Privacy Policy

CampusNinja uses Google Sign-In via Supabase Authentication as the sole sign-in method. When you sign in, we receive:

• Your Google account name and email address
• Your Google profile picture URL
• A unique user identifier

We do not receive or store your Google account password. Authentication tokens are securely stored on your device and refreshed automatically by Supabase.

Signing in is optional. The app can be used without an account for browsing subjects, notes, and study resources. An account is required only for placing marketplace orders.

We use Firebase Cloud Messaging (FCM) via Expo Notifications to send push notifications. When you grant notification permission, we obtain:

• An Expo push token (for the Expo notification service)
• A native FCM device token (for Firebase Cloud Messaging)

These tokens are stored in our Supabase database (in the device_tokens table) alongside your user ID (if signed in), selected branch, semester, and platform type.

You can disable push notifications at any time through your device's system settings. When you sign out, your device token is automatically removed from our servers.

CampusNinja uses basic event tracking to understand how the app is used. Events tracked include:

• App open events
• Subject and resource views
• PDF downloads
• Marketplace interactions
• Order creation events

Currently, analytics events are logged locally on the device for debugging purposes. Firebase Analytics JS SDK is not active in the React Native environment. No analytics data is transmitted to third-party analytics services.

We do not use any advertising identifiers, cross-app tracking, or third-party analytics SDKs that profile users.

We use the following third-party services, each with their own privacy policies:

We do not sell, trade, or rent your personal information to any third party. Data shared with the above services is limited to what is necessary for their operation as described.

Mobile App: The CampusNinja mobile app uses AsyncStorage (device-local storage) to store:

• Your academic setup preferences (branch, semester)
• Onboarding completion status
• Recent search history
• Authentication session tokens
• Installation timestamp

This data is stored locally on your device and is not transmitted to any server unless explicitly stated.

Website: The CampusNinja website may use essential cookies and local storage for session management and functionality. We do not use advertising or tracking cookies.

Under applicable data protection laws, including the General Data Protection Regulation (GDPR) and the Indian Digital Personal Data Protection Act (DPDP Act, 2023), you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request permanent deletion of your account and associated data (see Section 12).
• Portability: Request your data in a structured, machine-readable format.
• Withdraw Consent: Withdraw consent for data processing at any time by deleting your account or contacting us.
• Grievance Redressal: Under the DPDP Act, you may raise a grievance with us and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, please contact us at manavgupta236@gmail.com.

We retain your personal data only for as long as necessary to provide our Service:

• Account Data: Retained until you delete your account.
• Order Records: Retained for up to 2 years after order completion for record-keeping and dispute resolution, then anonymized.
• Device Tokens: Removed when you sign out, delete your account, or uninstall the app.
• Uploaded Files: Order-related files are retained for the duration of the order lifecycle and deleted upon account deletion.
• Local Storage: Cleared when you delete the app from your device.

We take the security of your data seriously and implement the following measures:

• Encryption in Transit: All data transmitted between your device and our servers uses TLS/HTTPS encryption.
• Encryption at Rest: Supabase encrypts all stored data at rest using AES-256 encryption.
• Row-Level Security: Supabase Row-Level Security (RLS) policies ensure users can only access their own data.
• Secure Authentication: OAuth 2.0 via Google Sign-In with token-based session management.
• No Password Storage: We never store user passwords; authentication is delegated entirely to Google.

While we strive to use commercially acceptable means to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

CampusNinja is designed for engineering college students and is not directed at children under the age of 13 (or 18 in jurisdictions where applicable). We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at manavgupta236@gmail.com and we will promptly delete such information.

You can permanently delete your CampusNinja account at any time through the mobile app:

1. Open the CampusNinja app
2. Go to Profile tab
3. Scroll to Help & Legal section
4. Tap Delete Account
5. Confirm deletion in the two-step confirmation dialog

Upon account deletion, we permanently remove:

• Your authentication account and session
• Your push notification device tokens
• Your uploaded order files from cloud storage
• Your order records (anonymized for legal compliance)

You may also request account deletion by emailing us at manavgupta236@gmail.com. Deletion requests are processed within 7 business days.

For detailed instructions, visit our Account Deletion page.

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and notify users through a push notification or in-app banner for material changes.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.