Security Verified

Privacy Engine

Your data is your property. We are just the custodians.
Version 2.1.0 • Updated Feb 2026

1. Data Architecture

We follow the strict principle of Data Minimization. We only collect what is strictly necessary to run the StuHive ecosystem in compliance with global privacy standards, including the Digital Personal Data Protection Act (DPDP) and GDPR.

Information You Provide

Identity: Google Profile data (Name, Email, Avatar) via OAuth 2.0. We do not process or store passwords.

Academic: University name, course details, and subject interests you voluntarily add to your profile.

Content: Any notes, PDFs, blogs, chat messages, or reviews you choose to publish on the platform.

Social & Analytics: Your followers, following list, saved collections, and basic interaction telemetry to improve the app.

2. Google OAuth & API Services Disclosure

StuHive's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Scope of Google Data Collected

We request the minimum necessary OAuth scopes: openid, profile, and email. This provides us solely with your public Google Name, Email Address, and Profile Picture URL.

Limited Use & Strict Prohibitions

No Data Selling: We absolutely do not sell, rent, lease, or trade your Google data, or any derived data, to third-party advertising networks, data brokers, or marketing agencies.
Strict Functional Use: Your Google data is used exclusively to provision your StuHive account, visually identify you to other users (via your avatar and name), and send you essential service notifications.
No Human Reading: No human will read your Google data or personal communications, unless explicitly required for security purposes, to comply with applicable law, or if you request technical support.

3. Third-Party Data Sharing

To operate StuHive, we securely share necessary data fragments with trusted, compliance-verified infrastructure partners. We do not share your Google OAuth data for marketing.

Database Infrastructure (Cloudflare D1): Stores your profile, university hubs, notes metadata, and encrypted session data within a secure, globally distributed SQL environment.

Object Storage (Cloudflare R2): Securely stores all user-uploaded files, PDFs, and media across a global edge network with S3-compatible security protocols.

Real-time Messaging: Facilitates instant chat delivery and collaborative features through the Cloudflare worker-backed chat store.

4. Security & Storage Infrastructure

We treat your data with military-grade respect.

In-Transit Encryption: All data moving between your device and our servers is encrypted using TLS 1.3 (SSL).

At-Rest Encryption: Our databases utilize AES-256 encryption at rest.

5. Data Retention & Deletion

We keep your personal information only for as long as your account is active.

Account Deletion: If you choose to delete your account, your Google OAuth profile data, personal information, and chat histories are permanently and irreversibly purged from our active databases within 30 days.

Revoking Access: You may instantly revoke StuHive's access to your Google account at any time by visiting your Google Account Security settings (myaccount.google.com/permissions).

6. Cookie Policy

We do not use invasive tracking cookies. We utilize Essential Cookies strictly for:

• Securely maintaining your NextAuth.js active login session.
• Remembering your UI preferences (like Dark Mode).
• Preventing Cross-Site Request Forgery (CSRF) attacks.

7. Your Sovereignty

Under GDPR and the DPDP Act (India), you hold the status of a Data Principal and maintain total control over your digital footprint.

Right to Access: You can request a copy of the personal data we hold about you.

Right to Erasure: You can request full deletion of your profile and data.

8. StuHive Mobile App Disclosures

Our mobile application (available on Android and iOS) requires specific device permissions to function correctly.

Camera & Gallery: Accessed only when you choose to upload a profile picture or scan/upload academic notes directly from your phone.

Local Storage/Files: Used to download and view PDFs locally or to pick documents for upload to the StuHive ecosystem.

Device Identifier: We use unique device IDs for secure session management and to deliver service-related push notifications (if enabled).

Secure Store: We use encrypted local storage (iOS Keychain/Android Keystore) to safely cache your authentication tokens.

Grievance Redressal & Support

Have questions about this Privacy Policy, your Google data, or wish to exercise your rights to data deletion? Contact our Data Protection Officer directly:

support@stuhive.in

Please include "Privacy Request" in your subject line for faster routing.

1. Data Architecture

Information You Provide

Identity: Google Profile data (Name, Email, Avatar) via OAuth 2.0. We do not process or store passwords.

Academic: University name, course details, and subject interests you voluntarily add to your profile.

Content: Any notes, PDFs, blogs, chat messages, or reviews you choose to publish on the platform.

Social & Analytics: Your followers, following list, saved collections, and basic interaction telemetry to improve the app.

2. Google OAuth & API Services Disclosure

StuHive's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Scope of Google Data Collected

We request the minimum necessary OAuth scopes: openid, profile, and email. This provides us solely with your public Google Name, Email Address, and Profile Picture URL.

Limited Use & Strict Prohibitions

No Data Selling: We absolutely do not sell, rent, lease, or trade your Google data, or any derived data, to third-party advertising networks, data brokers, or marketing agencies.

Strict Functional Use: Your Google data is used exclusively to provision your StuHive account, visually identify you to other users (via your avatar and name), and send you essential service notifications.

No Human Reading: No human will read your Google data or personal communications, unless explicitly required for security purposes, to comply with applicable law, or if you request technical support.

3. Third-Party Data Sharing

To operate StuHive, we securely share necessary data fragments with trusted, compliance-verified infrastructure partners. We do not share your Google OAuth data for marketing.

Database Infrastructure (Cloudflare D1): Stores your profile, university hubs, notes metadata, and encrypted session data within a secure, globally distributed SQL environment.

Object Storage (Cloudflare R2): Securely stores all user-uploaded files, PDFs, and media across a global edge network with S3-compatible security protocols.

Real-time Messaging: Facilitates instant chat delivery and collaborative features through the Cloudflare worker-backed chat store.

5. Data Retention & Deletion

We keep your personal information only for as long as your account is active.

Revoking Access: You may instantly revoke StuHive's access to your Google account at any time by visiting your Google Account Security settings (myaccount.google.com/permissions).

8. StuHive Mobile App Disclosures

Our mobile application (available on Android and iOS) requires specific device permissions to function correctly.

Camera & Gallery: Accessed only when you choose to upload a profile picture or scan/upload academic notes directly from your phone.

Local Storage/Files: Used to download and view PDFs locally or to pick documents for upload to the StuHive ecosystem.

Device Identifier: We use unique device IDs for secure session management and to deliver service-related push notifications (if enabled).

Secure Store: We use encrypted local storage (iOS Keychain/Android Keystore) to safely cache your authentication tokens.