UnivBattles · Legal
Privacy Policy
Summary
- We collect your IIT email and a display name when you sign in, and your best score per event each season.
- Bests and settings for practice play stay in your browser. Meme Market keeps a virtual portfolio on our server.
- Microphone audio is analysed in real time on your device. It is never uploaded, and nothing we run stores it.
- We show no ads today and use no analytics or trackers. If we add ads, they may be chosen by your campus (the part of your email after the @), only for adults, and your email is never given to advertisers.
- You can delete your account and data at any time with the buttons below.
Your data controls
Delete your account: your email, name, season scores and sign-in sessions. You will be signed out.
Delete your Meme Market portfolio from our server, and the cookie that links this browser to it.
Delete every best score, setting and saved game kept in this browser for this site.
1. Who we are
UnivBattles (“we”, “us”) is an independent student project run by the UnivBattles team. For the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described here. Contact: contact@univbattles.me.
2. What we collect, where, and why
| Data | Where it is kept | Why | How long |
|---|---|---|---|
| Your IIT email address and a display name (taken from your email, or from your Google profile if you use Google sign-in) | Our server | To check you are an IIT student, keep you signed in, show you on leaderboards and contact you if you win | Until you delete your account, or 2 years after your last visit |
| Google account ID (only with Google sign-in) | Our server | To recognise you when you sign in again | As above |
Your campus, worked out from your email domain (for example iitb.ac.in means IIT Bombay) | Our server | Campus leaderboards and, once ads start, choosing ads for your campus (section 5) | As long as your account exists |
| Whether you confirmed you are 18 or older, and your ad choice (once ads start) | Our server | To decide whether you may see campus-based or personalised ads | As long as your account exists |
Sign-in session (olympics_session cookie) | Your browser; our server keeps only a one-way hash of it | To keep you signed in | 30 days, or until you sign out |
| Your best score per game per season and when it was set; for each run, when it started and finished and its score; your Meme Exchange portfolio value | Our server, linked to your account | To run the leaderboards (which show only the first three letters of your name), count runs, spot cheating and pick winners | Until you delete your account |
| Meme Market virtual portfolio: virtual cash, holdings, orders and trades | Our server, linked to a random ID | To run the shared paper-trading market | Until you delete it; deleted after 12 months without use |
| Anonymous trade flows: coin, time and size of each virtual trade, with no ID | Our server | To push shared prices by player activity | 6 hours |
| Practice bests and game settings | Your browser only (local storage) | To show your bests and remember choices | Until you delete them |
| Microphone audio (Scream Cat, Worst Singer Alive, Department Flight recording) | Memory in the open tab only | Pitch and loudness for gameplay, or replaying your own recorded word | Discarded continuously; never stored or uploaded |
| Technical request data: IP address, browser type and time | Our hosting provider | To deliver pages, limit abuse of sign-in, and keep the service secure | Up to 30 days in the host's logs |
| If you win: a record of the prize sent to you, and PAN if tax rules require it | Our records | To deliver the prize and keep any tax records the law requires | As long as tax law requires, then deleted |
We do not ask for your phone number, location or contacts during play, and we do not build a profile of your behaviour.
3. Why we are allowed to use it
We process your data with your consent, which you give by signing in after seeing this notice, and for uses the DPDP Act allows, such as meeting tax law when giving prizes. Campus-based and personalised ads, once they start, use a separate choice that you can turn off at any time without losing access to the games. You can withdraw consent at any time by deleting your account. Withdrawing does not affect processing that already happened.
4. Other services
- Sign-in emails. When you ask for a sign-in code, we send your email address and the code to our email provider, Brevo (Sendinblue SAS, France), which delivers the message under the Brevo Privacy Policy. Codes expire after 15 minutes; we keep only a scrambled (hashed) copy until then.
- Google sign-in, when it is turned on. Google confirms your email address to us and handles the sign-in under the Google Privacy Policy. We receive only your email, name and Google account ID.
- Browser speech voices. Department Flight uses your browser's built-in text-to-speech. Some browsers send the text to their maker's online service to create the voice.
- Our hosting provider runs the server and processes request data on our behalf.
- Ad networks, once ads start, as described in section 5.
We do not sell or rent personal data, and we never share your email, name or scores with advertisers (see section 5). We publish winners only by display name and campus unless the winner agrees to more.
5. Advertising
The site shows no ads today. We plan to add ads to cover hosting and prize costs. Before we do, we will update the date at the top of this policy and show a notice on the site. This is how they will work:
Where ads appear
Banners on start and end screens, a short video before some games, and optional “watch an ad to continue” offers in practice mode. Ads never affect prizes: prize play has no ad rewards.
Ads chosen by your campus
- We may choose ads for your campus using only the domain of your email (the part after the @, for example
iitd.ac.in). That lets us show, for example, a fest, club or business near your campus. - We never give your email address, name or scores to advertisers. An advertiser can only ask us to show their ad to a campus; they never learn who saw it.
- Campus ads are shown only to players who have confirmed they are 18 or older. The DPDP Act does not allow targeted advertising at children, so players under 18, or who have not confirmed their age, see only general ads.
- You can switch off campus-based ads in your account settings and still play everything.
Ad networks
- Ads may be served by an ad network such as Google AdSense. Ad networks and their partners use cookies and similar technology to show ads, limit how often you see the same ad, measure results and prevent fraud. They collect that data under their own privacy policies (how Google uses data for ads).
- Personalised ads (based on your activity on other sites) are used only for adults who agree to them. Everyone else gets non-personalised ads, which use cookies only for frequency limits, measurement and fraud prevention.
- Visitors from the European Economic Area, the UK or Switzerland will be asked for consent before any ad cookies are set.
- You can also manage Google ad personalisation at adssettings.google.com.
What ads never get
Ads never get microphone audio, recordings, imported media, your PAN or payment details. We do not sell personal data.
6. Age
Accounts are for IIT students. If you are under 18, please ask a parent or guardian before signing in; prizes are only for players aged 18 or over. We do not track or profile children, and we never show them targeted or personalised ads.
7. Security
Sign-in cookies are HttpOnly, SameSite and sent only over HTTPS, so page scripts and other sites cannot read them. The server stores a one-way hash of each session, not the session itself. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Rules require.
8. Where data is processed
Our server may run in India or abroad, depending on our hosting provider. Data processed outside India is handled only where Indian law permits.
9. Your rights
Under the DPDP Act you can ask what personal data we hold about you and how it is used, ask us to correct or erase it, withdraw consent, nominate someone to act for you, and have complaints resolved. The buttons above erase your data straight away. For anything else, email contact@univbattles.me.
10. Complaints
Email contact@univbattles.me. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
11. Changes
We will update the date at the top when this policy changes. If a change affects how we use existing data, we will show a notice on the site before it takes effect.