Privacy Policy

1. Who can use the Portal

Access is restricted to students with an @iimcal.ac.in or @email.iimcal.ac.in Google account, verified at sign-in.

2. What we collect

• From Google Sign-In: your name, email address, and profile photo.
• Profile details you enter: year, hostel, room number, contact (phone) number, bio, specialization, and tags.
• Activity on the Portal: cases you mark solved, approaches you post, upvotes, material downloads, Peer Practice availability slots you list, and booking requests you send or receive.
• Google Calendar (optional):if you click "Connect Google Calendar", we request permission to view and manage events on your calendar (the calendar.events scope) — nothing broader. We use this only to create an event when a Peer Practice request you own is accepted, and to remove it if the session is later cancelled. We do not read your existing calendar events, and we never request this permission as part of ordinary sign-in — it is a separate, opt-in step.

3. How we use it

Your profile and activity data are used to run the Case Library, Learning Materials, Peer Practice booking, and Dashboard features described on the Portal. Your contact number and hostel/room are shown to classmates so they can coordinate a practice session with you. We send email notifications for Peer Practice request/accept/decline/ cancel events, and offer optional WhatsApp "click-to-chat" links so you can message a practice partner directly — we do not read or store WhatsApp message content, and we never send automated WhatsApp messages on your behalf.

4. Where it's stored

Data is stored in a managed Postgres database (Supabase) with row-level access controls so students can only see what the Portal's features require. Emails are sent via Resend. A connected Google Calendar refresh token is stored in a separate, access- restricted table that is never exposed through the Portal's public API — only server-side booking-acceptance logic can use it, solely to create/delete the specific event tied to your booking.

5. Sharing

We do not sell or share your data with third parties for advertising or any purpose outside operating the Portal. Data is visible only to other signed-in students of the Consulting Club, as needed for the features above (e.g. your name and hostel appear in Peer Practice listings).

6. Your controls

• Edit or remove your profile details any time from your profile page.
• Disconnect Google Calendar access at any time from your Google Account's third-party access settings.
• Request full account deletion by emailing us (see below) — we will remove your profile and associated activity data.

7. Contact

Questions about this policy or your data: consultclub@iimcal.ac.in.