terms and privacy policy

README.md

@@ -195,7 +195,8 @@ The registration APIs (`/api/register`, `/api/upload`) check the same switch on
 
 Edit [`src/config/payment.ts`](src/config/payment.ts). The fee must match `REGISTRATION_FEE_INR` in
 [`src/lib/security.ts`](src/lib/security.ts), which is what the server records. Then regenerate
-`public/assets/upi-qr.svg` from the new `UPI_PAY_LINK` with any QR encoder, and scan it to check before deploying.
+`public/assets/upi-qr.svg` from the new `UPI_PAY_LINK` as a single byte-mode segment (see the comment in
+`payment.ts`), and scan it to check before deploying.
 
 ### Add gallery photos
 

src/app/privacy/page.tsx

@@ -0,0 +1,98 @@
+import Link from 'next/link';
+import LegalPage, { LegalContacts } from '@/components/legal/LegalPage';
+import { pageMetadata } from '@/lib/seo';
+
+export const metadata = pageMetadata({
+  title: 'Privacy Policy',
+  description: 'How INNOVISION 2026, the techno-management festival of NIT Rourkela, collects, uses and protects your personal data.',
+  path: '/privacy',
+});
+
+/**
+ * /privacy. Describes what the site actually does with personal data; keep it in step with the code when the data
+ * collected changes (registration form fields, supabase/schema.sql, the analytics in src/app/layout.tsx).
+ */
+export default function PrivacyPage() {
+  return (
+    <LegalPage title="Privacy Policy" path="/privacy" updated="13 October 2026">
+      <p>
+        This policy explains what personal data the INNOVISION 2026 website collects, why, who can see it and what you can
+        do about it. &ldquo;We&rdquo; means the INNOVISION 2026 organising team at the National Institute of Technology
+        Rourkela, Odisha. By signing in or registering you agree to this policy and to our{' '}
+        <Link href="/terms">Terms and Conditions</Link>.
+      </p>
+
+      <h2>What we collect</h2>
+      <ul>
+        <li><b>From Google sign-in:</b> your name, email address and profile photo. We never see your Google password.</li>
+        <li><b>When you register:</b> your name, gender, college, enrolment or roll number and phone number.</li>
+        <li><b>For the fee:</b> the UPI transaction ID (UTR) and the screenshot of your payment that you upload. We do not collect card, bank or UPI PIN details.</li>
+        <li><b>At the venue:</b> when your entry pass is scanned, we record the time, the entry desk and which volunteer checked you in.</li>
+        <li><b>Visit statistics:</b> anonymous page-view counts through Vercel Analytics, which uses no cookies and does not identify you.</li>
+      </ul>
+
+      <h2>Why we use it</h2>
+      <ul>
+        <li>To sign you in and keep you signed in.</li>
+        <li>To verify your payment and confirm or reject your registration.</li>
+        <li>To issue your QR entry pass and check you in at the gate, once per registration.</li>
+        <li>To contact you about your registration or important changes to the fest.</li>
+        <li>To keep the site secure and stop abuse, such as fake or repeated registrations.</li>
+      </ul>
+      <p>We do not sell your data, use it for advertising or send you marketing email.</p>
+
+      <h2>Who can see it</h2>
+      <ul>
+        <li><b>You</b> can see your own profile, registration and entry pass after signing in.</li>
+        <li><b>The registration team</b> sees registration details and payment screenshots to verify payments. Screenshots are kept in private storage and opened only through short-lived links.</li>
+        <li><b>Gate volunteers</b> see your registration details when they scan your pass, to match them with your college ID.</li>
+        <li>
+          <b>Service providers</b> that run the site for us: Google (sign-in), Supabase (database and file storage) and
+          Vercel (hosting and visit statistics). They process data only to provide those services.
+        </li>
+      </ul>
+      <p>We share data with anyone else only if the law requires it.</p>
+
+      <h2>Cookies and browser storage</h2>
+      <p>
+        We use two sign-in cookies, which last up to 7 and 30 days, so you stay logged in. The site also keeps small,
+        temporary notes in your browser&apos;s session storage, for example to reopen the registration form after you sign
+        in. We use no advertising or tracking cookies.
+      </p>
+
+      <h2>How long we keep it</h2>
+      <p>
+        We keep registration data, payment screenshots and check-in records only for as long as we need them to run
+        INNOVISION 2026, handle questions about payments or entry and settle the fest&apos;s accounts. After that we delete them.
+      </p>
+
+      <h2>How we protect it</h2>
+      <p>
+        Data is sent over encrypted connections. Access is limited by role: participants can read only their own records,
+        and only the registration team can see payment screenshots. Entry-pass codes are stored encrypted. No system is
+        perfectly secure, but we take reasonable steps to protect your data.
+      </p>
+
+      <h2>Your choices and rights</h2>
+      <ul>
+        <li>You can view your details in your profile and update your phone number there.</li>
+        <li>You can ask us for a copy of your data, to correct details you can&apos;t edit yourself, or to delete your data.</li>
+        <li>If you have a concern about how we handle your data, contact us first and we will try to resolve it.</li>
+      </ul>
+      <p>
+        Deleting your data cancels your registration and entry pass. We may keep a record of a payment where that is needed
+        to settle accounts or resolve a dispute.
+      </p>
+
+      <h2>Changes to this policy</h2>
+      <p>
+        If we change this policy we will update it on this page and change the date at the top. Significant changes will
+        also be announced on the site.
+      </p>
+
+      <h2>Contact us</h2>
+      <p>For any privacy question or request, contact the organising team:</p>
+      <LegalContacts />
+    </LegalPage>
+  );
+}

src/app/sitemap.ts

@@ -10,7 +10,7 @@ import { WORLDS } from '@/components/innovision/data';
  * whose #/ hash routes on the home page search engines treat as the home page itself; the gallery and schedule views
  * have no pages of their own. /register and /merch are listed only while they render their public teaser pages; once
  * their launch switch (src/config/launch.ts) is on, they redirect instead (to sign-in, or to the #/merch store view)
- * and are left out. Staff pages (/admin) and the API never appear.
+ * and are left out. /privacy and /terms are always listed. Staff pages (/admin) and the API never appear.
  *
  * No lastModified: nothing in the project records when a page's content last changed, and a build date is not that.
  */
@@ -21,6 +21,8 @@ export default function sitemap(): MetadataRoute.Sitemap {
     ...WORLDS.map((w) => `/events/${w.slug}`),
     ...(REGISTRATIONS_OPEN ? [] : ['/register']),
     ...(MERCH_STORE_OPEN ? [] : ['/merch']),
+    '/privacy',
+    '/terms',
   ];
   return paths.map((path) => ({ url: `${SITE_URL}${path}` }));
 }

src/app/terms/page.tsx

@@ -0,0 +1,103 @@
+import Link from 'next/link';
+import LegalPage, { LegalContacts } from '@/components/legal/LegalPage';
+import { REGISTRATION_FEE } from '@/config/payment';
+import { pageMetadata } from '@/lib/seo';
+
+export const metadata = pageMetadata({
+  title: 'Terms and Conditions',
+  description: 'The terms for registering for and attending INNOVISION 2026, the techno-management festival of NIT Rourkela.',
+  path: '/terms',
+});
+
+/** /terms. The registration and entry rules here mirror the registration flow and the QR check-in at the gate. */
+export default function TermsPage() {
+  return (
+    <LegalPage title="Terms and Conditions" path="/terms" updated="13 October 2026">
+      <p>
+        These terms apply to everyone who uses the INNOVISION 2026 website, registers for the fest or attends it.
+        &ldquo;We&rdquo; means the INNOVISION 2026 organising team at the National Institute of Technology Rourkela, Odisha.
+        By signing in or registering you accept these terms and our <Link href="/privacy">Privacy Policy</Link>.
+      </p>
+
+      <h2>Accounts and registration</h2>
+      <ul>
+        <li>You sign in with your own Google account. One account can hold one registration.</li>
+        <li>Your details must be true and must match your college ID card, which you will be asked to show at the gate.</li>
+        <li>You are responsible for keeping your account secure and for activity under it.</li>
+      </ul>
+
+      <h2>Fee and payment</h2>
+      <ul>
+        <li>The registration fee is <b>₹{REGISTRATION_FEE}</b>, paid by UPI to the account shown on the registration form.</li>
+        <li>After paying, you upload a screenshot of the payment and enter its UPI transaction ID (UTR).</li>
+        <li>
+          Your registration stays <b>pending</b> until the registration team has verified the payment. It is then
+          confirmed or rejected.
+        </li>
+        <li>
+          A registration is rejected if the payment can&apos;t be verified, for example a wrong amount or an unclear or
+          edited screenshot. You can then register again with a valid payment.
+        </li>
+        <li>A UTR can be used for only one registration. We may block accounts that submit false payment details.</li>
+      </ul>
+
+      <h2>Refunds</h2>
+      <p>
+        The registration fee is non-refundable once your registration is confirmed. If you were charged twice, or your
+        payment reached us but your registration was rejected, contact us with your UTR and we will look into a refund.
+        If the fest is cancelled, we will announce how fees will be refunded.
+      </p>
+
+      <h2>Entry pass</h2>
+      <ul>
+        <li>A confirmed registration gets one QR entry pass, shown under MY PASS on the site.</li>
+        <li>The pass is personal and non-transferable. Don&apos;t share it: whoever is scanned first is checked in.</li>
+        <li>Each pass checks in once. Carry your college ID; volunteers may refuse entry if it doesn&apos;t match your registration.</li>
+      </ul>
+
+      <h2>At the fest</h2>
+      <ul>
+        <li>Follow the rules of NIT Rourkela and the instructions of the organisers, volunteers and security staff.</li>
+        <li>Individual events may have their own rules, eligibility and judging, which apply alongside these terms.</li>
+        <li>
+          We may refuse entry to or remove anyone who breaks these rules or behaves unsafely or abusively, without a refund.
+        </li>
+        <li>You are responsible for your belongings. We are not liable for loss or damage to personal property.</li>
+        <li>
+          The fest is photographed and filmed. Photos and videos may appear on this site and on our social media.
+        </li>
+      </ul>
+
+      <h2>Changes to the fest</h2>
+      <p>
+        Schedules, venues, line-ups, prizes and event formats may change. We will post changes on the site. If the fest
+        has to be postponed or cancelled, we will announce what happens to registrations.
+      </p>
+
+      <h2>Using this website</h2>
+      <ul>
+        <li>Don&apos;t try to break, overload or get around the site&apos;s security, registration or payment checks.</li>
+        <li>Don&apos;t submit someone else&apos;s details, or create accounts or registrations on their behalf without their consent.</li>
+        <li>The site&apos;s design, text and artwork belong to INNOVISION and its creators. Don&apos;t reuse them without permission.</li>
+        <li>We may suspend accounts or cancel registrations that break these terms.</li>
+      </ul>
+
+      <h2>Liability</h2>
+      <p>
+        We run the site and the fest with reasonable care, but we provide the site &ldquo;as is&rdquo; and can&apos;t promise it
+        will always be available or error-free. As far as the law allows, our liability for any registration is limited to
+        the fee you paid for it.
+      </p>
+
+      <h2>Changes to these terms</h2>
+      <p>
+        We may update these terms. The date at the top shows the latest version. Continuing to use the site after a change
+        means you accept the updated terms.
+      </p>
+
+      <h2>Contact us</h2>
+      <p>For questions about registration, payments or these terms, contact the organising team:</p>
+      <LegalContacts />
+    </LegalPage>
+  );
+}