Privacy

Last updated September 19, 2026.

Andesite shares Science Olympiad practice tests through automatic exchanges and a public test collection. This says what is stored, who can reach it, and what cannot be undone.

What is stored

Your email address, username, optional display name, school and contact details, division, settings and timestamps. Supabase handles sign-in, so signing in with Google or connecting Discord shares identity information with Supabase and Andesite. The database also records your test collection, submissions, listing conditions, accepted seasons, automatic-exchange consent, requests, completed exchanges, reports and notification preferences. Moderation and security actions can create audit records, anti-abuse checks use salted IP hashes and request counters, and hosting providers see connection information. There are no public profile pages.

Google Drive links

Andesite stores Drive references and encrypted source links, with packet metadata and verification hashes. Verification can read a folder's contents to identify matching packets, including downloads for hashing and exports of native Google documents, and link-health checks can revisit a source later. Do not submit material you are not allowed to share.

Private links are opened for authorized owners, recipients and moderators through the site's access checks. The operator holds the database and the server secrets, so encryption does not hide a submitted link from the operator. Drive itself may show a folder owner's Google account name to anyone who opens the folder.

An exchange hands access to another person. They can copy the link or download the files, and the site cannot recall those copies. Pausing a listing or turning automatic exchanges off stops future matching; it does not undo a delivery that already happened.

Public tests

Publishing a public test makes its source link available without an account, on purpose. Public submissions need moderator approval, and a public test cannot be listed for exchange. Use Report test or Support if a packet is public or restricted when it should not be.

Providers

Supabase for sign-in and the database, Vercel for hosting, Google Drive for packet access, Resend for email when it is configured, and Discord for a connected account and exchange notices. Production pages include Vercel Analytics and Speed Insights. Each processes what it needs under its own policy, and changing an email preference does not erase messages already sent.

Your controls

Profile edits and deletes your account, Account settings changes email preferences, Trading preferences turns automatic exchanges off, and My tests exports your test collection. That export is not a copy of every account, security or moderation record.

Deleting your account removes the application account and your exchange settings, listings, requests and inventory, and attempts to remove the Supabase sign-in account. What can remain: completed-exchange records with your identifiers cleared, shared catalog and alternate-source records, records held by other recipients, some moderation or audit records, and release-log entries, which record that something was released on a given day and carry no identifier. Deletion cannot reach a copy another person already received or stored with a provider. There is no single retention period, no immediate removal from backups and no complete self-service export, so contact the operator for a data request or a deletion problem.

Contact

Andesite is operated by Vishwaa Kannan. Contact soggy_chinchilla on Discord, or use Support on the site. Do not send passwords, sign-in tokens or private packet links in a public message. There is currently no dedicated privacy email address and no staffed response schedule.

Changes

This document is dated above and kept in the project repository. The Privacy page renders the same file.