Privacy & Terms

Account. Your name and email address. If you sign up with email and password, we store a salted hash of your password — never the password itself. A phone number is optional, never verified, and never shown to anyone else.

Google sign-in. If you use “Continue with Google”, we receive your Google name, email address, and profile image (scopes: openid email profile). We never post to Google or read anything else from your account.

Academic profile. Only what you choose to enter — nationality, degree history, GPA, target fields and countries, and similar preferences. It is optional and exists to help you plan.

Your workspace. The scholarships, applications, tasks, links, and notes you create. These are private to you.

Community content. Scholarships you share to the public board (including an optional caption), feed posts you write, comments you leave, and reports you file.

Technical records. A session record (a random token hash and expiry time) so you stay signed in, and rate-limit counters keyed on hashed identifiers to slow down abuse.

We do not store IP addresses, use analytics, advertising, or third-party tracking, or set tracking cookies. The only cookie is your signed session cookie, which expires about eight hours after you sign in.

Other members see your display name (and avatar, for Google accounts) next to shared scholarships, posts, and comments. Nobody else ever sees your email address, phone number, academic profile, private scholarships, applications, or notes.

Your data is used only to operate the service: your personal workspace, the community board, transactional email (address verification and password reset), and moderation of reported content. It is not sold, rented, or used for advertising. Community posts and comments are stored as plain text and never altered by moderators — hiding content removes it from public view while preserving the record for moderation decisions.

Passwords are hashed with scrypt. Session tokens are HMAC-signed and checked against the server-side session table, so a session can be revoked. All write requests are validated, size-capped, same-origin checked, and rate-limited. User content is rendered as plain text, so scripts posted by members cannot run in your browser.

You can clear most of your data yourself from the workspace and profile pages. To delete your account and everything attached to it, contact the operator of this deployment. Shared community content authored by you is removed with your account.

Community-sourced information. Scholarships on the public board are shared by members and are self-reported. Details — especially deadlines and funding — change often and can be wrong. Always confirm at the official source before relying on anything you read here.

Your content. You are responsible for what you share and post. Do not post spam, malware, unlawful material, or content you do not have the right to share. Reported content may be hidden by the operators; serious or repeated abuse can lead to loss of access.

No warranty. The service is provided “as is”, without guarantees of availability, accuracy, or fitness for a particular purpose. Missing a deadline because of a wrong listing hurts — verify everything at the source.