Privacy Policy

At React Aligarh, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you join our community, access our platform, or participate in any of our activities. It is governed by the Digital Personal Data Protection Act 2023 (DPDP Act), the IT Act 2000, and the IT Rules 2021/2025.

By using React Aligarh's website or platform, you agree to the collection and use of information in accordance with this policy.

React Aligarh is a community initiative. For legal and data protection purposes, the platform is operated by Geeta Systems, Aligarh, Uttar Pradesh, India.

• Platform: React Aligarh (https://reactaligarh.com)
• Legal operator: Geeta Systems, Aligarh, Uttar Pradesh, India
• Data and legal matters: legal@reactaligarh.com
• Grievance Officer: Harsh Yadav, legal@reactaligarh.com, response within 48 hours, resolution within 30 days

This disclosure is required under Section 5 of the DPDP Act 2023 and Rule 3 of the DPDP Rules 2025.

This Privacy Policy applies to every person who visits, registers, or participates in React Aligarh, including school students, college students, working professionals, and mentors. React Aligarh is open to students at all levels of education.

4.1 Account Registration (all users)

• Full name and email address
• Password (bcrypt-hashed never stored in plain text)
• Username (chosen by you)

4.2 Social Login GitHub, LinkedIn OAuth

When you log in using GitHub and LinkedIn, we receive and store the following from your provider:

• Provider user ID (internal identifier)
• Username or handle from the provider
• Profile avatar URL
• Email address linked to that account
• OAuth access token (stored encrypted used only to maintain your login session)

We do not access your repositories, private messages, contacts, or any data beyond what is listed above.

4.3 Participant Enrollment Form

When you enroll as a Participant (before joining the 30-day roadmap), we collect:

• Full name, email address, and phone number
• City and state of residence
• Organisation or institution name
• Field of study or work, and current role
• Primary domain of interest and secondary interests
• Skills (self-reported)
• Community goals, learning goals, showcase interest, volunteer interest, and community expectations

Phone number, city, and organisation are used solely for community management and are never shown on your public profile.

4.4 Device Fingerprint: Assessment Anti-Cheat

To maintain the integrity of the assessment system and prevent cheating, we collect a device fingerprint at two points: account signup and roadmap enrollment. This fingerprint is a SHA-256 hash computed from the following signals:

• Browser user agent string and language settings
• Screen dimensions, colour depth, and timezone
• Hardware concurrency (CPU core count) and device memory
• Maximum touch points
• Canvas rendering fingerprint (if not blocked by browser privacy settings)

We also store: a persistent client-generated device UUID, IP address at time of capture, and raw user agent string. The fingerprint is stored as a one-way hash and used exclusively to detect multiple accounts or assessment fraud never for advertising or profiling.

4.5 Platform Usage Data

• Pages visited, time spent, and feature interactions
• Assessment session data (questions, scores, timestamps)
• Roadmap progress and checkpoint completions
• Project submissions and associated metadata
• Support tickets and help center interactions

We use the information we collect solely for the following specific purposes (as required by Section 4 of the DPDP Act 2023):

Account and Platform Operations

• Creating and managing your account and public profile
• Authenticating your identity across sessions
• Delivering the 30-day roadmap, assessments, and project workspace
• Displaying your public proof-of-work profile (name, username, skills, projects)
• Awarding badges and tracking membership status

Assessment Integrity

• Device fingerprint and session data are used exclusively to detect and prevent cheating and multiple account abuse
• This data is never used for advertising, profiling, or any purpose outside assessment security

Mentorship

• Your mentor sees your public profile (name, username, skills) and the specific project you are assigned to work on together
• Mentors do not have access to your phone number, city, enrollment form responses, or device fingerprint

Community and Communications

• Sending marketing communications about other Geeta Systems platforms or ecosystem events only with your explicit consent, and only if you have opted in from your notification preferences.
• Community announcements and platform updates
• Showcasing your public projects and profile to the broader community

We respect your privacy and will never sell your personal information. We share your information only in the following circumstances:

Public Profile (your choice)

• Visible to anyone: name, username, avatar, skills, approved projects, badges
• Never public: phone number, city, organisation, enrollment form responses, device fingerprint

Mentors

• Your assigned mentor sees your public profile and the project you are working on together nothing else

Service Providers (Data Processors)

• Email delivery: Brevo (Sendinblue) transactional emails only
• Push notifications: Custom Build
• Cloud hosting and database: MongoDB Atlas (encrypted at rest)
• Search: Custom Build
• Image CDN: Cloudflare R2 or ImageKit

Legal Disclosure

• We may disclose data if required by a lawful court order, the Data Protection Board of India, or another competent authority under the IT Act or DPDP Act

Geeta Systems Ecosystem: Cross-Platform Data Sharing

React Aligarh is part of the Geeta Systems family of platforms, which currently includes BtoE (btoe.in), VyomRachna, and others that will launch in the future. We may share data within this ecosystem in the following ways:

• Single Sign-On (SSO): In the future, you will be able to log in to any Geeta Systems platform using one account, 'Continue with Geeta Systems'. When you use this, your name, email, username, and avatar are shared with the platform you are logging into. This is opt-in you must choose to connect.
• Cross-platform account linking: You may choose to link your React Aligarh account with other Geeta Systems platforms (e.g., BtoE, VyomRachna). When you do, basic profile data (name, email, RA username) is shared between the linked platforms.
• Marketing communications: With your explicit consent, Geeta Systems may send you updates about other platforms or initiatives within the ecosystem. You can withdraw this consent at any time from your notification preferences.
• Aggregate analytics: Non-personal, anonymised usage data may be shared across Geeta Systems platforms to understand ecosystem-wide trends. No individual is identifiable from this data.
• Future platforms: As new Geeta Systems platforms launch, the same principles apply sharing only happens with your explicit opt-in action, and only the minimum data necessary is shared.

We retain personal data only for as long as necessary for the stated purpose or as required by law:

• Account data: retained while your account is active and for 3 years after deletion (legal compliance)
• Device fingerprint: retained until account deletion (planned: auto-delete on Member status in development)
• OAuth access tokens: retained while your account is active; deleted on account deletion or token revocation
• Enrollment form data: retained while your account is active
• Assessment session data: duration of membership + 1 year
• Support tickets: 2 years from ticket closure
• Audit logs: 1 year (auto-deleted via TTL index)
• Notification logs: 90 days (auto-deleted via TTL index)
• Sentiment survey responses: 2 years (auto-deleted via TTL index)

On account deletion, personal data is anonymised or deleted within 30 days, except where legal retention is required.

• Passwords: bcrypt-hashed with salt never stored in plain text
• Authentication: cookie-based JWT with httpOnly flag never exposed in JavaScript
• Transport: TLS 1.2+ enforced on all connections
• Database: MongoDB with access controls and encryption at rest
• OAuth access tokens: stored encrypted
• Device fingerprint: stored as one-way SHA-256 hash cannot be reversed
• Rate limiting: Redis-backed limits on all sensitive endpoints
• Access to personal data restricted to authorised team members only

Under Chapter III of the DPDP Act 2023, you have the following rights as a Data Principal:

• Right to access: request a summary of personal data we hold about you and how it is being processed
• Right to correction: request correction of inaccurate or incomplete information
• Right to erasure (Right to be Forgotten): request deletion of your personal data, subject to legal retention requirements
• Right to grievance redressal: raise a complaint with our Grievance Officer (legal@reactaligarh.com)
• Right to nominate: nominate a person to exercise your rights in the event of your death or incapacity
• Right to withdraw consent: withdraw consent at any time this does not affect prior lawful processing
• Right to lodge a complaint with the Data Protection Board of India if you believe your rights have been violated

To exercise any of these rights, contact us at legal@reactaligarh.com with your registered email address. We will respond within 30 days.

Types of cookies we use:

• Essential cookies: authentication session (httpOnly cookie) required for login, cannot be disabled
• Preference cookies: UI settings and display preferences
• Analytics cookies: anonymised usage data to understand platform usage

We do not use advertising cookies or cross-site tracking cookies. You can disable non-essential cookies through your browser settings this may affect certain platform functionality.

React Aligarh is open to students of all levels including school students. Under the DPDP Act 2023, processing data of persons under 18 requires verifiable parental consent.

• Under 13: do not register. If we discover an account belonging to a child under 13, we will delete it immediately
• Ages 13–17: a parent or legal guardian must review this policy and provide consent before registration
• Parents or guardians who believe their child has submitted data without consent should contact legal@reactaligarh.com immediately

• Our platform may contain links to third-party websites such as GitHub, Discord, LinkedIn, and YouTube
• We are not responsible for the privacy practices or content of any external sites
• Clicking third-party links means you are subject to their respective privacy policies
• Presence of a third-party link does not constitute an endorsement

• Material changes will be notified to registered users via email and in-app notification at least 14 days before taking effect
• The effective date at the top of this page always reflects the latest revision
• Continued use of the platform after changes are published constitutes acceptance
• If you disagree with the updated policy, you may request account deletion by contacting us

We aim to respond to all privacy-related queries within 30 days as required under the DPDP Act 2023.