Privacy Policy

Last Updated: September 4, 2025

UniSelector is developed by Dilanga Prabath. UniSelector helps A/L students plan study time, track progress, view a meritboard/leaderboard, and access resources. This Privacy Policy explains what we collect, how we use it, and your choices—covering the new server-sync features (Supabase/Cloudflare R2) and Google Sign-In.

If you have questions, email uniselectorapp@gmail.com.

What we collect

We collect only what’s needed to provide core features. UniSelector is offline-first: most data is stored locally (AsyncStorage). When you sign in or when sync is available, selected data is securely stored in our backend (Supabase) so features like the MeritBoard, Connections, and backup/restore work.

1) Account & profile

• Username (required)
  
  

• Subjects (3) (required)
  
  

• District (required)

• profile photo (optional) → stored as an image in AsyncStorage
  
  

• Avatar photo (optional) → stored as an image in Cloudflare R2; only the URL is stored in your profile.
  
  

• Google Sign-In (optional but required for online features): when you sign in, we receive your Google user ID and email from Google to create/secure your account in Supabase. We don’t use your email for marketing.
  
  

2) Study & progress data

• Study hours, streaks,Study points (SP), weekly SP, MeritBoard rank.
  
  

• Connections graph (who you follow / who follows you) to power “Connections” & “Connectees”.
  
  

3) Order/commerce (if you use the feature)

• If you place an order via WhatsApp, your name, delivery address, and phone number are used only to fulfill the order via WhatsApp’s normal flow. We don’t store this in our database unless explicitly stated.
  
  

4) Subscription status (where available)

• If your plan uses carrier billing (Dialog Ideamart), your mobile number and subscription status are processed by Dialog’s official APIs. We keep only the status we need to enable premium features.
  
  

5) Device & diagnostics

• Basic device/app info (app version, timestamps, crash logs if enabled by platform) for reliability and fraud prevention.
  
  

• Supabase/Cloudflare may log IP addresses in standard security logs.
  
  

We do not request location, contacts, or other sensitive permissions. When you pick a profile photo, we ask for gallery access.

Where data lives

• On your device (AsyncStorage): username, subjects, district, recent study stats, cached counts (e.g., last Connections number), and other preferences—so UniSelector works offline.
  
  

• Supabase (database & auth): profile (username, subjects, district, avatar URL), study progress (SP, streaks, hours), meritboard view, and connections graph.
  
  

• Cloudflare R2 (object storage): the profile image file, accessible via a secure public URL (e.g., https://avatars.uniselectorapp.homes/...).
  
  

• Google: Google Sign-In handles your Google account authentication; we receive your Google user ID and email to authenticate/identify your account.
  
  

How we use data

• App functionality: create your account, show MeritBoard/Connections, sync progress, and restore across devices.
  
  

• Account management: sign-in/out, secure access, prevent abuse.
  
  

• Order fulfillment (when used): process orders you initiate via WhatsApp.
  
  

• Subscriptions (where enabled): verify subscription status to unlock premium features.
  
  

We do not sell your data. We share data only with service providers needed to run UniSelector (see below), under contract and only for the purposes described here.

Third-party services we use

• Supabase (Auth + Database): account creation, auth, and data sync (profiles, progress, connections).
  
  

• Cloudflare R2: stores your avatar image; the URL is kept in Supabase.
  
  

• Google (Google Sign-In): authenticates your account; we receive your Google user ID and email.
  
  

• WhatsApp (optional orders): you interact directly with WhatsApp; your number is visible per WhatsApp’s normal behavior.
  
  

• Dialog Ideamart (where carrier billing is available): processes mobile number and subscription status to enable premium features.
  
  

• Hosting/Infrastructure (e.g., AWS for backend components if applicable): subscription validation or utilities.
  
  

Each provider has its own privacy practices. We choose reputable vendors and use them only for the necessary functions.

Data security

• Encryption in transit (HTTPS/TLS) for data sent between the app and our services.
  
  

• Row-Level Security (RLS) in Supabase to isolate user data.
  
  

• Least-privilege access and server-side checks for write operations (e.g., avatar uploads via an Edge Function).
  
  

• We regularly review access and rotate keys.
  
  

No system can be 100% secure, but we work to protect your data using industry-standard measures.

Data retention

• On device: remains until you clear app storage or uninstall the app.
  
  

• Supabase/Cloudflare: kept while your account is active. If you request deletion, we delete your Supabase profile and related rows (progress, connections) and remove your Cloudflare R2 avatar within 30 days unless a longer period is required by law (e.g., fraud prevention logs).
  
  

• Logs (e.g., security logs) may persist briefly per provider policies.
  
  

Your choices & rights

• Use without sign-in: core planning remains available offline. Online features (MeritBoard, Connections) require sign-in.
  
  

• Access & correction: you can update username, subjects, district, and avatar inside the app.
  
  

• Delete profile photo: change/remove your avatar; we will clean up older avatar files.
  
  

• Account/data deletion: request deletion via email:
  
  

  • Email: uniselectorapp@gmail.com
    We will delete your Supabase profile + progress + connections and your Cloudflare avatar within 30 days and confirm when complete.
    
    

Terms and Conditions 

For detailed information about pricing, subscription duration, how to unsubscribe, and other service-related conditions, please refer to our Terms and Conditions page:
👉 https://sites.google.com/view/uniselector-termsandconditions/home 

Children’s privacy

UniSelector is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child provided data, contact us and we’ll delete it.

International data transfers

Our providers may process data in multiple regions (e.g., Supabase region you selected, Cloudflare global infrastructure, Google). By using UniSelector, you consent to processing outside your country where data protection laws may differ.

Contact

Questions or requests?
Email: uniselectorapp@gmail.com

We may update our Privacy Policy from time to time. Any changes will be posted on this page.