Privacy Policy
Photog · Last updated 4 August 2026
Photog is the official app of the BITS Pilani photography club. It is a private,
members-only app: sign-in is restricted to @pilani.bits-pilani.ac.in
accounts and there is no public registration. This policy explains what the app
collects, why, and what happens to it when you leave.
Who this policy is from
Photog is built and operated by the BITS Pilani photography club for its own members. It is not a commercial product. There is no advertising in the app, no analytics or tracking SDKs, and no data is ever sold.
What we collect
Everything below is collected because a specific feature needs it. Nothing is collected speculatively.
| Data | Required? | Why it exists |
|---|---|---|
| Email address | Required | Your account identity, provided by Google Sign-In. Also how coordinators grant you club access. |
| Name | Required | Provided by Google Sign-In. Shown on your profile and anywhere you appear in the club roster. |
| Phone number | Optional | So coordinators can reach you about an event you are shooting. You choose whether to add it. |
| Instagram handle | Optional | Displayed on your profile as a link. You choose whether to add it. |
| Photos you upload | Optional | Profile avatar, profile banner, portfolio shots, signature shot, event coverage previews, personal contributions, and fest showcase photos. |
| Bio and skill tags | Optional | Free-text bio and self-selected skills shown on your profile. |
| Push notification token | Required | A device identifier issued by the push service so the app can notify you about assignments, gear, and recruitment. |
| Notification history | Required | A record of notifications sent to you, so the in-app notification list works and you are not sent duplicates. |
| Recruitment application data | Optional | If you apply to join the club: your submissions (including any Google Drive links you provide), plus evaluator notes and scores recorded during the recruitment rounds. |
| Gear and coverage activity | Required | Which club camera gear you are currently holding and the transfer history, and which events you have claimed or shot. Tied to your identity by design — the whole point is knowing who has what and who is shooting what. |
How it is used
Only to make the app work. Specifically: managing your account and club role, coordinating event coverage, tracking who is holding which piece of club gear, running the annual recruitment cycle, and sending you notifications about those things.
Your data is not sold, rented, or shared with advertisers, data brokers, or any third party for their own purposes.
Service providers
The app runs on infrastructure operated by other companies. They process data on the club's behalf, under their own security and privacy terms, and are not permitted to use it for their own purposes. This is processing, not data sharing.
- Supabase — hosts the database and handles authentication. Your profile, roles, gear records, coverage records, recruitment data, and notification history are stored here.
- Cloudflare R2 — object storage for every image you upload.
- Expo — delivers push notifications. Your push token is passed to Expo's push service, which relays through Google's Firebase Cloud Messaging on Android and Apple's Push Notification service on iOS.
- Google — provides Sign-In. Google supplies your email and name to the app when you authenticate; the app does not receive your Google password at any point.
Security
- All data is transmitted over HTTPS. Nothing moves in plain text.
- Google Sign-In is the only way in. The app never sees, handles, or stores a password.
- Access is restricted at sign-in to
@pilani.bits-pilani.ac.inaddresses. - Database access is governed by row-level security rules, so members can only read and write the records their club role permits.
- Your login session is stored encrypted in your device's secure storage (Keychain on iOS, Keystore on Android).
No system is perfectly secure. This is a student-run club app, not a bank — please do not store anything in it that you would be seriously harmed by losing or exposing.
Your rights
You can view and edit your own profile data at any time from the app's profile screen — phone number, Instagram handle, bio, skill tags, and every photo you have uploaded.
You can delete your account and its data from inside the app: Settings → Delete Account. It takes effect immediately and cannot be undone.
If you cannot sign in — lost access to your institutional email, graduated, or the app is not working for you — use the account deletion request page instead.
What deletion actually does
Deleting your account is not a soft flag or a hidden archive. Your authentication record and member profile are erased from the database. Here is the precise split.
Permanently deleted
- Your login account and profile row — email, name, phone number, Instagram handle, bio, and skill tags.
- Your avatar, banner, portfolio shots, signature shot, and personal contribution images — both the database records and the underlying image files in storage.
- Your recruitment application and its submissions.
- Gear items you personally own that were listed in the app.
- Your push notification token and notification history.
- Your personal stats and milestones, and your assignment to any event as a shooter.
Retained, with your name removed
Some records belong to the club rather than to you individually. These survive so the club's history stays intact, but the link to your identity is severed — the record remains and your attribution is cleared:
- Event coverage and its preview photos — coverage belongs to the club, not to the individual shooter.
- Fest showcase gallery photos and gallery panels — curated club gallery content stays in the gallery, without a photographer credit.
- Club gear records and their transfer history — so the chain of custody for club equipment is not broken.
- Recruitment evaluations and notes you wrote about other applicants, and announcements you posted.
- Photo-of-the-week wins.
In each of these cases the underlying record no longer identifies you: the reference to your account is set to empty and cannot be traced back after deletion.
Data retention
Data is kept for as long as you have an account. There is no automatic expiry — a member who stays in the club keeps their profile and history. When you delete your account, the split above applies immediately. The club does not keep backup copies of deleted personal data for its own purposes, though infrastructure providers may retain routine system backups for a short period as part of normal operations.
Children
Photog is for enrolled students and alumni of BITS Pilani, Pilani campus. It is not directed at children and is not intended for anyone under 13.
Changes to this policy
If this policy changes materially, the "last updated" date above will change and the revised version will be published at this URL.
Contact
Questions about this policy, or about what the app holds on you: tejas.sajith@gmail.com