Privacy Policy

IUian Alumni is a private platform for members of the alumni association to stay connected — a directory, chat, job board, events, funds tracking, and related tools. This policy explains what personal information the app and website collect, why, and what choices you have. It applies to the IUian Alumni Android and iOS apps and the associated website.

Account information

• Your name and Gmail address (used to sign in and to send verification codes).
• Your password, stored only as a salted bcrypt hash — never in plain text.
• Your session/batch and, optionally, your district.

Profile information you choose to add

• Phone number, LinkedIn URL, current status, occupation field, job title, company, years of experience, current institution, years spent abroad.
• A profile photo, if you upload one.

Content you create in the app

• Chat messages and any files you attach to them.
• Questions and answers, job posts, help requests, event details, meeting notes and decisions, donation/expense records, and committee assignments — where you add them.

Technical information

• Your IP address, processed transiently to rate-limit sign-in and sign-up attempts and protect the service from abuse. It is not used to build a profile of you.
• An authentication token, stored on your device in the operating system's secure storage (Keychain / Keystore) so you stay signed in.

The app does not contain advertising or third-party analytics SDKs. It does not collect your location, contacts, or microphone audio. The camera/photo permission is used only to let you pick a profile picture from your device.

• To create and secure your account and verify your email address.
• To let approved members find and contact each other through the directory and chat.
• To operate the features you use (jobs, events, help requests, funds, and so on).
• To send you transactional email — verification codes, password-reset links, and notifications about your account or activity relevant to you.
• To send association-wide announcements by email or SMS, when an administrator issues a broadcast.
• To protect the service from spam, brute-force attempts, and abuse.

Access to your account requires approval by an administrator or session coordinator before you can sign in.

We do not sell your personal information or share it for advertising. Your profile information is visible to other approved members of the association through the in-app directory, subject to any privacy settings on your profile. Contact details you add (phone, LinkedIn) are shown to other members only if you provide them.

We use a small number of service providers that process data on our behalf:

• Cloudflare R2 — stores uploaded images and files.
• Email (SMTP) provider — delivers verification codes, password resets, and notifications.
• SMS gateway — delivers broadcast text messages when an administrator sends one.
• Cloud hosting providers — run the application server and website.

We may also disclose information if required by law, or to protect the rights, safety, and security of the association and its members.

We keep your account and profile information for as long as your account is active. Content you posted (for example questions, job posts, or fund records) may remain in the app after your account is removed, shown as authored by a deleted user, so that shared history stays intact. Rate-limiting data derived from your IP address is discarded within minutes.

• All traffic between the app and our servers is encrypted with HTTPS.
• Passwords are hashed with bcrypt and are never stored or logged in plain text.
• Sign-in tokens are held in your device's secure storage.
• Sensitive actions are restricted to administrators and session coordinators.

• Access and correction: view and edit your profile at any time from the Profile screen.
• Deletion: request deletion of your account and associated data at any time from the Delete your account page, or ask an administrator to delete your account. We will delete your account and personal profile information.
• Communications: transactional emails are required to operate your account; association broadcasts are infrequent and sent only by administrators.

The app is intended for alumni and is not directed to children under 13. We do not knowingly collect personal information from children.

We may update this policy from time to time. Material changes will be reflected by a new "last updated" date on this page.

Questions about this policy or your data: gkibriu@gmail.com.