Privacy Policy

This Privacy Policy applies to the FAST ISB Portal, also presented as FAST PORTAL ISB, including its website and its installable web application form (the "Portal"). Terms used in this Policy have the meanings given in the Terms & Conditions.

The Portal is operated by the individual or individuals who develop and maintain it (the "Portal Operator"), who can be contacted as stated in Section 14.

Many Services can be used without an Account. The information described in this Policy that relates to an Account is collected only when a User registers and uses Services that require an Account.

When a User registers, the Portal collects an email address, a password and a display name. A User may instead sign in with Google, in which case the information supplied by Google for sign-in, which may include a name and email address, is used to create the Account. Authentication is performed by the Supabase authentication service. Authentication session information is kept in the browser's local storage so that a User remains signed in.

A User may add a department, a profile photograph, a cover photograph and a short biography. Uploaded profile photographs are stored in a storage location that serves them by public web address.

The Portal stores a User's choice whether the User's name is shown to others and the User's choice of who may send Connection requests.

The Portal stores Connection requests, including the stated purpose, any message of up to 500 characters and whether the request was sent anonymously, together with Connections, private messages, their timestamps and read status, blocks and reports about Users or messages, including the category and any details provided.

The Portal stores Marketplace Listings, including title, category, condition, price, description, status, expiry date and up to six photographs, together with the listings a User has saved and any reports a User has made about a listing. Photographs are stored in a private storage area and are shown to Users through short-lived links.

The Portal stores Lost & Found reports, including whether the item was lost or found, the category, title, description, location, date and time, distinguishing details, the reporter's contact name, department and preferred contact method, any additional information, and up to three photographs.

The Portal stores Notices and, for approved publishers, the identity of the publishing Account. The identity of the publisher is retained privately and is not shown to other Users.

The Portal stores Jama'ah Sessions, including the prayer, duration, any note and its creation and end times, together with each participant's association with a session, a record of the version of the Jama'ah terms accepted, and the timing used to apply the creation cooldown.

A signed-in User's Custom Timetable, expressed as the lists of class offerings the User has added and removed for a department, is stored against the Account. Only stable offering identifiers are stored.

A signed-in User can save Semester Simulator plans. A saved plan consists of a name chosen by the User and the figures the User entered into the Simulator, such as course names and codes, credit hours, simulated grades, assessment marks and weights, a current CGPA and number of completed credit hours, and a target CGPA. Most of these figures are entered by the User. Course names, codes, credit hours and lab status can instead be taken from the User's timetable on the Portal, and a saved plan keeps a copy of them. The Portal does not read any of these figures from a transcript or other academic record. A saved plan is stored against the Account.

When a User enables Class Reminders or announcements, the Portal stores the push subscription issued by the User's browser, consisting of an endpoint and encryption keys, together with the User's selected batch, program, section, student type, repeat course selections, timetable customization and a record of the reminders sent. When a User turns on Notice alerts, the Portal also stores which notice types (Official, Verified or Community) the User chose, and a record that an alert was sent for a notice. This record does not contain an Account identifier. Disabling Class Reminders removes the stored subscription unless Notice alerts are still on, and turning off Notice alerts removes it unless Class Reminders are still on.

Standard technical information, such as an IP address, browser type and request details, is processed by the infrastructure and the Third-Party Services that deliver the Portal. Technical error information may be recorded to diagnose faults. Website usage statistics are collected through Umami Cloud, as described in Section 6.

The Portal uses information for the following purposes:

The Portal does not use personal information for personalized advertising of its own.

The following information may be visible to other persons:

The Portal does not share telephone numbers or email addresses between Users. A User should not include such details in Content that is visible to others unless the User intends them to be public.

The Portal Operator can access account-level information for authorization, abuse prevention and moderation, including for requests and participation that appear anonymous to other Users.

The Portal's own systems do not sell Account information. Information is disclosed in the following circumstances:

FAST-NUCES does not operate the Portal and does not receive Account information from it as a matter of course.

The Portal uses the following Third-Party Services:

The Portal also links to external sites, and those sites are subject to their own privacy policies. The Portal does not control how Third-Party Services use information under their own policies.

The Portal does not currently use any other analytics, advertising tracker or social media plug-in beyond those listed in this Section.

The Portal's own code does not set cookies. It stores information in the browser's local storage so that the Portal works as expected. This includes authentication session information, the selected theme, the selected section, batch or department, examination selections, the acceptance of exam-specific terms, the version of a release announcement that has been dismissed, the Class Reminders setting and its subscription endpoint, notification state for Lost & Found and activity, the Semester Simulator draft, which holds the figures a User has entered or loaded from the timetable and is kept whether or not the User is signed in, and timetable customization for a User who is not signed in.

Third-Party Services that the Portal loads, including the advertising script and web fonts provided by Google, are operated by those providers and may use cookies or similar technologies under their own policies. The Portal does not display a cookie consent banner and does not operate a cookie preference mechanism of its own.

A User can clear the Portal's local storage through the browser's settings. Doing so signs the User out and resets stored preferences on that device.

The Portal applies access controls in its database, including row-level security that restricts which records a User can read and change, and stores Marketplace photographs in a private storage area that is accessed through short-lived links. Authentication is handled by a dedicated authentication service.

No method of transmission or storage is completely secure, and the Portal cannot guarantee absolute security. A User should choose a strong password that is not used elsewhere, should keep credentials confidential, and should report a suspected security issue through Section 14.

The Portal does not apply a single retention period to all information. The following periods apply to particular Content:

Records needed for safety, abuse prevention, security or legal purposes, including reports and the account association of anonymous activity, may be retained for as long as they are needed for those purposes.

The Portal does not currently provide a function that allows a User to delete an Account without assistance. A User may ask for deletion of the Account and associated information by writing to the contact address in Section 14.

When an Account is deleted, records that are linked to it, such as a stored Custom Timetable, are removed with it. The extent to which other records are removed or de-identified depends on the kind of record, and records needed for the purposes in Section 9 may be retained.

A User can also delete certain information without assistance, including the User's own Lost & Found reports, the photographs in the User's Marketplace Listings, the User's Connections and the User's saved Semester Simulator plans, and can remove a stored push subscription by disabling Class Reminders.

A signed-in User can use the following controls:

The Portal is intended for members of a university community and is not directed to children. The Portal does not knowingly seek personal information from children. A parent or guardian who believes that a child has provided personal information to the Portal may contact the Portal Operator through Section 14, and the Portal Operator will review the request and remove the information where appropriate.

The Portal Operator may update this Privacy Policy, for example when a Service or a Third-Party Service changes. Each version has a version number, an effective date and a last updated date, which are stated at the top of this page. Continued use of the Portal after the effective date of an updated version constitutes acceptance of it.

Questions, access requests, correction requests, deletion requests and privacy concerns may be sent to wamizphantom@gmail.com.

A privacy concern may also be reported by selecting a category below, which opens an email addressed to the contact address with the category in the subject line.

The Portal is not monitored in real time, and the Portal Operator does not commit to a response time. A request should identify the Account concerned and should not include a password.