1. Who this covers
This policy covers the MCG Student mobile app for iOS and Android, operated by MCG Career College ("MCG", "we"). It applies to students enrolled at MCG's Calgary, Edmonton, Red Deer, and Cold Lake campuses who use the app, and to MCG staff who use its ID verification features.
MCG is subject to Alberta's Personal Information Protection Act (PIPA).
This policy covers the app specifically. It supplements MCG's college-wide privacy policy at https://mcgcollege.com/privacy, which covers admissions, enrolment, academics and marketing, and which continues to apply to your student record itself. Where the app collects something the college-wide policy does not describe — your ID photo, your device's notification token, the ID-scan verification log — this policy is the one that explains it.
2. What the app collects
From your student record. The app displays information MCG already holds about you as a student: your legal name, preferred name, student number, program name and code, campus, enrolment status, and program start and end dates. The app does not create this information — it mirrors your record from MCG's student information system. You cannot change it in the app; corrections go through your campus front desk.
Your academic and financial record. The app also displays the course results, attendance and payment records MCG holds for you. As with the rest of your record, the app only mirrors it: you cannot change it in the app, and it is not an official transcript, attendance report or receipt. Corrections go through your instructor, the registrar or the front desk.
Your ID photo. You take a photo in the app for your digital student ID. It is uploaded to secure storage and reviewed by authorized staff before your ID becomes active.
Your email address, used solely to sign you in. The app has no password; you receive a one-time six-digit code by email.
A device notification token, if you allow notifications. This identifies your device to the notification service so announcements can reach you. It is not tied to any advertising identifier.
Verification records. Each time staff scan a student ID, the app records which student was scanned, which staff member scanned it, the campus, the result, and the time.
3. What the app does NOT collect
- No advertising identifiers, and no third-party analytics or advertising SDKs.
- No location data. The app never requests location permission.
- No contacts, calendar, microphone, or health data.
- No payment card details, bank details, or any way to pay. The app shows the payment records MCG already holds for you; it never takes a payment and never asks for financial details.
- No browsing or usage tracking across other apps or websites.
- The camera is used only while you are on the photo or scanner screen, and never in the background.
4. Why we collect it
| Purpose | What it uses |
|---|---|
| Confirm you are an enrolled MCG student | Email, student record |
| Issue and display your digital student ID | Photo, name, student number, program, campus |
| Let staff verify an ID is genuine and current | ID code, photo, enrolment status |
| Send you campus and program announcements | Campus, program, notification token |
| Show you your results, attendance and payments | Student record |
| Protect against forged or reused ID codes | Verification records |
We do not use your information for marketing, and we do not sell it. Ever.
5. Who can see your information
- You, for your own record.
- Authorized MCG staff — front desk, registrar, and administrators — for identification, ID approval, and support. Front-desk staff see only their own campus.
- Service providers that operate the app's infrastructure, listed in §7.
We do not disclose your personal information to anyone else except where required or permitted by law.
6. How long we keep it
- Your ID photo is retained for up to 12 months after your program ends, then permanently deleted by an automated monthly process. This matches the consent you give in the app.
- Your student record is retained by MCG as part of your education file under the college's records-retention obligations, independent of the app.
- Verification records are retained as part of campus security records.
- Notification tokens are deleted when you sign out, delete your account, or stop being an active student.
7. Where your information is stored
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in, photo storage | Canada (Montréal region) |
| Railway | Student-record synchronization | United States |
| Expo | Push notification delivery | United States |
| [EMAIL PROVIDER - NOT YET CHOSEN] | Sending your sign-in code | United States |
Your ID photo and student record are stored in Canada. Notification tokens and the text of announcements pass through servers in the United States, where they may be subject to lawful access by US authorities. Announcements are not personal to you, and notification tokens do not identify you by name.
8. Your rights under PIPA
You may:
- Access the personal information MCG holds about you.
- Correct it if it is wrong. Student-record corrections go through your campus front desk, since the app only displays what MCG's records contain.
- Delete your ID photo at any time, from the Profile screen in the app.
- Delete your account from the Profile screen. This removes your sign-in and your ID photo and stops notifications. Your student record is retained by MCG as part of your education file, as the law and the college's obligations require — deleting the app account does not withdraw you from your program.
- Withdraw consent to the photo by deleting it, though your digital ID will not work without one. You can still get a physical ID from your campus.
- Complain to MCG at the contact below, and to the Office of the Information and Privacy Commissioner of Alberta: https://oipc.ab.ca
9. Security
Sign-in uses a one-time emailed code; there is no password to steal. Photos are kept in private storage that is never publicly readable, reachable only through short-lived links issued to authorized staff. Database access is restricted per student, so one student's session cannot read another's record. The QR code on your ID is cryptographically signed and expires after 60 seconds, so a screenshot cannot be reused. All traffic is encrypted in transit.
No system is perfectly secure, but MCG will notify affected students and the Alberta Privacy Commissioner of any breach involving a real risk of significant harm, as PIPA requires.
10. Children
The app is for enrolled MCG students, who are typically adults. It is not directed at children, and MCG does not knowingly collect their information through it. MCG confirms it enrols students aged 18 and over only, which is what the app's Google Play target-audience declaration states. If the college ever admits students under 18, this section needs parental-consent language and that declaration has to change with it.
11. Changes
We will post any changes here and update the effective date. Material changes affecting how your information is used will be announced in the app.
12. Contact
Privacy Officer MCG Career College
#220 4774 Westwinds Dr NE, Calgary, AB T3J 3Z5 info@mcgcollege.com · (888) 261-8999