Privacy policy

1. What we collect

• Account data: your name, email address and Google account identifier, received when you sign in with Google.
• Study profile: the department, year and session you optionally enter on your account page, used to nudge you about syllabus changes.
• Payment data: the bKash transaction ID (TrxID) you submit, the amount, the plan you chose and the approve/reject decision. We never see or store your bKash PIN, card details or wallet credentials.
• Access data: which subject access was granted, to which account, and until when.
• Usage data: aggregate, cookieless page-view statistics from Vercel Analytics, plus ordinary server logs from our host.

2. Why we use it

• To create your account and keep it secure.
• To verify your bKash payment and grant the access you paid for.
• To answer support requests and investigate payment problems.
• To understand which subjects and pages are useful, so we can improve them.
• To keep accurate payment and access records, and to resolve disputes.

3. Cookies and local storage

We do not use advertising cookies or cross-site tracking. If that ever changes, we will say so here before it happens.

• nu_guides_lang — remembers whether you chose Bangla or English, so the right version is served to you.
• Theme preference — stored in your browser's local storage so dark mode does not flash on load. It never leaves your device.
• Authentication session — set by Supabase so you stay signed in between visits.

4. Who processes your data

• Supabase — database and authentication hosting; your account, profile, payment request and access records live there.
• Vercel — application hosting and the cookieless analytics we use.
• Google — sign-in through OAuth; your Google account is governed by Google's own terms and privacy policy.
• bKash — the money transfer happens inside your own bKash app or USSD session, under bKash's terms. We only receive the transaction reference you send us; we do not receive your bKash credentials.

5. How long we keep it

Account and study-profile data stays while your account exists. Payment and access records are kept as long as needed to resolve disputes and keep accurate financial records.

If you ask us to delete your account, we remove your profile and personal data, keeping only the minimum payment record we are still required to hold.

6. Security

Traffic to the site is encrypted with TLS. The database enforces row-level security, so one student's records are never readable by another, and the privileged server key that can bypass those rules is used only in server-side code and admin tooling — never in the browser.

7. Your choices and rights

Use the contact details on our contact page. We respond within a reasonable period, normally within 30 days.

• Ask for a copy of the personal data we hold about you.
• Ask us to correct your name, email or study profile.
• Ask us to delete your account and personal data.
• Withdraw consent for anything not essential to the service.

8. Students under 18

NU Guide is meant for university students. If you are under 18, please use it with the involvement of a parent or guardian.

We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes to this policy

We may update this policy as the service changes. The “Last updated” date at the top of this page shows the current version.