Privacy policy

1. Who operates this service

The Enigma organising team, Department of Computer Science, University of Mumbai, operates the student account service. Contact info.veman99@gmail.com for privacy questions, corrections or account deletion requests.

2. Information processed

• Account details: first name, last name, email, phone number, account identifier, verification status and account timestamps.
• Optional profile information: college, course, study year and student identifier if provided. Do not enter government identity numbers in a student identifier field.
• Social sign-in information: Google or GitHub identifiers, email and basic profile information returned to our authentication provider. That provider may receive a profile-picture URL as part of standard profile data. Our student profile and account interface do not use that picture or require a photo upload.
• Technical information: session cookies, preview-access cookies, request information used for security, and provider logs. Our application rate-limit records use hashed email/IP identifiers rather than storing raw email addresses or IP addresses in that table.
• Website analytics: Google Analytics is configured on the site and may process usage, device, browser, approximate location and cookie information according to its settings and Google’s policies.

College ID cards and payment screenshots are planned for a later registration stage. Those uploads and payment approval are not part of the current account setup. We will update the registration information and this policy when those features become available.

3. Why we use information

We use account information to verify email ownership, authenticate users, maintain student profiles, answer support requests and prepare participation-related services. We use security information to limit abuse and protect accounts. Website analytics helps us understand how the site is used and identify improvements.

Google and GitHub sign-in data is used for account identity and access, not for advertising. Signing in does not grant us access to your Gmail messages, Google Drive files or private GitHub repositories.

4. Service providers and disclosure

Supabase provides authentication and account storage; Brevo delivers verification emails; Vercel hosts the website; and Google or GitHub processes social sign-in when you choose it. Google Analytics processes website usage information. These providers may process information on infrastructure outside your country under their own terms and privacy policies.

Organising team members who need information to operate accounts and support participants may access it. We may also disclose information when required by law or needed to investigate misuse or protect the service.

Relevant provider policies: Supabase, Brevo, Vercel, Google and GitHub.

5. Cookies, analytics and external content

Session cookies keep you signed in, and preview-access cookies unlock the development preview. Blocking these cookies may prevent those features from working. Analytics cookies may also be used by the Google Analytics integration. You can manage or delete cookies through your browser settings and learn about Google’s Analytics opt-out tool.

Maps, embedded media and external links may connect you to third-party services, which can receive technical information and apply their own privacy policies.

6. Retention and deletion

We keep information for the account, festival administration and support purposes described here, and for any necessary security or legal retention. We review continued retention as those purposes end. Contact us to request deletion rather than assuming an account is deleted automatically after the festival.

We may need to verify account ownership before acting on a request. Limited records may remain where required for security, dispute resolution or legal obligations; provider backups may retain copies until their normal expiry. We will explain any applicable limits when responding to your request.

7. Your choices and account security

You can edit available profile fields in your account and contact us to request access, correction or deletion of your information. You can also revoke Enigma’s access from your Google or GitHub account settings; revoking social access does not by itself delete your Enigma account.

Keep verification codes private and sign out on shared devices. We apply access controls and verified-session checks, but no online service can guarantee absolute security. Do not send passwords, OTPs or unnecessary identity documents to our support email.

8. Changes and contact

We update this page when the service or its data practices change. The date above identifies the current version. For questions, email info.veman99@gmail.com. See about student accounts for an overview of the service.