PrivacyPolicy

This Privacy Policy describes what personal information Career Catalyst Club (“CCC,” “we,” “us”) collects through careercatalystclub.in (“the Site”), why we collect it, and who can access it. We collect only what the Site needs to run club operations — account access, event registration, and member communication — and nothing more.

Account information. When you sign up, we store your full name, email address, and a hashed password (or, if you sign in with Google, the profile information Google shares with us — typically your name and email). Your profile can optionally include department, year, and phone number if you choose to add them.

Event registrations. When you register for an event, we record which event, your account, a status (confirmed, waitlisted, cancelled, attended, or no-show), and the registration timestamp.

Contact form submissions. If you use the contact form, we store your name, email, subject, message, and category so we can respond. Submissions are rate limited using a salted, one-way hash of your IP address — we do not store your raw IP address alongside your message.

Event photos. Photos from club events may be uploaded to the public gallery. Any images you submit through the admin upload flow are re-encoded server-side (metadata stripped, dimensions and file size validated) before publishing.

Role and audit records. For members with administrative permissions, we record which roles are assigned and a database-generated audit trail of privileged actions (for example, publishing an event or changing a registration status). Audit entries record the action taken and a general actor label, not free-form personal data.

• To create and secure your account and let you log in;
• To process event registrations and let you manage your own registrations;
• To respond to messages you send through the contact form;
• To display event photography in the public gallery as part of documenting club activities;
• To maintain an internal audit trail of administrative actions for accountability and security; and
• To keep the Site secure and prevent abuse.

Your account details are visible to you and to club administrators whose role grants the relevant permission — for example, only administrators with a “manage registrations” permission can see the registrant list for an event, and contact messages are visible only to administrators with a “manage messages” permission. These permissions are enforced at the database level, not just in the app you see, so they can’t be bypassed by calling our backend directly.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

The Site is built on infrastructure operated by:

• Supabase — hosts our database, authentication, and file storage. Supabase processes your account data, registrations, messages, and uploaded photos on our behalf, under their own security and privacy practices.
• Google — if you choose “Continue with Google” to sign in, Google authenticates you and shares your name and email with us via OAuth. We never see your Google password.
• Cloudflare Turnstile — a privacy-preserving challenge shown on sensitive forms (like login and signup) to distinguish real visitors from automated bots, without tracking you across other sites.
• Vercel — hosts the Site and collects anonymized, aggregate performance metrics (like page load times) through Speed Insights. This does not identify you individually.

The Site uses a small number of strictly necessary cookies set by Supabase Auth to keep you signed in between visits (HttpOnly, secure in production). A short-lived cookie is also set during password-reset to confirm you followed a valid reset link. We do not use advertising or cross-site tracking cookies.

We keep account and registration data for as long as your account is active, so you can see your own registration history. If you ask us to delete your account, an administrator can permanently remove your auth record and associated profile; some minimal audit entries about actions taken on the account may be retained for security accountability, with the personal identifier removed where the underlying action doesn’t require it.

You can, at any time:

• Review and update your profile information from your account dashboard;
• Ask us to delete your account and associated personal data by emailing catalystclubcareer@gmail.com;
• Ask us to remove a specific photo of you from the public gallery;
• Unregister from an event you previously registered for.

We use row-level security policies and permission-checked database functions so that even a compromised or misused API key can’t read or change more than the calling user is authorized to. Uploaded images are validated and re-encoded server-side before publishing. No system is perfectly secure, but we treat security issues seriously — if you believe you’ve found a vulnerability, please report it responsibly to catalystclubcareer@gmail.com rather than exploiting it.

The Site is intended for GITM students, who are generally college-age and older. We do not knowingly collect information from children under 13.

We may update this Privacy Policy as the Site evolves. Material changes will update the “last updated” date below. We encourage you to review this page periodically.

Questions about this Privacy Policy, or requests about your data, can be sent to catalystclubcareer@gmail.com or through the Contact page. See also our Terms of Service.