Privacy Notice

The short version

• We store what is needed to run a campus social app: your account, your profile, and what you post.
• Essential storage (your session, offline cache) is always on because the app cannot work without it. Optional analytics is off until you accept it, and you can change your mind at any time.
• We do not sell your data, show ads, or run advertising trackers.
• Your message text, your email address, your verification codes and your session token are never sent to analytics or error-monitoring services.
• Server logs containing IP addresses are kept for 14 days, then deleted.

1. What we collect

• Account: campus email address, name, username, branch, year, and an avatar (chosen by you, or generated from your username).
• Profile: a short bio if you write one, and whether you are online right now.
• What you post: room and event titles and descriptions, event location on the campus map, messages in rooms, direct messages, RSVPs, and friend requests.
• Derived activity: karma, the karma ledger (which action earned what), badges, and counters such as rooms joined and events attended. These are computed by the server from the activity above.
• Technical: server logs record the request path, the IP address and the authenticated account id, so we can rate-limit abuse and debug failures.

2. What we do not collect

• Your contacts, your phone number, or your email password.
• Your real-world GPS location — the map only knows the campus coordinates you choose.
• Your browsing outside LAN.
• Advertising identifiers, and anything used to profile you for ads.

3. Cookies and on-device storage

Nothing is stored on your device except what the app needs, and you can clear all of it by signing out and clearing site data:

• Essential — your session. Your sign-in token and account record inlocalStorage, so you stay signed in. Signing out removes it.
• Essential — offline cache. The app shell, icons and previously opened pages kept by the service worker in Cache Storage and IndexedDB, so Nexus opens on weak campus WiFi. Your private data (direct messages, the PocketBase API) is never cached.
• Optional — usage counts. Only if you accept, our analytics provider may set its own identifiers so we can tell how many students use a feature. Decline and the analytics code is never even downloaded — there is nothing to collect.
• Optional — crash reports. Only if you accept, crashes and errors are sent with a random identifier so we can find and fix them. Messages, addresses, verification codes and session tokens are never included, and none of it is recorded until you agree.

We do not use cookies for advertising, and we do not add cookies for performance reasons — page speed is handled by caching and compression, not by tracking. Nexus itself sets no cookies of its own: your session lives in localStorage, and the two optional services are the only third parties involved.

4. Who else is involved

• DiceBear — generates the fallback avatars. When your avatar is generated, a seed derived from your username or name is sent to their API. No email address is sent.
• Analytics and error monitoring (only after you accept) — these receive event names, page paths, and technical error details. Never the contents of your messages, never your email address, never your token.
• Our email provider — used to deliver your verification code. It sees the address the code was sent to, and nothing else.
• We host the app and database ourselves; we do not share data with advertisers or data brokers.

5. How long we keep it

• Server logs (including IP addresses): 14 days.
• Verification codes: minutes — they expire, and are stored only as a hash.
• Your account and content: until you delete them, or until the pilot ends.
• Deleted content is removed from the live database; encrypted backups may hold it for a short period before they rotate.

6. Your choices

• Usage counts and crash reports: accept, decline, or change your mind later. The notice appears until you decide, and it can be reopened at any time — each half (usage counts and crash reports) can be switched on or off separately. Declining never blocks sign-in, the map, friends, messages or events.
• Withdraw consent now: Manage cookies — the switches reopen with your current answer, and switching both off stops collection immediately and clears the analytics identity on this device. Signing out clears it too.
• Your data: you can edit your profile in the app, and you can ask us to export or delete your account and its content by writing to the address below. We answer within 30 days.
• Blocking: blocking a student hides them and their content from you, and stops them contacting you.

7. Security

Passwords are stored hashed, traffic is encrypted in transit, access rules restrict every record to the students entitled to see it, and the API is rate-limited. Text you submit is sanitised before storage. No system is perfect: if you find a security problem, tell us at the address below and give us a chance to fix it before talking about it publicly.

8. Who can use LAN

The pilot is limited to SKIT Jaipur students and staff. Accounts belonging to people who have left the institute may be removed.

9. Changes to this notice

If we change how we handle your data, this page is updated and the version number above changes. Material changes are announced in the app.

10. Contact

Data requests, corrections and security reports: nexus@skit.ac.in.