Privacy Policy

Who we are

LECFLOW is an independent, student-built productivity tool for IIT Madras BS Online Degree students. It is operated by Shubham Chaurasiya. It is not affiliated with, endorsed by, or operated by IIT Madras. The service is provided free of charge with no commercial intent.

What data we collect and why

Account information

• Email address — used to identify your account and let you sign in.
• Password — stored as a one-way bcrypt hash. We never store your plaintext password and cannot recover it.

Calendar data

• Google Calendar URL — the link you paste when adding a subject. Stored so we can sync events on your behalf.
• Calendar events — title, date/time, Google Meet links, and Google Drive recording links fetched from your course calendar. Stored per-user so you can view them inside the app.

User-generated content

• Notes — Markdown notes you write on individual lecture events. Stored privately and visible only to you.
• Watched status — whether you have marked a lecture as watched. Stored per-user.
• YouTube links — optional links you add manually to events without a Drive recording.

Google Calendar API and Google sign-in

When you click Sync, LECFLOW uses Google Identity Services (GIS) to request a short-lived, read-only access token from your existing Google browser session. This token is used solely to read event data from your IITM course calendar via the Google Calendar API.

• We request read-only calendar access (calendar.readonly scope). We cannot create, edit, or delete calendar events.
• The access token is never stored — it is used once per sync request and discarded.
• We do not store your Google credentials, Google account ID, or Google profile information.
• Calendar data fetched (event titles, dates, Meet links, Drive recording links) is stored only to display it back to you inside the app.
• We do not use calendar data for advertising, analytics, or any purpose other than displaying your lectures.
• We do not share calendar data with any third party.

Data storage and security

• Data is stored in a PostgreSQL database hosted on Supabase.
• Passwords are hashed with bcrypt and salted before storage.
• All traffic between your browser and lecflow.space is encrypted over HTTPS.
• We do not sell, rent, or share your personal data with third parties.

Data we do not collect

• We do not use advertising trackers or third-party analytics scripts.
• We do not collect device identifiers, IP addresses, or browsing behaviour beyond what is necessary to serve the app.
• We do not collect payment information — LECFLOW is free.

Data retention and deletion

Your data is retained for as long as your account exists. You can delete a subject and all its associated events at any time from the dashboard. To permanently delete your account and all associated data, email us at the address below and we will process the request within 7 days.

Third-party services

LECFLOW uses the following third-party services to operate:

• Google Calendar API — to fetch course calendar events on your behalf.
• Google Identity Services — to obtain a short-lived token from your Google session for calendar access.
• Supabase — for database hosting.
• Google Drive / YouTube — recordings are embedded from these platforms; we do not host video files ourselves.

Each of these services has its own privacy policy. We encourage you to review them.

Children's privacy

LECFLOW requires users to be at least 13 years of age. If you are between the ages of 13 and 18, you must have the consent of your parent or legal guardian to use this Service, in accordance with applicable data protection laws (such as India's Digital Personal Data Protection Act).

We do not knowingly collect personal data from children under the age of 13. If we become aware that we have collected data from a child under 13 without verification of parental consent, we will take steps to delete that information as quickly as possible.

Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page. Continued use of the app after changes are posted constitutes acceptance of the revised policy.

Contact