Privacy policy

Synode is run by Sithum Raigamage. It is the controller of the personal data described here. Write to sithum.raigamage.dev@gmail.com about anything in this policy.

Your account. When you sign in with Google, or with your organization's single sign-on, we receive your name, email address and profile picture. We keep which organization you belong to and your role on the platform.

What you do here. Events you save or say you're going to, waitlists you join, teams and organizations you follow, teams you join or ask to join, invitations you receive, your check-in passes and attendance, red and black attendance marks, feedback you give after an event, events you report, applications to start a club, and your email preferences.

Your profile. If you add them, your username, bio, university, field of study, graduation year, skills and links to GitHub, LinkedIn or a website. All optional.

What organisers add. Team and organization admins add events, team details, announcements and images. Team admins can invite or import members by email address.

Security records. For each signed-in session we keep the IP address, the browser or device, and when it started and expires. Admin actions are written to an audit log. Admins who turn on two-factor authentication have its secret stored. Request counts per IP address are kept briefly to stop abuse.

Event statistics. We count how many people view an event or click its registration link. For visitors who aren't signed in, the count uses a key derived from the IP address and browser that changes every day, so it can't be used to follow anyone over time.

Payments. When an organization pays for a plan, the payment is made on PayHere's pages. We keep the amount, status and PayHere's reference — never card details.

• To run your account and show you events you're allowed to see.
• To send the emails you've asked for: invitations, event reminders, the weekly digest, and notices when an event you saved is cancelled.
• To give organisers attendance numbers, attendee and check-in lists, and anonymous feedback.
• To give places at full events fairly: a waitlist, and attendance marks. Three black marks in 90 days stop you taking places at events with limited places until they expire; nothing else is decided automatically.
• To keep the platform secure, investigate abuse and review reported events.
• To bill organizations for their plan.

We don't sell personal data and we don't show advertising.

• Event pages show how many people are going, not who. Feedback reaches organisers without your name.
• The team running an event (and its organization's admins) see who is going, on the waitlist, checked in or didn't come, with each person's red and black marks — names only, not email addresses.
• Your profile is private unless you turn on Public profile. Then anyone with the link sees what you filled in, your red marks and how many events you attended — never your email address or black marks.
• Team admins see their team's members, join requests and check-ins. Organization admins see the people at their organization, including email addresses, teams and last sign-in.
• Platform administrators can see accounts and sessions to support users and keep the platform safe.
• Organization-only and team-only events are shown only to members of that organization or team.

• Google, or your organization's identity provider — signing in.
• Vercel — hosting the site, storing uploaded images, counting page views and measuring page speed without cookies (visitors are told apart only by a short-lived hash that is discarded after 24 hours, and speed figures are not tied to any person). Private pages such as sign-in, invitations and admin screens are not counted.
• Neon — the database.
• Resend — sending email.
• PayHere — taking payments from organizations.
• Sentry — error reports, with email addresses removed before they're sent.
• Umami, where enabled — visit statistics without cookies or personal data.

Some of these services store data on servers outside Sri Lanka.

We use one essential cookie to keep you signed in. Your theme choice and, if you install the app, your saved events (so they open offline) are stored in your browser. We don't use advertising or cross-site tracking cookies.

Account and activity data is kept while your account exists. Sessions expire on their own. Abuse-prevention counters are short-lived. Payment records are kept as long as accounting rules require.

• Turn event reminders and the weekly digest on or off on your profile.
• Unsave events, unfollow, leave teams, or withdraw a join request at any time.
• Download a copy of your data, or delete your account, under Your data on your profile.
• Ask us to correct your data, or for help with any of these, by writing to sithum.raigamage.dev@gmail.com.

These rights include those under Sri Lanka's Personal Data Protection Act No. 9 of 2022.

When this policy changes, we update the date at the top. For questions, write to sithum.raigamage.dev@gmail.com. See also the terms of use.