Privacy

Information we collect

When you sign in, we store your name, email address, email verification status and an account identifier. If you use Google or GitHub, we receive your basic profile, including your provider account ID and profile picture when available. Authentication tokens are stored on the server; OAuth access and refresh tokens are encrypted.

If you submit the registration form, we also store your registered name, your confirmation that you attend PRISMS, a registration reference, status and submission dates. Signing in alone does not submit a registration.

How we use it

We use this information to sign you in, recognize your account when you return, show and update your registration, and let authorized organizers review participants. Google account data is used for these account and registration features. We do not request access to your Gmail inbox, Google Drive files, or GitHub repositories.

Who can access it

Authorized Refract organizers can view accounts and registration details, edit names and registration status, sign out accounts, manage admin access, delete accounts, and export the participant list. Admin changes are recorded with account identifiers, timestamps and the changed values or action counts. Historical personal change details are removed when the affected account is deleted. Organizer access also requires a shared admin password, stored as a salted hash, with a separate 30-minute unlock for each session. The website and database run on Amazon Web Services. Resend processes your email address and verification message when you use email sign-in. Google or GitHub handles authentication when you choose that provider.

The website has no advertising or third-party analytics integrations. Participant profiles and the registration list are not public.

Cookies and security records

We use cookies to keep you signed in and protect the sign-in process. Sessions expire after seven days unless renewed. Email verification codes expire after ten minutes and are stored as hashes. Temporary browser storage keeps track of an email verification request so you can finish it.

The server also uses session, request and rate-limit records, which can include IP addresses and browser information, to operate the website and limit abuse.

Website traffic

We count page views, approximate daily visitors and browsers active in the last five minutes. A random identifier in your browser storage changes each UTC day. The server stores only a daily hash of that identifier, a page-view identifier, the page path and visit times for up to 30 calendar days. These traffic records do not include your account, email, full URL, or raw IP address. We use IP addresses temporarily in memory to limit abusive requests.

Traffic collection respects Do Not Track and Global Privacy Control. You can also clear the site’s browser storage. Counts may include automated visits or multiple browsers belonging to the same person.

Retention and your choices

Account and registration records remain on the server until removed by an organizer; there is currently no automatic deletion schedule. Server backups may also contain those records.

You can update your registered name and sign out on your account page. To request access, correction or deletion of your information, contact iamaaronli1324@gmail.com or johnzhou811@gmail.com. We may need to verify that the account belongs to you before making a change.

You can also remove Refract’s access through your Google or GitHub account settings. Removing provider access does not itself delete an existing Refract account or registration.

Contact and updates

For questions about this page or your information, email iamaaronli1324@gmail.com. Changes to how this website uses information will be reflected here with an updated date.