Security

Last updated: 23 October 2026

How your data is protected

• In transit: every connection uses HTTPS/TLS. The app makes no plain-HTTP requests.
• At rest: accounts and progress live in Google Firebase (Authentication and Cloud Firestore). Firestore security rules let each student read and write only their own record; problem reports are write-only and cannot be read back by other users.
• Guest mode: if you do not create an account, nothing leaves your device.
• On the page: a Content-Security-Policy restricts what the site may load and where it may connect.
• Least data: no phone number, contacts, photos, precise location or advertising ID are collected, and nothing is sold. See the privacy policy.
• AI requests are sent to a Cloudflare Worker without your name or e-mail attached, and are checked by a safety filter.

Reporting a vulnerability

If you find a security problem, please report it privately first:

• Report it on GitHub (private advisory), or
• e-mail aryansonkar243@gmail.com with the steps to reproduce.

Please give us a reasonable time to fix the problem before telling anyone else, and do not access or change other people's data while testing. We are grateful for responsible reports and will credit you if you would like.

Hosting

The website is served from GitHub Pages, the Android app is distributed as a signed build, accounts and data are in Google Firebase, and AI requests run on Cloudflare Workers. Because GitHub Pages cannot send custom response headers, some header-based protections (HSTS preload, X-Frame-Options, nosniff) are set by GitHub's own defaults rather than by us; the site's own policy is delivered through a meta Content-Security-Policy instead.