Privacy policy

Last updated 5 November 2026

Draft. Items marked “To confirm” must be completed by the platform administrators before this page is relied on.

This policy explains what the MCA Class Platform (“the platform”) collects, how it is used and stored, and who can see it. The platform is run by To confirm: who runs the platform for members of the MCA class. Questions about this policy or your data can be sent to To confirm: contact email address.

Signing in with Google

The platform uses Google sign-in to confirm who you are. It asks Google only for the basic openid, email and profile permissions. From the sign-in it uses your email address, whether Google has verified that address, and your name.

Only email addresses that the class administrators have added to the class allow-list can create an account. Other addresses are refused and nothing about them is saved.
The platform does not keep your Google access token after sign-in. It does not ask for, and cannot reach, your own Google Drive, Gmail, contacts or calendar.
After sign-in the platform keeps you signed in with its own session cookie (see Cookies and your device).

What the platform stores

Account and profile: email address, name, username, role, batch and semester. Also your roll number (entered by you or by the administrators on the allow-list), and optionally a short bio, a GitHub username and an avatar colour.
Account activity: when you joined, the last day you were active and your study streak. Also a daily count of study actions, which draws the activity chart on your profile.
What you create: files you upload, chat messages, forum questions and answers, comments, votes, poll votes, ratings, reports, project and team posts, event RSVPs and assignment submissions.
Code lab: code you submit to practice problems and contests with its verdict, time and memory, snippets you save, and a log of each run (language, result and time).
Study progress: syllabus topics you tick off, bookmarks, recently opened resources, quiz attempts (score, time taken and your answers), and flashcard and roadmap progress.
Chat status: the time you were last seen online, and a short-lived note that you are typing.
Notifications: your in-app notifications and which kinds you have switched on.
Administration: an audit log of administrative actions, such as role changes, approvals, bans and data deletion requests. Entries can include the email address of the account concerned.

Why it is used

To let only verified members of the class sign in, and to give each person the right role.
To show your semester, subjects, timetable and deadlines, and to save your progress.
To run the shared spaces (library, chat, forum, projects) and to send in-app notifications.
To keep the community safe: reviewing uploads, handling reports, and moderating or suspending accounts.

The platform contains no advertising and no third-party analytics or tracking code, and it does not sell personal data.

Where data is stored, and the services involved

The platform runs on Google Cloud, in a project controlled by the people who run the platform. Data is hosted in To confirm: the hosting region.
Database (Cloud SQL): everything except the files themselves is stored in a Postgres database.
Files (Cloud Storage): uploaded files are stored in a private storage bucket, not in your own Google account. The database keeps the file name, type, size, uploader and a reference to the stored file. Your browser sends files straight to that bucket.
Hosting (Cloud Run): the website runs on Cloud Run, and Google Cloud keeps standard request logs (such as IP address, browser type and the page requested).
AI tutor (Gemini on Vertex AI), if switched on: when you ask the tutor a question, the platform sends your question, together with extracts from class notes, to Google’s Gemini model to write the answer. Your name and email are not sent with it. Avoid putting personal information in tutor questions.
Code runner (Cloud Run): code you run, and its input, goes to a separate private service that compiles and runs it, then keeps nothing. Code from the playground isn’t stored unless you save it as a snippet.
GitHub: project pages that link a public GitHub repository show its stars and languages, which the platform fetches from GitHub’s public API using only the repository name.

Files and sharing

Class files are library resources, past papers, gallery photos, announcement attachments and chat attachments, including attachments in direct messages. Any signed-in member can open them through the platform.
Private files are My Drive files and assignment submissions. Through the platform, only you can open them, plus the people you share them with, and for assignment submissions the faculty and super admins who grade them. Unsharing removes that access.
Library uploads from students go to a review queue, where administrators and faculty approve or reject them. Uploads from faculty, administrators and contributors are published directly.
Files over 4 MB open through a temporary Google Cloud link, issued after the platform checks your access. Anyone who has that link can use it until it expires, up to one hour later.
Only some file types can be uploaded, and some types (for example, web pages and images that can contain code) are always downloaded rather than opened in the browser.

Who can see your information

Every signed-in member can see your name, username and avatar, and anything you post in shared spaces (channels, forum, comments, projects, events, the library). They can also see your name on quiz and contest leaderboards and in non-anonymous polls, and your online and typing status in chat.
If your profile is public (the default), classmates can open your profile page, with your bio, GitHub username, contributions, quiz statistics, study streak and activity chart. They can also find you, including by roll number, in people search. You can make your profile private in Settings. Your name still appears on what you post.
Your code: faculty and administrators can read the code you submit to problems and contests. Classmates can’t. A snippet stays private unless you share it, and then any signed-in member with its link can read it until you stop sharing.
Direct messages are shown in the platform only to the people in the conversation.
Class administrators (admins and super admins) can see the member list with email addresses, roll numbers, roles and join dates. They can also see the allow-list, the audit log and storage use. Administrators and faculty can see reported content and moderate it.
People who administer the Google Cloud project have broader access. They can read everything in the database, including direct messages, and open every uploaded file. These are To confirm: who holds these accounts.

Security

The platform takes these measures:

The site is served over HTTPS.
Your session is a signed, HTTP-only cookie that expires after 30 days.
Every page and file request checks your role and access on the server.
Only allow-listed accounts can sign in, and the test sign-in used during development is switched off in production.
Chat messages and AI questions are rate-limited.

No system is completely secure, and the platform makes no guarantee that data can never be accessed without authorisation.

Cookies and your device

Cookies: mca_session keeps you signed in (up to 30 days, or until you sign out). oauth_state protects the Google sign-in step and lasts 10 minutes. There are no advertising or analytics cookies.
Browser storage: your theme choice, and the attendance, CGPA and Pomodoro tools, are saved only in your own browser. They are never sent to the platform.
Offline copies: to work offline, the site keeps copies of pages you visit and files you open in your browser’s storage. These stay after you sign out. On a shared computer, clear this site’s data in the browser settings when you finish.

Your choices

Edit your name, username, bio, GitHub username and semester, make your profile private, and choose which notifications you get, in Settings.
Delete your own chat messages, and move your My Drive files to the trash.
Delete my data (in Settings) removes your syllabus progress, bookmarks, ratings, reading history, roadmap and flashcard progress, notifications, poll votes, event RSVPs, activity chart, code snippets, code submissions and run log. It also replaces your name with “Former member”, clears your bio and GitHub username, makes your profile private and closes your account. It does not currently remove your email address, roll number or username. Nor does it remove your uploaded files (including My Drive files), chat messages, forum posts and votes, quiz attempts, assignment submissions or audit log entries. To ask for these to be removed, or for a copy of your data, contact To confirm: contact email address.

How long data is kept

Account data and content are kept while the platform runs, unless removed as described above or by an administrator. To confirm: what happens to accounts and files after a batch graduates or a member leaves
My Drive items in the trash for more than 30 days are permanently deleted the next time their owner opens My Drive.
A deleted chat message has its text erased immediately. A record that a message existed stays, and so does any file attached to it.
Online status is replaced each time you are active. Typing notes stop being shown after a few seconds.
Data removed from the platform may remain for a time in backups or logs kept by Google Cloud, including database backups and recently deleted files, which are kept for about 7 days by default.

Changes

If this policy changes, the new version will be posted on this page with a new “last updated” date. See also the terms of use.