Privacy Policy

Who we are

AFTER HOURS is the esports club at NMAM Institute of Technology, Nitte. This policy explains how we handle information collected through this website. Contact us at afterhours@nmamit.in with privacy questions.

Information we collect

When you create an account, we collect your name and email. Your profile includes your username, branch and USN. Password sign-in stores a password hash. If you choose Google sign-in, Google provides account details such as your name, email and profile picture. We do not receive your Google password.

We keep event registrations, team names, invitations, attendance marked by admins, and notifications. For paid events, we collect the transaction ID and screenshot you submit, along with the payment amount, review status and admin notes.

We log IP addresses for important account and event actions. Our audit log records account creation, sign-in and account changes, profile setup, event registrations and cancellations, team invitation responses, payment submissions and reviews, attendance changes, and event and game catalogue changes by admins. Records include the time, signed-in user ID when available, action, affected record, result, and IP address when provided by our hosting platform. We do not log page visits, routine searches, opening records, or reading and dismissing notifications in the audit log. We do not record keystrokes, individual button clicks, passwords, authentication tokens, full form contents, URL query strings or payment images in the audit log. Our hosting provider may also process technical request logs.

How we use your information

We use this information to manage accounts, find teammates, send team invitations, run events, review payments, record attendance, and prevent misuse. We use activity and IP logs to protect accounts, investigate misuse, troubleshoot problems and check changes made by admins. We do not sell your personal information.

Who can see it

Signed-in users can search for teammates using a username or USN. Search results show the player's name and username. People in a registration can see their team roster and invitation status. Admins can access the profile and event details needed to manage registrations and attendance. Only admins can view the website audit log, including recorded IP addresses.

Payment screenshots can be viewed through the website only by the submitting account and admins. Receipts may contain sensitive information, so upload only the receipt needed to verify the payment. We do not ask for your UPI PIN, OTP or card details.

Published tournament brackets display solo entrants’ usernames or team names, group assignments and match results publicly. Admins control bracket publication and record results. Bracket and announcement changes are included in the admin action audit log.

The public Community page displays club team details and portraits supplied for publication. Creating an account does not automatically add your profile to that directory.

Cookies and service providers

We use essential cookies to keep you signed in and protect account requests. Sign-in sessions normally last up to seven days and may renew while you use the site. Your sound preference and the IDs of dismissed event announcements are stored locally in your browser.

Vercel hosts the website, and our database provider stores account and event records. Cloudinary stores and delivers website images, including public event posters, QR codes and community portraits. Payment screenshots use authenticated storage and are served only after an account access check. These providers process information needed to run the service. Google processes sign-in information if you choose Google sign-in. Your UPI app and bank handle the actual payment under their own policies; this website collects only the payment evidence you submit for review.

Keeping and removing information

We keep account and event records as needed to operate the club, manage events, resolve payment questions and meet applicable requirements. Payment screenshots are stored privately in Cloudinary; older receipts may remain in our database. The audit log displays the last 90 days. Older audit records are automatically deleted when activity is recorded or the log is opened; on an inactive site, deletion occurs when activity resumes. We do not promise immediate deletion of records needed for an unresolved payment or event dispute.

You can request access to, correction of, or deletion of your information by emailing afterhours@nmamit.in from your registered email address. Include your username and explain the request. We may need to verify your identity before making changes. If some records need to be retained, we will explain why.

Changes to this policy

We may update this policy as the website or club operations change. The date above shows the latest update. Contact us if you need an explanation of how your information is handled.