Privacy

The main pages don’t ask for any personal information. There are no ads, analytics or tracking cookies. Your light or dark theme, and whether you closed the announcement banner, are saved only in your own browser.

Cloudflare, which hosts the site, handles standard request details such as your IP address to deliver pages and block attacks.

If you send a suggestion, we keep what you wrote and the page you came from, plus your email address if you leave one, or your account if you’re signed in. Only the Samosa Stack team reads suggestions, and we use your email only to reply about yours. To have one deleted, email us.

You apply to join on Discord. The organisers who approve members see your answers to the application questions, and nobody else does. Discord’s own privacy policy covers your Discord account.

• Your account: your email address and first name, used to sign you in and to email you about requests and messages. If you sign in with Google, see the next section.
• Volunteer profiles: what you write on your profile, and your photo if you add one. These are public, except anything you choose to hide. Every photo is checked by the team before it appears.
• University and work email addresses: used only to check that you study or work where you say, every 6 months while you’re studying or for a work email. After you graduate we don’t check your university email again; we just ask every 6 months if you’re still volunteering. They’re never shown on your profile.
• Requests and messages: only the two people in a conversation can read it.
• Questions asked in the open: shown without your name. If you leave an email address, we only use it to tell you when your question is answered.
• Staying signed in: a random sign-in token in a cookie, stored on our side only in a one-way coded form. Sign-in codes are stored the same way.

When you choose “Continue with Google”, Google shares your name, email address, profile photo link and a Google account ID with us. We use them only to:

• sign you in and set up your account
• greet you by your first name
• show your Google photo on your volunteer profile, only if you choose “Use my Google photo” and the team approves it

We don’t ask Google for anything else, such as your contacts, files or calendar. We don’t use Google data for ads, we don’t sell it, we don’t use it to train AI models, and we only share it with the services listed below that run the site.

You can remove Samosa Stack’s access at any time at myaccount.google.com/permissions, and deleting your account deletes this data. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Only when someone reports it, to keep everyone safe. Every time someone on the team opens a reported conversation, we record who opened it, when and why.

• Cloudflare hosts the site, the database and photos, and runs the spam check on some forms.
• Resend sends our emails.
• Google handles “Continue with Google”, if you choose it.
• Discord hosts the community. Questions asked in the open on Samosa Stack Study may also be posted there, without names, so volunteers see them.

These services may process data outside Pakistan, for example in the United States or Europe.

• Your account and profile: until you delete your account.
• Messages: 90 days after a conversation is marked as done, or after it closes on its own following 60 days without messages.
• Sign-in codes: deleted within a day. Signed-in sessions: 30 days.
• A short safety record, in one case explained below: one year.
• If we block an account for breaking our code of conduct: the account, its email address and our reason, for as long as it stays blocked, so the same address can’t come back. Its requests, conversations and messages close and are deleted on the usual schedule. To ask us to look at a block again, email us.

Deleting your account removes your profile, photo, verifications, requests and messages. The only exception: if someone reported you and we didn’t dismiss the report, we keep a short record for one year: your name, a one-way code made from your email address, what was reported, and what we decided.

We keep it to protect students, so that nobody can delete their account to get around a decision and come back. The code lets us recognise the same email address if it signs up again, but it can’t be turned back into the address. The record is used for nothing else and is deleted automatically after the year. Reports we dismissed are deleted with your account.

You can see and change your profile at any time, and delete your account from your dashboard on Samosa Stack Study. For anything else, such as a copy of your data, a correction, or an objection to how we use it, email hello@samosastack.com. We’ll reply within 30 days. If you live in the EU or UK, you can also complain to your data protection authority.

One-to-one help on Samosa Stack Study is for people aged 18 and over. Under 18s are welcome at group Q&As and can ask in the open without an account. Samosa Stack isn’t meant for children under 13.

We’ll update the date at the top. If a change affects what we do with your data, we’ll email everyone with a Samosa Stack Study account before it takes effect.