Legal

Privacy Policy

Last updated: 31 October 2026 — Compliant with the Philippine Data Privacy Act of 2012 (RA 10173)

1. Who We Are

BSIT Survival Kit is a study guide app for Filipino BSIT (Bachelor of Science in Information Technology) students. It is operated by a single independent developer.

As the personal information controller under RA 10173, the developer also serves as the Data Protection Officer (DPO). You can reach the DPO at: paneslawrence8@gmail.com

2. What We Collect

We only collect what we actually need. Here is what that looks like:

Account and profile

Your email address and password are collected when you create an account (the password is stored only as a secure hash by our sign-in provider). Your name, and optionally your age, gender, school, and course, are collected only if you fill in your profile. All of it is optional, and you can delete your account and this data yourself at any time from your Profile page.

We previously ran a "notify me" waitlist for subjects that had no content yet. That is finished: every subject now has content, everyone who signed up was emailed, and their names and emails were deleted.

Device ID

A randomly generated identifier (UUID), created by your browser the first time you visit. It is kept in your browser's local storage and in a cookie (see Section 5). It is not tied to your identity unless you also sign up.

Reading activity

Pages you visit, modules you open, sections you read, and how you arrived (for example, the link or campaign tag that brought you here). We store this in our own database linked to your device ID. The modules you mark as done are also linked to your account when you are signed in, so your progress follows you across devices. We use this to remember your progress and to understand how students use the app.

Search queries

When you use Search, we record what you searched for, how many results it found, and which result you opened, linked to your device ID. Before it is stored, the query is lowercased, cut to 80 characters, and anything that looks like an email address or a long number (such as a phone or student number) is removed. We record a search once you stop typing, not each keystroke, and we only look at searches in aggregate, to learn what students look for and which topics we are missing. Please do not type personal information into the search box.

Usage data collected by Google Analytics

Every page loads Google Analytics (measurement ID G-WN5Q254FCG). Google receives the address of each page you view, your IP address, and your browser, device, and approximate location, and sets its own cookies to recognize repeat visits. We see only aggregated reports, not your IP address.

Payment data

If you buy access to reviewers, you pay on PayMongo's checkout page by GCash, Maya, or card. Your card number, e-wallet login, and any details you type on that page go to PayMongo, never to us. We keep a record of the purchase: the PayMongo payment reference, the plan, the subject or year it unlocks, the amount, and when it was paid, linked to your account and device ID.

Feedback

If you rate a module or send feedback, we store the rating and your comment, linked to your device ID and, unless you send it anonymously, your account.

Code you run in the playground

Python and SQL run entirely in your browser and are never sent to us. Java and C code is passed through our server to Judge0, a third-party code execution service, to be compiled and run. We do not store submitted code.

3. Why We Collect It

Account email and profile — to sign you in, keep your unlocked subjects tied to your account across devices, and personalize your dashboard.

Emails we send — receipts and messages about a purchase (a welcome note, a warning before your access ends, and a note after it ends). We may also send an occasional study reminder, such as before finals; every one has an unsubscribe link, and we will not use your email for anything else without your permission.

Device ID, reading activity, and analytics — to save your reading progress across visits and to understand which modules students find most useful, so we can improve the app.

Payment data — to verify your payment, activate your access, and keep records we may need to resolve a dispute or refund.

4. Service Providers We Use

We use a small number of services to run the app. Each one receives only the data it needs to do its job for us, listed below. We never sell your data, and we do not share it with anyone else unless the law requires us to.

Supabase (Database and sign-in — Singapore region)

Stores your account, profile, device ID, reading activity, feedback, and purchase records, and handles signing in. Data is hosted in Singapore.

Vercel (Web hosting — global edge network)

Serves the app. Vercel processes request metadata (IP addresses, headers) as part of normal web hosting, under its own privacy policy.

Google Analytics (Usage statistics — Google LLC)

Receives the usage data described in Section 2 and processes it under Google's privacy policy. You can opt out with Google's Analytics opt-out browser add-on or by blocking cookies from google-analytics.com; the app works the same either way.

PayMongo (Payments — GCash, Maya, and card)

Runs the checkout page and processes your payment. We send it the plan and price, plus your device ID and account ID so the payment can be matched to you. PayMongo handles your payment details under its own privacy policy.

Resend (Email delivery)

Delivers the emails described in Section 3. It receives your email address and the content of each message.

Judge0 (Code execution — ce.judge0.com)

Receives the Java or C code you run in the playground, through our server, so it never sees your account. Do not put sensitive or personal data in code. Judge0 is an independent service with its own terms and privacy policy.

jsDelivr and sql.js.org (File delivery for the playground)

The playground downloads its Python engine from jsDelivr, and its SQL engine from sql.js.org only if our own copy fails to load. These public file servers see your IP address like any web request. No code or personal data is sent to them.

5. Cookies and Browser Storage

We do not use advertising cookies. These are all the cookies and browser-storage entries the site sets:

bsit_device_id (Us; lasts 1 year)
A signed copy of your device ID, so your reading progress and any unlock stay tied to this browser. HttpOnly: page scripts cannot read it.
sb-…-auth-token (Supabase Auth, on our behalf; lasts until you sign out, at most 400 days)
Keeps you signed in. Only set once you log in.
_ga, _ga_… (Google Analytics; lasts up to 2 years)
Tells visits from the same browser apart so page-view counts are not inflated.
admin_session (Us; lasts 8 hours)
Signs in the site administrator. Never set for students.

Local storage (stays until you clear it)

bsit_device_id — Your device ID (see Section 2).
theme — Whether you chose light or dark mode.
bsit_last_module — The module you last opened, for the "Continue reading" link on the home page.
bsit-pages-…, bsit-static-… (Cache Storage) — Copies of the public lesson and subject pages you opened, so they still open with no signal. Never sent to us; your browser can clear them.
bsit_install_prompt_dismissed — When you closed the "add to home screen" suggestion, so it stays away for three weeks.
bsit_recent_lessons — The last few lessons you opened (titles and links), for "Pick up where you left off". Never sent to us.
bsit:tour:… — Which page tours you have finished or skipped, so they don't repeat.
bsit:landing-seen — That this browser has opened the home page before, so the home page tour waits until your second visit.
bsit_signup_nudge_dismissed — That you closed the "create a free account" prompt.
last-feedback-prompt, rated-modules — When we last asked for feedback, and which modules you already rated, so we don't ask again.

Session storage (cleared when you close the tab)

bsit:session-entered — Counts a visit once per browser session, not once per page.
bsit_signup_nudge_shown — Shows the sign-up prompt at most once per session.

You can clear or block any of these in your browser settings. Blocking our own cookie and storage means your progress and unlocks will not be remembered on that browser.

6. Your Rights Under RA 10173

As a data subject under the Philippine Data Privacy Act, you have the following rights:

—
Right to be informed — You have the right to know what data we collect and why. This policy is how we fulfill that.
—
Right to access — You can request a copy of the personal data we hold about you.
—
Right to rectify — You can ask us to correct inaccurate or incomplete data.
—
Right to erasure — You can delete your account and personal data yourself, any time, from your Profile page — or email us and we will do it for you. We will comply unless we are legally required to retain it (see Section 8).
—
Right to object — You can object to how we process your data, including for analytics. To stop Google Analytics, use the opt-out in Section 4.
—
Right to data portability — You can request your data in a structured, commonly used format.
—
Right to file a complaint — If you believe your rights have been violated, you can file a complaint with the National Privacy Commission at privacy.gov.ph.

7. How to Exercise Your Rights

To delete your account — sign in, go to your Profile page, and use the "Delete my account" option. This removes your profile and unlinks your name from your subscription and progress history immediately.

To stop study-reminder emails — use the unsubscribe link in any of them.

For anything else (access, correction, or if you can't sign in), email us at paneslawrence8@gmail.com with the subject line Data Privacy Request. Please describe what you are requesting (access, correction, deletion, etc.) and we will respond within a reasonable time, and no later than the period required under NPC Circular 16-01.

8. Data Retention

Account and profile — kept until you delete your account.

Waitlist name and email — deleted once the subject you signed up for has content and we have notified you, since that is the only purpose we collected it for. All notify-me signups from the 2026 waitlist were deleted in July 2026 after everyone was emailed. The signup form is no longer in use.

Reading activity — retained for up to 12 months, then deleted or anonymized.

Google Analytics data — kept by Google for no more than 14 months, the longest retention Google Analytics allows.

Payment records — kept for as long as necessary to resolve disputes and comply with any applicable accounting or legal obligations.

9. Security

Your data is stored in Supabase with encrypted connections (TLS in transit, AES-256 at rest). Admin access to the dashboard is protected by password authentication. We apply reasonable technical measures to protect your data, but no system is completely immune to breaches. If a breach occurs that affects your rights, we will notify you and the National Privacy Commission as required by law.

10. Contact

For any privacy-related questions, requests, or concerns, reach out to the Data Protection Officer:

paneslawrence8@gmail.com

This policy was written in plain English on purpose. If something is unclear, email us and we will explain it.