Privacy

Pikachoo is built to keep students anonymous. Here's exactly what we collect, store, and don't.

What we collect

• Your email — temporarily. Used once to send the magic link and verify you're a Parul student. Hashed (SHA-256 with a secret pepper) and the raw value is removed from our app database after verification.
• Your handle. The anonymous name you pick. Public.
• Your posts, comments, votes, and reports. Linked to your account, not your real identity.
• Anonymous usage data. Pages viewed, errors, performance — never tied to your real identity.

What we don't collect

• Your real name.
• Your phone number.
• Your photos (unless you upload one to a post).
• Your location.
• Your raw IP address in our database.

Who can see your activity

• Other users: only your handle and what you publicly post.
• Moderators: can see reported content and ban accounts.
• Admins: have technical access to the database for debugging and abuse handling. Admins cannot link your handle to your real name.

Your rights

• Delete your account at any time from Settings → Danger Zone. Your handle and email hash are erased; your posts and comments are hidden.
• Export your data by emailing us (see Help).
• Block users to never see their content again.

Cookies

We use one cookie to keep you logged in. No advertising trackers, no third-party analytics that identify you.

Third parties

We use Supabase (database/auth), Vercel (hosting), and Cloudflare (CDN). They process data on our behalf and cannot identify you personally.

Security

HTTPS everywhere. Row-level security on every table. Service keys never reach the browser. We do our best, but no system is perfect.

Changes

We'll announce material changes in-app.