Privacy Notice

CampusZen is a student social network operated in India. For data protection questions, rights requests or complaints, contact our Grievance Officer at privacy@campuszen.tech. We aim to respond within 30 days and will not exceed 90 days without telling you why. General support: support@campuszen.tech. Security issues: user-synax@proton.me.

This notice covers personal data we process through CampusZen accounts, the website, the API, notifications and moderation. Under the DPDP Act, you are the Data Principal, we are the Data Fiduciary, and service providers who process data only on our instructions are Data Processors.

We do not sell your personal data. We do not use it for targeted advertising, and we do not run advertising cookies. CampusZen is for users aged 13 and over; accounts for children under 13 are not permitted.

We collect only what is needed for the purposes below. Where a field is optional (for example bio, college, course or social links), you can leave it blank.

• Your consent. We ask you to take a clear affirmative action — ticking the consent box at signup or in the consent screen — before we process account data. The notice is presented before or with that request, and the consent is recorded with its version, time, IP address and user agent.
• 13–17 year olds. If your date of birth shows that you are under 18, the account stays inactive until a parent or lawful guardian verifies their email with a one-time code and confirms they are 18 or older. We record the guardian's name, email, consent time and request details. We do not activate the account, and we do not send the child's verification code, before that approval.
• Optional analytics. Analytics consent is separate and optional. It is off unless you turn it on, and it is always off for under-18 accounts.
• Language. This notice is available in English. You can request a copy in any language listed in the Eighth Schedule to the Constitution by writing to privacy@campuszen.tech.

• Create, verify and secure your account; keep you signed in.
• Show your profile, posts, replies, articles, polls, media, college pages, interest hubs, search results and feeds according to your privacy settings.
• Deliver in-app notifications, optional Web Push notifications, and transactional email such as OTPs and password resets.
• Moderate reports and appeals, enforce blocks, restrictions, suspensions and bans, and protect users from abuse.
• Provide author analytics (views and engagement) and aggregated service analytics where you have consented.
• Comply with law, respond to lawful requests, and establish or defend legal claims.

We do not use your data for behavioural advertising, and we do not sell or rent it. We do not use children's data for tracking, behavioural monitoring or targeted advertising.

We share personal data only with processors that help us run the service, under confidentiality and data-processing terms:

• MongoDB Atlas — primary database hosting.
• Appwrite — storage for avatars, covers and post media.
• Resend or Gmail SMTP — delivery of OTP and password-reset email.
• Web Push (VAPID) — OS-level notifications when the app is closed.
• Vercel — hosting, plus optional aggregated analytics and performance measurement.

These providers may process data outside India, including in the United States, the European Union and other regions where they operate. Cross-border transfers are made in accordance with Section 16 of the DPDP Act and any restrictions notified by the Government. You can ask us for the current processor list and locations at privacy@campuszen.tech.

We may also disclose data where required by law, to protect the safety of users, or as part of a merger or acquisition subject to this notice.

• Account, profile and content: kept while your account exists. If you deactivate, the account is hidden for 30 days so you can restore it; after that it is permanently purged. If you delete immediately or withdraw consent, it is hidden at once and removed by the deletion sweep, usually within 24 hours.
• Consent records: kept while the account exists and deleted with it. We may retain the minimum needed to demonstrate compliance where the law requires it.
• Sessions: 1 day, or 7 days when you choose "remember me"; deleted on logout, revocation or expiry.
• OTPs: 10 minutes, with a maximum of 5 attempts.
• Post views: raw view rows are deleted after 180 days. The denormalized all-time view count remains on the post.
• Reports, appeals and verification requests: kept for as long as needed to review the matter and any appeal, then deleted or anonymised unless the law requires longer retention.
• Push subscriptions: kept until you disable push or delete your account; dead endpoints are removed when delivery fails.

Deletion removes the account row, owned content and graph rows, sessions, notifications, push subscriptions, post-view rows, reports, appeals, verification requests, consent records and stored media. Some data may remain for a limited period in encrypted backups before they rotate.

• Access. Download a JSON copy of your profile, content, graph, sessions, notifications, consent history and other account records from Settings → Your data, or email us.
• Correction. Edit your profile at any time. Date of birth is locked after it is set to protect the age gate; if it is wrong, write to us and we will correct it after verification. Email changes are handled the same way.
• Erasure. Delete individual posts, or delete your account from Settings → Your data. Deactivation gives you a 30-day restore window; immediate deletion and consent withdrawal schedule prompt erasure.
• Grievance redressal. Write to the Grievance Officer at privacy@campuszen.tech. We respond within 30 days (and no later than 90 days). If you are not satisfied, you may complain to the Data Protection Board of India at dpboard.gov.in after giving us the opportunity to resolve it.
• Nomination. You may nominate a person to exercise your rights in the event of death or incapacity by writing to us with the nominee's details. We will record the nomination and verify it before acting on it.

Requests are free. We may need to verify your identity before acting. We will explain if we cannot fulfil a request because of a legal obligation.

You can withdraw consent at any time from the consent screen or by writing to privacy@campuszen.tech. Withdrawal is as easy as giving consent. Withdrawing core consent means we stop processing your account: it is deactivated at once and scheduled for deletion. Withdrawing optional analytics consent turns analytics off without deleting the account. Withdrawal does not affect processing that was lawful before it.

A parent or guardian can withdraw consent for a 13–17 account on the guardian consent page. The account is deactivated and scheduled for deletion.

CampusZen is for users aged 13 and over. We do not knowingly allow accounts for children under 13; if we learn that a child under 13 has created one, we will remove it.

For users aged 13–17, we require verifiable consent from a parent or lawful guardian before the account can be used. We check that the person approving is an identifiable adult through a one-time code sent to the guardian email and an adult confirmation. We do not undertake tracking or behavioural monitoring of children, and we do not serve targeted advertising to them. Streaks, achievement progression and post-view analytics are disabled for under-18 accounts. A guardian can withdraw consent at any time.

We use technical and organisational safeguards: TLS in transit, bcrypt password hashing, HTTP-only cookies, per-device refresh-token rotation with replay detection, rate limits, input validation, access controls and consent audit records. No system is completely secure; use a strong, unique password and do not reuse it.

If a personal data breach occurs, we will notify affected Data Principals without delay and intimate the Data Protection Board of India without delay, followed by a detailed submission within 72 hours unless the Board allows more time. The notice will describe the breach, its likely impact and the steps we are taking.

We use a session cookie to keep you signed in, a theme cookie to remember light or dark mode, and an analytics-consent cookie. We do not use advertising cookies or cross-site tracking cookies.

Vercel Analytics and Speed Insights are optional, aggregated performance tools. They load only when your analytics-consent cookie is set to allow them; they do not build advertising profiles. You can withdraw analytics consent in the consent screen without deleting your account.

We may update this notice as the service or the law changes. When we do, we publish a new version and ask you to accept it before your next write action. The version and effective date are shown at the top of this page. Continued use after acceptance means the new notice applies.

If you have a concern, contact the Grievance Officer first at privacy@campuszen.tech. You can also complain to the Data Protection Board of India at dpboard.gov.in after giving us the opportunity to resolve it.