48 hours of a valid request.

12. Changes, and how to reach Agora

When this policy changes, the effective date at the top changes, and earlier versions are available on request. If a change affects what Agora collects or who sees it, Agora will tell you by email and on the site at least 30 days before it takes effect, unless the change is needed sooner for security or to meet a legal requirement, in which case Agora will tell you as soon as it reasonably can. Agora can be reached at hello@agoraoncampus.com.

13. What you can do

From your account settings you can see and change your name, profile and settings, download a copy of your data, end any session, turn read receipts off, choose which mail Agora sends you or stop all of it, and delete your account. For anything your settings do not cover, such as correcting something you cannot edit, asking what Agora holds about you or asking for it to be deleted, write to hello@agoraoncampus.com. Agora answers a request sent from the email address on the account, may ask for more to be sure a request is yours, and aims to answer within 30 days.

If you live in California: Agora does not sell your personal information, does not share it for advertising across other sites, and does not give it to other companies for their own marketing. You can ask what Agora holds about you, and ask for it to be corrected or deleted, as this section describes.