Privacy Policy

1. Legal Basis for Data Processing

In accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, AbhiHub processes personal data strictly on the basis of explicit user consent provided at account creation, OAuth login, or feature initialization.

Indian law does not recognize broad "legitimate interest" exceptions for commercial digital services. You have the absolute right to grant, manage, or withdraw your consent at any time.

2. Information We Collect & Technical Scope

We collect only data necessary to deliver academic study tools, leaderboard ranking, and secure user profiles:

• Account & Profile Data: Full name, verified email address, role (student/teacher), college affiliation, department/branch, year of study, registration/roll number, and optional mobile number.
• Uploaded Document Data: Study notes, question papers, and practical files uploaded to Cloudinary or Supabase Storage. PDF metadata and image EXIF geolocation headers are automatically stripped prior to cloud storage to protect uploader privacy.
• Analytics & Usage Telemetry: Google Analytics 4 (Measurement ID: G-EH5BGS9BEG) and server-side logs record IP address, user-agent string, device type, page URL paths, document access duration, and client errors.
• Push Notification Subscriptions: Web Push VAPID subscription endpoints and device identifiers for sending exam alerts and upload updates.
• Transaction Data: For credit top-ups (₹2/view credit packs), AbhiHub records user ID, purchased pack size (50/100/500 views), price in INR, and resulting quota balances in database transaction ledgers. Payment card details are never stored by AbhiHub.

3. Feature-Specific Data Handling

Certain interactive features require specialized data handling policies:

• Encrypted Direct Messaging: Peer-to-peer messages use NaCl (PyNaCl) End-to-End Encryption or Fernet symmetric encryption. Message content cannot be read by AbhiHub servers. However, server metadata is logged for delivery: sender ID, recipient ID, message timestamps, and delivery/read receipts (abhihub.chat_messages).
• Campus Crush & Matchmaking: When you mark a crush via /api/crush/<target_id>, the system stores your choice privately (from_user, to_user, year; maximum 2 crushes per calendar year). Crush choices remain strictly confidential and are never revealed unless a mutual match occurs, in which case both users receive a match alert.
• Memory Wall & Year Book: Signatures uploaded for memory walls are compressed image files stored on Cloudinary. Submitter email and user ID are logged server-side for moderation. Public memory wall pages display the visual signature along with the submitter's public display name or note.

4. Named Third-Party Data Processors

AbhiHub integrates with trusted infrastructure and analytics providers to host and secure services:

• Supabase Inc. (AWS AP-South / India): Primary PostgreSQL database, authentication token verification, and fallback public file storage.
• Cloudinary Ltd.: Cloud media storage, image grayscale optimization, watermark overlay, and document delivery.
• Google LLC (Firebase & GA4): OAuth 2.0 authentication verification and Google Analytics 4 performance telemetry.

5. Data Retention Periods

We retain personal data only as long as necessary to provide service:

• Profile & Upload Data: Retained for the lifetime of your active account. If you request account deletion, your profile and private metadata are permanently scrubbed.
• Chat Delivery Receipts: Retained for 90 days following message delivery, after which delivery timestamps are archived.
• Security & Session Audit Logs: User session IP addresses and access logs (user_sessions, security_audit_logs) are automatically purged after 90 days.

6. Your Rights under DPDP Act 2023

As a Data Principal under the DPDP Act 2023, you possess the following enforceable statutory rights:

• Right to Access: Request a summary of personal data being processed by AbhiHub and the identity of third parties with whom data was shared.
• Right to Correction & Erasure: Correct inaccurate profile data via Account Settings or request complete account erasure via the Delete Account page.
• Right to Grievance Redressal: Submit privacy complaints directly to our designated Grievance Officer.
• Right to Nominate: Nominate an authorized individual to exercise your data rights in the event of incapacity or death.

7. Grievance Redressal Officer

In compliance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act 2023, the contact details of our Grievance Officer are:

8. Minimum Age & Cookie Disclosure

Minimum Age Requirement: AbhiHub is designed for higher education engineering students. Users must be at least 13 years of age (or the minimum legal age for digital consent in India) to create an account.

Cookie Usage: We use essential HTTP session cookies for user authentication and security. Analytics cookies are enabled only upon explicit consent via our cookie notification banner.