Policy Update History
A dated record of what changed in our Terms and Privacy Policy, and why
We update our Terms of Service and Privacy Policy whenever CAX's actual features or data practices change, so the published policy always reflects what the platform really does. This page is a plain-language history of those updates for reference — the documents above remain the binding legal text.
Verification, security, and payments overhaul
Backend authentication and student verification were substantially rebuilt. This update brought both legal documents in line with how the platform actually works:
- Verification is now two-tier. Students who sign up with their institutional (university-domain) email are verified automatically — no ID card is requested at all. Students signing up with a personal email now go through a manual review track: they submit a photo of their student ID card and select their college, and an administrator approves or rejects it.
- Corrected data retention claims. The previous policy stated uploaded ID card images were auto-deleted within 24 hours. That is no longer accurate: the encrypted image, an image hash, and a hashed (non-reversible) student ID number are now retained permanently to detect the same document being reused across multiple accounts and prevent fraud. This is a real change in how long the data is kept, not just wording.
- Renewal changed from every 6 months to once a year. Manually verified accounts previously had to re-verify every 180 days. Verification now expires annually on a fixed date (July 19, Asia/Kolkata), with a 30-day grace period of uninterrupted access afterward.
- Removed the "3 rejected attempts = permanent block" rule. This limit no longer exists in the system; users can resubmit corrected documentation after a rejection.
- Added optional two-factor authentication (TOTP) as an account security option.
- Documented event payment processing via Razorpay or manually submitted UPI screenshots, including that CAX never stores card, UPI PIN, or bank credentials.
- Broadened "User Content" language to explicitly cover newer platform features — bookmarks, and game activity such as Bingo and Arcade — that didn't exist when the policy was first written.
Initial publication
The first published versions of the CAX Terms of Service and Privacy Policy, covering student eligibility and email-domain verification, the original ID-card verification and 24-hour deletion process, code of conduct, content licensing, liability, and data rights.