Our Privacy Commitment: CAX is built exclusively for university students. We believe campus communities should be spaces of trust. We never sell your student data, and we do not share it with external advertisers or recruiters. Students who verify with their institutional email are never asked for an ID card at all; where a student ID card is submitted (personal-email verification only), it is encrypted at rest and used strictly to confirm enrollment and detect fraudulent duplicate submissions.
1. Scope and Who We Are
This Privacy Policy describes how CAX (referred to as "CAX", "the Platform", "we", "us", or "our"), operated by CaxOne and developed by Rahul Thatipamula, collects, processes, stores, and protects your personal information. This policy applies to your access and use of the CAX mobile application, the CAX web platform, and the website caxone.in.
2. Information We Collect
To maintain a trusted, student-only platform, we collect two categories of information: information you provide to us directly, and information collected automatically.
A. User-Provided Information
- Email Address: We require an email address at signup. If it matches a registered university domain, your enrollment is verified automatically and no further documentation is needed.
- Student ID Card (Personal-Email Signups Only): If you sign up with a personal email address instead of your institutional one, you will be asked to upload an image of your student identification card and select your college so an administrator can manually confirm your enrollment. This step does not apply to users who verify via their university email.
- Profile Details: When you set up your profile, you may provide your name, profile picture, university major, year of study, and personal interests.
- User Content: We store the posts, comments, media, event RSVPs, club memberships, bookmarks, and game activity (such as Bingo and Arcade participation) that you create or engage with on the platform.
- Payment Information: For paid events, we process payments through Razorpay or via manually submitted UPI payment screenshots. We do not store your card, UPI PIN, or bank credentials — payment gateway processing is handled by our payment partner under their own security standards.
B. Automatically Collected Information
- Log & Usage Data: We collect details about how you interact with the app, including login times, pages viewed, and feature interactions.
- Device & Connection Information: We collect your IP address, device type, operating system version, and unique device identifiers to troubleshoot issues and maintain platform security.
3. Student Verification and Data Security
To ensure the platform remains secure and free of bots, scammers, and external recruiters, we conduct verification checks. How verification works depends on which email you sign up with:
- Institutional Email: If your email domain matches a college we have on file, you are verified automatically. No ID card or manual review is required.
- Personal Email: If you sign up with a personal email, you submit a photo of your student ID card and select your college. An administrator manually reviews and approves or rejects the submission.
- Encryption at Rest: Any uploaded student ID card image is encrypted (AES-GCM) before storage. It is never returned to client apps directly — administrators access it only through a short-lived, presigned view link for the sole purpose of confirming enrollment details.
- Retention for Fraud Prevention: ID card submissions are not deleted after review. We retain the encrypted image along with a cryptographic hash of it and an HMAC-hashed (never plaintext) student ID number, so that the same physical ID card or student ID number cannot be reused to create duplicate or fraudulent accounts across different email addresses.
- Annual Re-Verification: Manually verified accounts (personal-email signups) must re-verify once a year, on a common renewal date of July 19 (Asia/Kolkata). You get a 30-day grace period after that date with uninterrupted access before verification lapses and access is restricted until you resubmit.
- Unique CAX ID: Upon your first successful verification, a unique, short, random identifier (CAX ID) is generated to identify your verified status. This ID persists across subsequent re-verification cycles to maintain a consistent user profile while keeping storage data minimal.
4. How We Use Your Information
We process your information for the following specific purposes:
- Verification & Access Control: To confirm you are a verified, active student and restrict access to authorized members of your specific campus.
- Service Provision: To run the Campus Feed, populate the Clubs Directory, facilitate Event RSVPs, and manage campus digests.
- Platform Security: To detect, investigate, and prevent harassment, spam, bots, fraudulent accounts, and other violations of our Terms of Service.
- Communication: To send you essential system notifications, security updates, and newsletters (if you choose to subscribe).
5. Data Sharing and Disclosure
We value your trust and do not sell, rent, or trade your data to third parties. Your data is shared only in the following limited scenarios:
- With Your Peers: Your posts, profile details, club memberships, and event RSVPs are visible to other verified students from your university on the CAX platform. They are not indexed by public search engines and are not visible to the general public.
- With Essential Service Providers: We work with trusted infrastructure provider partners (such as database hostings and verification APIs) to host and secure the platform. These providers are bound by strict contractual obligations to use your data only to provide services to us.
- For Safety and Legal Compliance: We may disclose information if required to do so by law (e.g., a valid court order) or if we believe in good faith that disclosure is necessary to prevent immediate physical harm or protect student safety.
6. Your Rights and Controls
You have complete ownership of your data on CAX. You can exercise the following options:
- Access and Update: You can view and edit your profile details at any time within the app settings.
- Two-Factor Authentication: You can enable optional TOTP-based two-factor authentication in account settings for additional login security.
- Account Deletion: You can delete your CAX account through the app or by contacting us at rahulthatipamula97@gmail.com. Upon account deletion, your profile, verified status, posts, and comments will be permanently erased from our active databases. Backups are purged within 30 days.
- Newsletter Opt-Out: You can unsubscribe from our campus bulletins at any time using the "Unsubscribe" link in the emails.
7. Academic Records and FERPA
CAX is an independent student community platform. We have no official affiliation, integration, or connection with your university's administration or registrar. CAX does not access, collect, or store any official education records, grades, transcripts, financial aid details, or disciplinary files. We do not operate under the Family Educational Rights and Privacy Act (FERPA) as a university representative, but we respect the confidentiality of student status.
8. Children's Privacy
CAX is designed and restricted to university students who are at least 18 years of age or legally enrolled in higher education. We do not knowingly collect personal data from children under the age of 13.
9. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. When changes are made, we will notify you by updating the effective date at the top of this page and, if the changes are significant, sending a notification through the app or to your verified student email. A plain-language history of what changed and why is maintained on our Policy Updates page.
10. Contact Us
If you have any questions, feedback, or concerns regarding your privacy or data handling, please contact the developer:
Rahul Thatipamula
Email: rahulthatipamula97@gmail.com
Website: github.com/rahul-thatipamula