Privacy Policy & Student Data Protection Policy
This Privacy Policy governs the collection, processing, local storage, and absolute non-disclosure of digital personal data across Flunked.online under the Digital Personal Data Protection Act, 2023 (DPDP Act, Act No. 22 of 2023) and the Information Technology Act, 2000.
Flunked.online was created by university students who refuse to participate in the corporate surveillance web. We practice radical data minimization. We do not sell student emails, we run zero programmatic advertising networks, and we never report your attendance calculations to university deans, registrars, or proctorial boards. Every calculation variable—your missed class count, CGPA scores, offered salary breakdown, roommate bills, and panic index responses—is computed locally inside your browser's runtime memory. It is never transmitted to, inspected by, or stored in our backend databases.
1Legislative Scope & Data Fiduciary Mandate
This Privacy Policy establishes the statutory standards under which Flunked.online acts as a "Data Fiduciary" pursuant to Section 2(i) of the Digital Personal Data Protection Act, 2023 (DPDP Act, Act No. 22 of 2023). You, as the enrolled student or user accessing our services, are recognized as the "Data Principal" under Section 2(j) of the DPDP Act.
This Policy applies to all digital personal data processed in connection with any service, interactive calculator, quiz, or feature hosted on the domain flunked.online and its sub-domains. It is drafted in compliance with the DPDP Act 2023, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).
2Privacy by Design: Client-Side Memory Sandboxing
Flunked.online is architected from the ground up on the principle of Privacy by Design and Default. Unlike traditional corporate web applications that log every user interaction to backend analytical datastores, Flunked.online enforces strict Client-Side Memory Sandboxing.
When you slide the attendance percentage bar in the Bunk Calculator, type your mid-sem marks into the Semester Survival Check, paste your placement CTC offer, enter roommate expenses, or answer the Placement Quiz, the computations are evaluated entirely in your device's browser JavaScript runtime memory (DOM).
3Comprehensive Data Inventory & Classification
We categorize all information into three distinct technical tiers:
When you enter the campus hub, you provide your preferred name / nickname and college / campus name. This information is stored exclusively in your local browser's localStorage to personalize your interface and display your campus benchmark. We do not maintain a user database, and no passwords or email addresses are ever required.
Calculated variables—including attended lectures, bunk numbers, semester marks, credits, CTC packages, base salary, EPF allocations, hostel roommate expense logs, and quiz selections—are never collected or uploaded. Flunked.online possesses zero copies or logs of these personal values.
Like any secure web infrastructure, our hosting edge servers ephemerally receive standard HTTP request headers—including your IP address, browser User-Agent, device type, and referring URL—strictly for socket transmission, rate-limiting, and volumetric DDoS defense. IP logs are automatically rotated and purged.
When you submit a tool suggestion, your selected tool category, college/university name, optional student name (which automatically defaults to "Anonymous" if omitted), and idea description are forwarded to Google Sheets (Google is the data processor) using a secure server-to-server webhook. To prevent denial-of-service abuse, your IP address is salted with a secret key, hashed with HMAC-SHA256, and stored temporarily in Upstash Redis for 10 minutes before expiring. No accounts or persistent user profiles are created.
4Lawful Grounds for Processing (DPDP Act 2023)
Under Section 4 and Section 7 of the DPDP Act, 2023, Flunked.online collects zero email addresses or institutional credentials, processing technical connection data and voluntary user inputs solely on the following lawful statutory grounds:
- Specified Purpose Consent (Section 6): By entering your student name and campus name to access calculator utilities, you authorize purely local browser persistence to establish your active session.
- Legitimate Uses & Security Compliance (Section 7): Processing technical connection logs to prevent denial-of-service cyber incidents, enforce rate limits, and block automated scrapers.
We do NOT process student personal data for any purpose incompatible with the specific academic utility requested by you.
5Absolute Non-Disclosure & Non-Monetization Manifesto
- Zero Institutional Reporting: Flunked.online will NEVER disclose, furnish, or transmit your name, campus affiliation, attendance numbers, or calculation history to any college administration, Dean of Academic Affairs, Head of Department (HOD), Proctorial Board, or university registrar.
- Zero Data Commercialization: We do NOT sell, lease, rent, trade, or monetize student names, campus affiliations, placement readiness quiz benchmarks, or salary estimations to ed-tech corporations, student loan aggregators, coaching classes, or recruitment agencies.
- Zero Surveillance Advertising: We load zero Meta Pixels, zero Google Tag Manager ad trackers, zero TikTok beacons, zero LinkedIn Insight tags, and zero behavioral retargeting scripts.
6Local Browser Storage & State Mechanics
To provide a seamless, non-invasive experience, Flunked.online utilizes standard W3C HTML5 Web Storage (localStorage) directly inside your browser rather than tracking cookies.
| Storage Key | Mechanism | Purpose | Lifespan |
|---|---|---|---|
| flunked_user | localStorage | Persists student name/nickname, campus name, and session timestamp. | Until user resets profile |
| flunked_tutorial_completed | localStorage | Remembers whether onboarding guide was completed or dismissed. | Persistent |
For detailed technical configurations and browser-by-browser clearing instructions, see our Cookie & Local Storage Policy.
7Data Retention Protocols & Instant Session Erasure
In accordance with Section 8(7) of the DPDP Act 2023, personal data must be erased as soon as the specified purpose for which it was processed is no longer being served.
When you click "Reset Profile" in the profile dropdown, Flunked.online executes an immediate programmatic purge of the flunked_user payload from your browser's local storage, severing all session data.
Queries typed into the navbar search box and Command Palette are filtered strictly within local JavaScript memory and are never transmitted to any analytics service or server datastore.
8Cryptographic Safeguards & Infrastructure Security
In fulfillment of Section 8(5) of the DPDP Act and Rule 8 of the Information Technology SPDI Rules 2011, Flunked.online implements reasonable security practices and procedures:
- Transport Layer Security: All client-server transmissions are strictly enforced over TLS 1.3 encryption with HTTP Strict Transport Security (HSTS) headers;
- Secure Headers & Content Security: We deploy strict Content-Security-Policy (CSP), X-Frame-Options (DENY), and X-Content-Type-Options (nosniff) headers to prevent cross-site scripting (XSS) and clickjacking attacks;
- No Password Datastores: We do not store student passwords, eliminating the risk of credential database leaks.
9Data Principal Rights under Chapter III (DPDP Act 2023)
As a student Data Principal under Chapter III of the DPDP Act, 2023, you are vested with specific statutory rights regarding your digital personal data:
You have the right to request a confirmation and summary of personal data held, identities of any service processors, and categories of processing.
You have full autonomy to update or clear your stored name and campus at any time directly through the client-side profile menu without submitting administrative requests.
For any privacy or data rights inquiries under the DPDP Act, contact our designated desk at privacy@flunked.online.
10Protection of Students & Minors under Section 9
Section 9 of the DPDP Act, 2023 prescribes specific obligations regarding the personal data of children (individuals under eighteen years of age). While Flunked.online is targeted primarily at university students who have completed secondary school, we strictly abide by the following protective mandates:
- We do NOT engage in behavioral monitoring, psychological profiling, or targeted advertising directed at any user;
- We do NOT process personal data in any manner likely to cause detrimental effects to the well-being or physical safety of young students;
- Calculators remain strictly neutral mathematical tools devoid of manipulative gamification algorithms.
11Data Locality & Cross-Border Transfer Boundaries
Flunked.online prioritizes Indian domestic cloud edge infrastructure. Any operational transmission of technical telemetry complies with Section 16 of the DPDP Act, 2023. We do NOT transfer student personal data to any foreign country or territory blacklisted or restricted by the Central Government of India.
12Data Protection Officer & Grievance Redressal (DPBI)
In compliance with Section 13 of the DPDP Act, 2023 and Rule 3(2) of the Information Technology Rules, 2021, Flunked.online has designated a Nodal Data Protection & Grievance Officer:
If you are not satisfied with the resolution provided by our Grievance Officer within 30 days, you retain the statutory right under Section 13(4) of the DPDP Act to file a complaint before the Data Protection Board of India (DPBI).