Loading CypherNotes…
Loading CypherNotes…
CypherNotes
Educational notes require an approved student verification session or staff account. Support and privacy information remain publicly accessible.
We keep an approved directory of Student IDs and names. Registration verifies control of your email, not ownership of a Student ID. Someone who knows an unclaimed approved ID can claim it using an email they control. Use only your own ID; disputed claims require independent administrator review through Account Recovery.
Your verified email, approved name and Student ID are shown only in your own signed-in profile and authorized administrative workflows. You cannot edit these through the profile. Student support issues include your verified identity automatically; public recovery requests use a separate support flow.
Request account recoveryStudents may submit an image of their Student Card to verify identity. The face photograph may be covered for privacy, provided the Student ID, name and relevant printed details remain clearly readable. CypherNotes stores card images in a private Supabase Storage bucket, separate from database records containing the Student ID and review decision. Approved and rejected card images are retained for future identity investigations; they are not public, and only authorized administrators may review them. This retention applies to new uploads: cards deleted under an earlier policy cannot be restored.
There is currently no automatic deletion date for retained card images. To request deletion or access, use the Contact form. The team must review identity and any outstanding disputes before processing a request; provider backups may follow separate retention rules.
Optional CypherNotes support payments are bank transfers made directly through your own financial provider to the published recipient. CypherNotes does not process cards or debit accounts. To claim a transfer, we privately store the selected method, amount, transfer reference, submission time, review status, optional message, and either your verified student account identity or a guest display name and contact email. An authorized administrator checks real bank records before confirming a claim. Submitted or unconfirmed claims are never counted as received contributions.
Name and department appear on the public Supporters Wall only if you expressly opt in. Publishing your confirmed amount and leaderboard participation requires separate consent. Guest emails, bank references and reviewer notes never appear on the supporter wall. Financial reconciliation and security audit records may be retained to investigate disputes; no automatic deletion deadline is currently configured. To request a correction or privacy review, use the contact form. Optional contributions do not affect access to notes or university services. Your bank or wallet provider may process payment information under its own policy.
The contact form collects your name, email, selected topic and message so the team can review and respond to your request. Messages are stored in Supabase and are available to authorized administrators, not visitors or ordinary contributors. Sending a message does not subscribe you to marketing.
The protected approved directory contains Student IDs, names and OTP-verified self-registered emails, with optional course information. We use it to send a one-time code and greet the verified student. The directory is not publicly searchable. Student IDs alone do not prove identity. Email OTP proves mailbox control only. The first successful email verification can claim an unclaimed ID; someone who knows another student’s unclaimed ID can therefore claim it. Disputes require independent administrator review. Verification records and revocable session grants protect access; signing out all devices revokes reader grants. Email and hosting providers process the necessary delivery and technical data. Contact the team for enrollment, correction or deletion requests.
Signed-in members and administrators receive private in-app notifications for Student ID reviews, contributor decisions and essential account events. Notification content, read status and timestamps are stored in a restricted database table. Guests cannot access an inbox, and notifications are not public. There is currently no automatic notification expiry date. You can request account data deletion through Contact, subject to required security records.
Approved administrators and contributors use email-based login accounts. Account identifiers and staff roles support access control and note ownership. Original PDFs and drafts are private. Published titles, descriptions, tags and course details are restricted to authorized readers; the reader receives short-lived access to page images.
Student verification and staff login use HttpOnly session cookies. Your browser stores a theme preference when you choose light or dark mode. The application does not add advertising trackers or analytics. Hosting and database providers may process technical request logs as part of operating the service.
The form uses Cloudflare Turnstile verification, validation, a hidden bot field, a timing check and sending limits. Sending-limit counters include a hash of the normalized sender email and a site-wide count. A hash is not a guarantee of anonymity. The application does not store a visitor IP address for these counters.
The contact form loads Cloudflare Turnstile to check for automated submissions. Cloudflare processes browser and technical signals for that verification. See Cloudflare’s Turnstile privacy information.
Messages are retained while the team handles requests and can be permanently deleted by an administrator. There is no automatic message-expiry schedule in the current version. Rate-limit counters are cleaned up during later submissions. To request access, correction or deletion of your contact or staff-account information, select “Privacy or deletion request” on the contact form. The team may need to verify the request before acting. Provider logs and backups follow the provider’s own retention rules.