Privacy Policy

The short version

• We collect what the product needs to work — an account, your progress, and payment details you submit yourself.
• We do not sell your data, and we run no advertising or third-party tracking. There is no analytics script on this site.
• We never see your bKash PIN, and we hold no card details.
• You can delete your account, and everything in it, yourself.

What we collect

To have an account

• Your name and email address
• Your password, stored only as a cryptographic hash — we cannot read it, and neither can anyone who obtains the database
• If you sign in with Google: your Google account email, name and profile picture
• Whether your email is verified

What you tell us at onboarding

• Your class or grade, and your school or college
• Your phone number — optional, and only useful if we need to reach you about a payment
• Optionally: a short bio, country, timezone, preferred language and subjects

We deliberately do notask for your home address, date of birth, or national ID. The product has no shipping and no in-person events, so holding a minor's address would be a liability with no purpose behind it.

What you generate by using it

• Your answers, which questions you attempted and whether you got them right
• Lessons opened and completed, practice sessions, bookmarks
• XP, level, streak, badges, contest entries, results and rating

Payments

• The bKash number you send from, the transaction ID, the amount, and the plan
• Whether we approved or rejected it, and any note we wrote you

That is the whole of it. The payment happens inside bKash, not here — we never receive your PIN and we do not process cards.

Security and session records

• Sign-ins, sign-outs, password changes, email changes and similar security events, with the time and IP address
• For each active session: the device and browser it came from, and its IP address
• A random device identifier stored in a cookie — it identifies a browser, not a person, and exists so that signing in on your phone does not silently end the session on your laptop

We keep these because you need them: the Sessions tab in Settings is what lets you spot someone else in your account and throw them out.

Cookies

We set two cookies, both necessary, neither used for tracking or advertising:

• Session cookie — keeps you signed in. Without it you would log in on every page.
• Device cookie (oa_device) — a random value identifying this browser, so the session list means something. It is httpOnly, so no page script can read it.

Your theme choice is stored in your browser's local storage and never sent to us. There is no advertising cookie, no tracking pixel, and no third-party analytics on this site.

Why we are allowed to hold it

• To provide the service you asked for — your account, your progress, your subscription.
• Because we have to — payment records are kept for accounting and dispute handling.
• Because we have a legitimate interest — security logs and rate-limit counters, which exist to protect your account and the platform.

Who else can see it

We use a small number of processors. Each gets only what it needs to do its job:

• Supabase — hosts the database and uploaded files. It holds everything listed above.
• Vercel — hosts and serves the application, and processes requests as they pass through.
• Resend — sends our email. It receives your email address and the contents of messages we send you.
• Google — only if you choose to sign in with Google, and only then.

We do not sell your personal data, and we do not share it with advertisers. We would disclose it if the law required us to, and we would tell you unless we were forbidden from doing so.

What other users can see

This matters more than most privacy policies admit, so here it is plainly.

Visible to other students: your name, your XP, level and streak, your rank on the leaderboards, any title you equip, your contest results, and your entries in the public submissions feed (which shows your name, the problem, and whether you got it right).

Not visible to anyone else: your email address, phone number, school, class, your answers themselves, your bookmarks, and everything about your payments.

If you would rather not appear on the leaderboards at all, write to us and we will exclude your account — the mechanism exists and takes a moment.

Children

You must be at least 13to have an account. Most of our users are school students and many are minors, which is exactly why we collect as little as we do and why the phone number is optional. If you are a parent or guardian and want to see, correct or delete your child's data, write to us and we will help.

How long we keep it

• Your account data, for as long as your account exists
• Security and sign-in logs, for up to 12 months
• Payment records, for as long as accounting rules require, even after an account is deleted
• Rate-limit counters, for about a day

Deleting your account

Settings → Account → Delete account. It is immediate and permanent, and it removes your profile, your answers, your progress, your XP, your contest results and your subscription record. We keep only what accounting rules require us to keep about payments, and an anonymous note that an account was deleted.

You may need to sign in again first — for anything this destructive we require a recent sign-in, so that someone at a borrowed laptop cannot delete your account.

Your other rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Most of this you can do yourself in Settings, including exporting your analytics. For anything else, write to contact@olympiadarena.com and we will respond within 30 days.

Security

Passwords are hashed. Traffic is encrypted in transit. Access to the production database is limited. Sensitive actions require a recent sign-in, and signing in on a device ends that device's previous session. No system is perfectly secure — if we ever suffer a breach affecting your data, we will tell you.

Changes

If we change this policy in a way that affects you, we will tell you in the app or by email before it takes effect. The date at the top always reflects the last substantive change.

Contact

Olympiad Arena, Bangladesh — contact@olympiadarena.com. Our Terms of Service cover the rest of the relationship.