Privacy policy

This website does not track you. It counts visits anonymously, with no cookies and nothing that identifies you, and it embeds no social widgets and shows no advertising. Nothing it holds is sold or shared with anyone outside the committee.

You can read every page of this site, including the whole event brief, without signing in and without giving us anything at all. Browsing signed out sets no cookies.

Every student and staff member of the department has an account, made by the department from its own roster rather than by the person themselves. What that account holds, what you add to it, and who can see it are described in full below.

This page describes what the site does. It is not legal advice, and it has not been certified by anyone. If something here is unclear or looks wrong, tell us.

Accounts, profiles, student records, questions, teams, payment references and chapter hand-ins are stored in a Supabase project hosted in Mumbai, India. Supabase is our database and authentication provider and processes this data on our behalf.

Files attached to student records, and profile photos, are stored in a Google Drive account the committee controls. Google processes those files on our behalf. They are not published by Drive: the site reads them through Google's API and only the people described below can open them.

The pages themselves are served by Vercel. Like any web server it records standard request information so pages can be delivered and abuse blocked, typically your IP address, the page requested, the time and your browser's user-agent string. We do not use those logs to build a profile of you and we do not combine them with your account.

How fast pages load is measured with Vercel Speed Insights. It sets no cookies and stores nothing on your device; it records load timings with the page, the country and the kind of device, never who you are.

Beyond those timings nothing is copied to a third service for analysis, and no part of this data is used to train anything.

There is no sign-up form. The department makes an account for every student, on their institute email address, from the department's own roster. Its first password is the email address itself, and the site will not open any console until you have chosen a new one. You then sign in with that address and your password, or with Google, GitHub or Facebook on the same address where those are switched on.

The account starts with what the roster already held: your name, institute email, PRN and class. You can correct your name, PRN, class and phone number from your console.

For an email and password account we store your email address, your name, and a one-way hash of your password. The hash cannot be turned back into your password, and nobody on the committee can read it. Password checking is handled by Supabase Auth and the password you type is never written to our own tables or logs.

If you use Google, GitHub or Facebook, you are sent to them to sign in and you give us no password at all. They then tell us your email address, your display name, and the address of your profile picture. We store those three things and nothing else. We do not receive, and cannot see, your password or anything else in that account.

Choosing one of those buttons means your browser contacts that company, and that visit is covered by their privacy policy as well as this one. Nothing on this site contacts them until you press the button.

To slow down password guessing, every sign-in attempt records the address that was tried, the network address it came from, the time and whether it worked. Those rows are kept for about a day and then deleted, are readable by nobody through the site, and are used for nothing else.

The site sets no cookies for analytics, advertising or profiling, and none at all until you sign in.

Signing in sets session cookies whose names begin with sb-, placed by Supabase Auth. They hold the tokens that keep you signed in and identify your account to the server. They are HttpOnly, so no script on the page can read them, and SameSite=Lax, so they are not sent from other sites. Signing out clears them.

Signing in also sets one small cookie called cesac-console. It holds only which console you use (student, organiser or verifier), so the public pages can show a Your console button instead of Sign in. It carries no name, no account number and no token, and signing out clears it.

These cookies are strictly necessary: they exist only because you asked to sign in, they do nothing else, and there is no version of a sign-in that works without them.

Four preferences are saved in your browser's local storage and nothing else is: cesac.consent records your answer to the cookie notice so it does not reappear on every page, cesac.music and cesac.music.volume remember whether you turned the music on the Attack on Token page on or off and how loud you set it, and cesac.theme remembers whether you chose the light or the dark look.

Local storage stays on your device. It is not sent to our server, not attached to requests, and nothing in it identifies you. You can clear it at any time through your browser's site-data settings.

CESAC also has a phone app for Android and iPhone. It is the same service, not a second one: it signs in to the same account, shows the same data under the same rules, and everything on this page applies to it. Its screens are pages from this site, under www.cesac.in/m, shown inside the app, and signing in there sets the same cookies described above.

If you turn notifications on, your phone gives the app a push token: a random identifier that lets a message reach that one phone. We store it with your account, together with whether the phone is Android or iPhone, and use it only to tell you that one of your records was checked, that a question you asked was answered, or that a notice was posted. Notifications are delivered through Firebase Cloud Messaging, a Google service, and on an iPhone through Apple's push service. They receive the token and the text of the notification and nothing else. Turning notifications off, or signing out, deletes the token.

A notification says only what happened, such as that a record was verified. It never carries a remark, a file or anything you would not want read off a locked screen. A copy of each one is kept for up to 30 days so that one that failed to arrive can be sent again, and is then deleted.

If you switch on the app lock, the app asks your phone to confirm it is you, with the fingerprint, face or passcode you already use to unlock it. That check happens entirely on the phone. The app is told only whether it succeeded and never receives your fingerprint, face or passcode.

The app uses the camera or your photo library only when you choose to attach a photo or a file, and only the one you pick is uploaded. It asks your permission first, and you can refuse.

On the phone itself the app keeps your choice of light or dark look, whether notifications and the app lock are on, and the push token. They stay on the phone and are removed when you remove the app.

Links to other sites open in a browser inside the app or on your phone, and what happens there is covered by that site's own policy.

If you are a student, your console asks you for a photo once, the first time you sign in. Wherever the site ranks students, on the signed-in standouts list and on the ranking in the console, your name is shown with it.

Before it leaves your device, your browser crops the photo to a square, shrinks it and saves it as a fresh JPEG. That drops the hidden information a phone photo carries, including the location it was taken at. What is uploaded is only the picture.

The server then decodes the photo and saves it again itself, so nothing but the picture is kept even if a photo reaches it without passing through that step.

It is stored in the committee's Google Drive, in a folder of profile photos, under a file name made from your account number rather than your name or email. Photos saved since 28 September 2026 are not shared by link at all: this site's server reads them through Google's API and serves them itself, so a page showing one makes no request from your browser to Google. Photos saved before that date are still shared as anyone-with-the-link and named after the account's email address; the committee is moving them to the new arrangement.

A photo shown on the site has a fixed address under /photo/, and anyone who has that address can load that one picture. It is shown next to your name wherever the site ranks students. You can replace it at any time from your console, and the old one is binned. An organiser can take a photo down if it should not be shown, and you are then asked for another.

Everyone with something on their record can be named on the signed-in standouts list, and each name opens a page listing what their records are: the kind, the title, how far it reached, the place, when it was and who ran it. Certificates and other files, Drive links, prize money, stipends and contact details are never on that page.

When CESAC gives you a certificate (for a place on the board or for winning an event), it carries a QR code and an ID such as CESAC-2026-00001: CESAC, the year and a serial number. Both open a page at www.cesac.in/c/ followed by that ID, so that whoever you show it to can check that CESAC issued it.

That page is public to anyone who has the ID: it shows your name, your class or college, the award, the event, the date it was issued and the certificate itself as it was printed, and whether it still stands. Nothing else about you is on it, and it is kept out of search engines. Because the IDs are serial numbers, anyone can try the next number along, so treat what a certificate says as public once it is issued.

The site counts how many times each certificate's page is opened, without recording who opened it, so the committee can see that a certificate is being checked. If a certificate was issued by mistake, the committee withdraws it rather than deleting it, and its page then says so, with the reason.

Your console lets you file records of what you have done: events, hackathons, papers, internships, courses and similar. Each record holds what the form asks for (a title, a level, dates, a place or prize where one applies, and the fields for that kind of record) and at least one file, a certificate, a PDF or a photo, up to 4MB each.

Files are checked when they arrive. Only PDF, JPG and PNG files are accepted, judged by their contents rather than their name, and a PDF carrying scripts or attachments is refused. They are stored in a folder of your own in the committee's Google Drive and are not shared publicly.

A record, and its files, can be seen by you, by the organisers of the committee who look after records, and by the faculty member who checks records for your class. A checker can mark a record verified or not, and nothing else. Nobody can verify their own record.

Verified records count towards the department's ranking and the signed-in standouts list, where your name, year, photo and a list of what your records are appear. Files, links, prize money, stipends and contact details never appear there.

You can edit or delete a record until it has been verified. After that it is part of the department's file, and a correction or removal goes through the questions page.

A question you ask from your console is stored with your account and can be read by you, by the organisers, and by the faculty member who checks records for your class, who can answer it.

Announcements are written by the committee and published on the site for everyone. They hold nothing about you.

Every committee member has a page under /people. What is on it is what they wrote on the committee's own roster form, where each of them agreed to it being shown on this site: a line about themselves, an about, their interests and the links they chose to give. The form also asked for a phone number and an email address, and neither is published here.

A committee member's portrait is either a Google Drive file they shared, or the photo on their own account. Either way it is fetched by this site's server and served from this site, so opening a profile page makes no request from your browser to Google or anyone else.

The faculty pages carry what the Institute publishes about them on its own faculty profiles: designation, qualifications, experience, responsibilities, publications, patents, funded projects and training. A personal phone number or date of birth listed there is not copied here.

The committee also keeps a staff directory of names, designations, institute email addresses, phone numbers and the class each faculty member looks after, so that record checking can be assigned. It is readable only by organisers who manage people, and is never shown on a public page.

An organiser can edit their own page from My details in the console, and anyone else who wants something on their page changed or removed can ask the committee.

Events with a date carry an Add to calendar button. The .ics file it offers is made and served by this site. The Google Calendar option opens Google Calendar in a new tab with the event filled in, and that visit is covered by Google's privacy policy; nothing contacts Google until you choose it.

Making a team stores the team name, a join code, and which two accounts belong to it. If the captain fills in the optional partner name and partner email before their partner joins, those are stored too, as a note for the organisers.

Your team's details are visible to you, to your partner, and to CESAC organisers. They are not visible to other teams.

Once organisers publish the leaderboard, every signed-in participant can see every registered team's name and score. Until they publish it, each team sees only its own. Nothing about a team is visible to anyone signed out.

There is no payment gateway on this site and no checkout window. You pay the entry fee by scanning a UPI code with your own banking app, and that payment happens entirely between your app and the bank.

We never see, receive or store card numbers, UPI PINs, bank credentials or anything else you enter in your banking app. What reaches us is the transaction reference you choose to type in, so an organiser can match the payment against your entry.

If an organiser records a payment for you, we store what they type: the method, the reference and any note they add.

Entries for Attack on Token are collected on a form hosted by another company, not on this site. What you put into that form is held by them under their own privacy policy, and it reaches CESAC as a list of entries.

We ask for your name, your team name, a WhatsApp number, and your partner's name, plus a VIT email address for each of you. The email addresses are what let us check that both of you are students here.

Nothing you type into that form passes through this website, and this website sets no cookie on it.

What you hand in for each chapter is stored against your team: the text you write, and any files you upload.

Uploaded files are held in private storage. They are not public, they have no guessable address, and they cannot be listed or read by other teams. When an organiser opens one for grading, the link generated expires within the hour.

Hand-ins and scores are visible to your team and to organisers. Grading notes written by organisers are internal and are not shown to participants.

When an organiser or a checker verifies a record, answers a question, verifies a payment, opens or closes a chapter, sets a score, applies a cut, changes somebody's role, sets somebody's password or takes down a photo, that action is written to a log with their account and the time. A password an organiser sets is never written to that log or anywhere else; the log records only that one was set, and on whose account.

That record exists so a disputed decision on the day can be checked. It is visible only to organisers.

Your account and your student records are kept while you are a student of the department, because the department uses them for its own records of student activity. Team, payment and hand-in records for an event are kept while the event runs and for as long as the committee needs them to settle results, issue certificates and reconcile entry fees.

Sign-in attempt rows are deleted after about a day. The organisers' action log is kept for as long as the records it describes.

The committee has not yet fixed a date after graduation when accounts and records are deleted. Until it does, you can ask for yours to be removed at any time, and the answer will say what, if anything, the department has to keep and why.

The database provider keeps its own backups for a short period, so something deleted from the site can survive in a backup until that backup expires.

This site is aimed at students and staff of the Computer Engineering department and the wider institute. It is not directed at children.

Some students may be under 18 when their account is made. Indian law treats personal data about anyone under 18 as a child's data, which needs a parent's or guardian's consent. If you are under 18, tell the committee, and ask a parent or guardian to contact us if they have questions about your account. The committee is taking advice on how that consent should be collected.

If you have never signed in, the site holds nothing about you and there is nothing to export, correct or erase.

If you hold an account, you can see everything attached to it from your console: your name, email, PRN, class and phone number, your photo, your records and their files, your questions, your team, your payment state and your hand-ins.

You can correct most of it yourself from your console. For anything else, ask the Technical vertical to correct it, to give you a copy of what is held about you, or to delete your account. Deleting an account removes the profile and its records, and, if you made the team, the team and its hand-ins with it. Files in Drive are moved to its bin, which empties itself after thirty days.

You may also withdraw consent to anything that relies on it, and raise a grievance about how your data is handled, with the committee at the contact below. We aim to answer within a week. If you are not satisfied, you can complain to the Data Protection Board of India once it is accepting complaints.

If you believe something on this site is handling your data in a way this page does not describe, tell us and we will fix it.

If the site starts collecting anything new, this page is updated in the same change that introduces it, and the date at the top moves.

A committee inbox has not been published yet. The committee is reachable through the Computer Engineering department office at VIT Pune.

CESAC, Computer Engineering, Vishwakarma Institute of Technology, Pune.