JustPass — Privacy Policy
Effective date: 10 May 2026
Application: JustPass (com.justpass.app)
Developer: Tarunswamy Muralidharan
JustPass is a student utility for PSG Institute of Technology (iTech) that
surfaces attendance, CA marks, timetable, results, circulars, and a
student-to-student chess lobby. This policy explains what information the
app handles, where it goes, and the choices you have. By installing or
using JustPass you agree to this policy.
1. Information we handle
-
LAUDEA SIS credentials (roll number + password):
entered by you on the in-app login screen. Stored only on your device
using Android
EncryptedSharedPreferences (AES-256, hardware-
backed Keystore where available). Sent only over HTTPS to the official
PSG iTech LAUDEA SIS authentication endpoint to obtain access tokens on
your behalf. The credentials are never sent to any server operated by the
developer.
-
Academic data fetched from LAUDEA SIS: attendance
records, CA marks, exam results, timetable, profile picture URL, and
student biodata. This data is fetched on demand from the SIS, cached on
your device for offline display, and is not transmitted elsewhere.
-
Firebase Authentication anonymous UID: created when you
open the chess lobby. Used to identify you to the multiplayer backend so
challenges can be routed. No personal information is attached unless you
choose a display name.
-
Chess lobby presence: while you are in the chess screen,
your chosen display name (or a randomly generated anonymous name) and
your online/offline state are visible to other JustPass users in the
lobby and stored transiently in Cloudflare Durable Objects and Firebase
Firestore.
-
Class marks comparison (anonymous): when this feature is
enabled by us via remote configuration, your continuous assessment (CA)
marks are uploaded under a one-way anonymous identifier (a SHA-style
hash derived from your roll number, never the roll number itself). They
are stored alongside a class key composed of your batch year, department,
section, and current semester, in Cloudflare D1 (an edge SQLite database).
Other students in the same class only ever see aggregated statistics
(averages, distributions, your rank) — never anyone else’s raw
marks or identifying information. Comparison statistics are hidden
entirely until at least 15 students from your class have signed in.
You can wipe your data anytime via Profile ’ Delete my class data.
-
Web (PWA) credential storage for background sync: if you
use the iOS / browser-based version of JustPass (justpass-eta.vercel.app),
your LAUDEA SIS credentials are stored encrypted (AES-GCM with a key held
only by our server) in Cloudflare D1. A scheduled job on our backend uses
those credentials to refresh your marks every ~10 minutes so that you can
contribute to the class comparison feature without having to open the
website. Credentials are decrypted in memory only during the refresh,
never logged, and are deleted immediately when you tap “Stop
background sync & delete class data” in your profile or when
you delete your class data through any client. This only affects the PWA
— the Android app never sends your credentials off your device.
-
Firebase Analytics: anonymous, aggregated usage events
(screen views, feature opens, crash counts) collected via the Google
Firebase SDK. No advertising IDs are correlated with your roll number.
-
AdMob: banner ads on a small number of secondary screens
may use Google’s standard ad identifiers. You can reset or limit
this via Android Settings ’ Privacy ’ Ads.
-
Notifications token (Firebase Cloud Messaging / WorkManager):
used to deliver college circular and holiday alerts. The push token is
stored on your device.
2. What we do NOT collect
- We do not collect your name, email, phone number, or photographs from your device.
- We do not access your contacts, SMS, call logs, calendar, or microphone.
- We do not access location, even coarse location.
- We do not sell, rent, or share your data with advertisers or data brokers beyond the standard Google Analytics / AdMob aggregations described above.
3. Permissions used
INTERNET — communicate with LAUDEA SIS, Firebase, Cloudflare, AdMob, and Lichess.POST_NOTIFICATIONS (Android 13+) — deliver circular and holiday reminders.READ_MEDIA_IMAGES / file picker — only when you import an exam-seat Excel file or pick an APK to share.FOREGROUND_SERVICE — show download progress for the optional on-device AI model.
4. Third-party services
5. Data retention
Cached academic data lives on your device until you uninstall the app or
clear app storage. Chess presence is removed from the lobby within seconds
of you closing the chess screen. Firebase Analytics events follow Google’s
default retention (currently 14 months for event-level data).
6. Your choices and rights
-
Sign out / wipe local data: use Profile ’ Sign Out
inside the app, or uninstall the app, to remove all credentials and
cached SIS data from your device.
-
Opt out of analytics / ads: revoke ad personalisation in
Android Settings, or uninstall to stop all analytics events.
-
Delete chess presence: closing the chess screen removes
your record. To remove your anonymous Firebase UID and stored display
name, contact the developer (see below).
-
Access / deletion request: email the developer at the
address below and we will respond within 30 days.
7. Children
JustPass is intended for college students of PSG Institute of Technology
and is not directed at children under 13. We do not knowingly collect data
from children under 13.
8. Security
All network traffic uses HTTPS / WSS. Credentials are encrypted at rest on
the device. The developer does not operate any server that stores your
SIS roll number or password.
9. Changes to this policy
We may update this policy as the app evolves. Material changes will be
announced inside the app and via the Play Store listing. The “Effective
date” at the top will reflect the latest revision.
10. Contact
Tarunswamy Muralidharan
Email: tmswamy10@gmail.com
App package: com.justpass.app