Privacy Policy

Who we are

Dhaka College Information & Technology Club (DCITC) is a student technology club at Dhaka College in Dhaka, Bangladesh. This website is the club's public home and the place where members manage their accounts.

For any question about this policy, write to dhakacollegeitclubofficial@gmail.com.

The short version

Information you give us

• Creating an account. Your name, email address, HSC batch, and a password. The password is stored only as a one-way hash, so nobody at the club can read it.
• Signing in with Google. If you choose Google sign-in, Google tells us your email address, your display name, and an identifier for your Google account. We use the email to match you to an existing account. We never receive your Google password.
• Signing up or resetting a password. We email a six-digit code to confirm the address belongs to you. The code expires after ten minutes and can only be used a limited number of times.
• Recovering a forgotten email. If you cannot remember which address you registered with, you can enter your name and HSC batch. We then email a reminder to the address on that account; the address is never shown in the browser.
• The contact form. Your name, email address, and the message you write. It is sent to the club by email and is not stored as a list of enquiries in the site database.
• The membership form. Enrolment opens a form in a new tab that is hosted outside this site. Whatever you enter there is handled by that form and its provider, not by us. This site shows the annual fee the club sets but does not process payments.

Information created automatically

• Cookies. Three cookies, all httpOnly and SameSite=Lax, and marked Secure when the site runs over HTTPS: dcitc_at holds a signed-in member session for seven days, dcitc_admin holds an administrator session for seven days, and dcitc_oauth_state protects the Google sign-in round trip for five minutes. There are no advertising or analytics cookies.
• Security records. One-time codes are kept as hashes with an expiry time, an attempt count, and the moment they were used. These records are what let us refuse a reused or expired code.
• Rate limiting. Sign-in, sign-up, password reset, contact messages, and uploads are limited per network address. Sign-in, sign-up, and password reset also count the email address in the request, so repeated guessing against one account is slowed. Uploads are limited per administrator.
• Request logs. The API writes one line per request containing a random request ID, the method, the path, the response status, and how long it took. It does not record cookies, request bodies, or your network address in normal operation. A temporary diagnostic setting can add the address; it stays off unless an operator turns it on.
• No analytics or advertising. The site runs no third-party analytics, pixels, or advertising trackers, and we do not build profiles of visitors.

Public content about people

Leadership profiles, achievements, and intel articles are public, and they may name a person and show their role, batch, photograph, and links to social profiles. Club administrators publish that content. Uploaded images are served from public storage, so anyone with the link can view them.

If you appear in something published here and want it changed or removed, email us and we will handle it.

How we use information

• To create and run your account and keep you signed in.
• To confirm that an email address belongs to you.
• To answer messages sent through the contact form.
• To publish the club's leadership, achievements, and intel.
• To keep the site secure — refusing reused codes, limiting repeated attempts, and investigating abuse.
• To keep the club's own record of who holds an account.

We do not use your information for advertising, and we do not sell or rent it.

Who can access it

• You. Your own account details and membership card in the member dashboard.
• Club administrators. The admin console is for leadership, achievements, intel, and site settings. It does not list member accounts.
• Super administrators. Manage administrator accounts and read the audit log of admin activity.
• Technical maintainers. The people who operate the database, file storage, and servers have infrastructure-level access, limited to what their work requires.

Third parties

A few outside services make the site work. Each one only receives what its role requires.

• Google. Handles sign-in if you choose it, and supplies the map embedded in the contact section. When the map loads, Google may receive your network address and browser details under its own privacy policy.
• Supabase. Hosts the database that stores accounts and club content, and the storage that serves uploaded images.
• Our email provider. Delivers one-time codes, email-recovery messages, and contact-form notifications. Those messages pass through the provider to reach you or the club.
• Our hosting providers. Serve the website and the API, and therefore process requests made to them.
• The membership form. Hosted by whichever form service the club links to. Your submission there is governed by that service's own policy.

How we store and protect it

Passwords and one-time codes are stored as hashes rather than readable text. Sessions live in httpOnly cookies that page scripts cannot read, and connections use HTTPS in production. Access to the database and servers is limited to the people who need it.

No system is perfectly secure. If you think your account has been accessed by someone else, email us so we can help.

How long we keep it

Account information is kept for as long as the account exists. Security records are kept for as long as they are useful for protecting the site. Messages are kept for as long as needed to deal with them, and published content stays up until it is removed.

We do not publish fixed retention periods because how long a record is needed depends on what it is for. If you want to know about a particular record, ask us.

Members under 18

Many DCITC members are HSC students and may be under 18. If you are under 18, please make sure a parent or guardian knows about the account and agrees to it. If they would rather you did not have one, ask us to delete it.

Correcting or deleting your information

There is no self-service control for editing or deleting an account. Email dhakacollegeitclubofficial@gmail.com from the address on the account, tell us what you want changed or removed, and a club member will handle the request by hand and confirm back to you.

Changes to this policy

We may update this policy as the site changes. When we do, the “last updated” date at the top of this page changes with it. Please check back occasionally.

Contact us

Questions, corrections, and deletion requests all go to the same place: dhakacollegeitclubofficial@gmail.com. You can also write to the club at Dhaka College, Dhaka, Bangladesh.