diff --git a/README.md b/README.md
index 4a59339..279d6e0 100644
--- a/README.md
+++ b/README.md
@@ -195,7 +195,8 @@ The registration APIs (`/api/register`, `/api/upload`) check the same switch on
Edit [`src/config/payment.ts`](src/config/payment.ts). The fee must match `REGISTRATION_FEE_INR` in
[`src/lib/security.ts`](src/lib/security.ts), which is what the server records. Then regenerate
-`public/assets/upi-qr.svg` from the new `UPI_PAY_LINK` with any QR encoder, and scan it to check before deploying.
+`public/assets/upi-qr.svg` from the new `UPI_PAY_LINK` as a single byte-mode segment (see the comment in
+`payment.ts`), and scan it to check before deploying.
### Add gallery photos
diff --git a/public/assets/upi-qr.svg b/public/assets/upi-qr.svg
index 5b37fdd..adab88a 100644
--- a/public/assets/upi-qr.svg
+++ b/public/assets/upi-qr.svg
@@ -1 +1 @@
-
+
diff --git a/src/app/privacy/page.tsx b/src/app/privacy/page.tsx
new file mode 100644
index 0000000..f4d7501
--- /dev/null
+++ b/src/app/privacy/page.tsx
@@ -0,0 +1,98 @@
+import Link from 'next/link';
+import LegalPage, { LegalContacts } from '@/components/legal/LegalPage';
+import { pageMetadata } from '@/lib/seo';
+
+export const metadata = pageMetadata({
+ title: 'Privacy Policy',
+ description: 'How INNOVISION 2026, the techno-management festival of NIT Rourkela, collects, uses and protects your personal data.',
+ path: '/privacy',
+});
+
+/**
+ * /privacy. Describes what the site actually does with personal data; keep it in step with the code when the data
+ * collected changes (registration form fields, supabase/schema.sql, the analytics in src/app/layout.tsx).
+ */
+export default function PrivacyPage() {
+ return (
+
+
+ This policy explains what personal data the INNOVISION 2026 website collects, why, who can see it and what you can
+ do about it. “We” means the INNOVISION 2026 organising team at the National Institute of Technology
+ Rourkela, Odisha. By signing in or registering you agree to this policy and to our{' '}
+ Terms and Conditions.
+
+
+
What we collect
+
+
From Google sign-in: your name, email address and profile photo. We never see your Google password.
+
When you register: your name, gender, college, enrolment or roll number and phone number.
+
For the fee: the UPI transaction ID (UTR) and the screenshot of your payment that you upload. We do not collect card, bank or UPI PIN details.
+
At the venue: when your entry pass is scanned, we record the time, the entry desk and which volunteer checked you in.
+
Visit statistics: anonymous page-view counts through Vercel Analytics, which uses no cookies and does not identify you.
+
+
+
Why we use it
+
+
To sign you in and keep you signed in.
+
To verify your payment and confirm or reject your registration.
+
To issue your QR entry pass and check you in at the gate, once per registration.
+
To contact you about your registration or important changes to the fest.
+
To keep the site secure and stop abuse, such as fake or repeated registrations.
+
+
We do not sell your data, use it for advertising or send you marketing email.
+
+
Who can see it
+
+
You can see your own profile, registration and entry pass after signing in.
+
The registration team sees registration details and payment screenshots to verify payments. Screenshots are kept in private storage and opened only through short-lived links.
+
Gate volunteers see your registration details when they scan your pass, to match them with your college ID.
+
+ Service providers that run the site for us: Google (sign-in), Supabase (database and file storage) and
+ Vercel (hosting and visit statistics). They process data only to provide those services.
+
+
+
We share data with anyone else only if the law requires it.
+
+
Cookies and browser storage
+
+ We use two sign-in cookies, which last up to 7 and 30 days, so you stay logged in. The site also keeps small,
+ temporary notes in your browser's session storage, for example to reopen the registration form after you sign
+ in. We use no advertising or tracking cookies.
+
+
+
How long we keep it
+
+ We keep registration data, payment screenshots and check-in records only for as long as we need them to run
+ INNOVISION 2026, handle questions about payments or entry and settle the fest's accounts. After that we delete them.
+
+
+
How we protect it
+
+ Data is sent over encrypted connections. Access is limited by role: participants can read only their own records,
+ and only the registration team can see payment screenshots. Entry-pass codes are stored encrypted. No system is
+ perfectly secure, but we take reasonable steps to protect your data.
+
+
+
Your choices and rights
+
+
You can view your details in your profile and update your phone number there.
+
You can ask us for a copy of your data, to correct details you can't edit yourself, or to delete your data.
+
If you have a concern about how we handle your data, contact us first and we will try to resolve it.
+
+
+ Deleting your data cancels your registration and entry pass. We may keep a record of a payment where that is needed
+ to settle accounts or resolve a dispute.
+
+
+
Changes to this policy
+
+ If we change this policy we will update it on this page and change the date at the top. Significant changes will
+ also be announced on the site.
+
+
+
Contact us
+
For any privacy question or request, contact the organising team:
+
+
+ );
+}
diff --git a/src/app/sitemap.ts b/src/app/sitemap.ts
index 3c571f8..72537d1 100644
--- a/src/app/sitemap.ts
+++ b/src/app/sitemap.ts
@@ -10,7 +10,7 @@ import { WORLDS } from '@/components/innovision/data';
* whose #/ hash routes on the home page search engines treat as the home page itself; the gallery and schedule views
* have no pages of their own. /register and /merch are listed only while they render their public teaser pages; once
* their launch switch (src/config/launch.ts) is on, they redirect instead (to sign-in, or to the #/merch store view)
- * and are left out. Staff pages (/admin) and the API never appear.
+ * and are left out. /privacy and /terms are always listed. Staff pages (/admin) and the API never appear.
*
* No lastModified: nothing in the project records when a page's content last changed, and a build date is not that.
*/
@@ -21,6 +21,8 @@ export default function sitemap(): MetadataRoute.Sitemap {
...WORLDS.map((w) => `/events/${w.slug}`),
...(REGISTRATIONS_OPEN ? [] : ['/register']),
...(MERCH_STORE_OPEN ? [] : ['/merch']),
+ '/privacy',
+ '/terms',
];
return paths.map((path) => ({ url: `${SITE_URL}${path}` }));
}
diff --git a/src/app/terms/page.tsx b/src/app/terms/page.tsx
new file mode 100644
index 0000000..15d5da3
--- /dev/null
+++ b/src/app/terms/page.tsx
@@ -0,0 +1,103 @@
+import Link from 'next/link';
+import LegalPage, { LegalContacts } from '@/components/legal/LegalPage';
+import { REGISTRATION_FEE } from '@/config/payment';
+import { pageMetadata } from '@/lib/seo';
+
+export const metadata = pageMetadata({
+ title: 'Terms and Conditions',
+ description: 'The terms for registering for and attending INNOVISION 2026, the techno-management festival of NIT Rourkela.',
+ path: '/terms',
+});
+
+/** /terms. The registration and entry rules here mirror the registration flow and the QR check-in at the gate. */
+export default function TermsPage() {
+ return (
+
+
+ These terms apply to everyone who uses the INNOVISION 2026 website, registers for the fest or attends it.
+ “We” means the INNOVISION 2026 organising team at the National Institute of Technology Rourkela, Odisha.
+ By signing in or registering you accept these terms and our Privacy Policy.
+
+
+
Accounts and registration
+
+
You sign in with your own Google account. One account can hold one registration.
+
Your details must be true and must match your college ID card, which you will be asked to show at the gate.
+
You are responsible for keeping your account secure and for activity under it.
+
+
+
Fee and payment
+
+
The registration fee is ₹{REGISTRATION_FEE}, paid by UPI to the account shown on the registration form.
+
After paying, you upload a screenshot of the payment and enter its UPI transaction ID (UTR).
+
+ Your registration stays pending until the registration team has verified the payment. It is then
+ confirmed or rejected.
+
+
+ A registration is rejected if the payment can't be verified, for example a wrong amount or an unclear or
+ edited screenshot. You can then register again with a valid payment.
+
+
A UTR can be used for only one registration. We may block accounts that submit false payment details.
+
+
+
Refunds
+
+ The registration fee is non-refundable once your registration is confirmed. If you were charged twice, or your
+ payment reached us but your registration was rejected, contact us with your UTR and we will look into a refund.
+ If the fest is cancelled, we will announce how fees will be refunded.
+
+
+
Entry pass
+
+
A confirmed registration gets one QR entry pass, shown under MY PASS on the site.
+
The pass is personal and non-transferable. Don't share it: whoever is scanned first is checked in.
+
Each pass checks in once. Carry your college ID; volunteers may refuse entry if it doesn't match your registration.
+
+
+
At the fest
+
+
Follow the rules of NIT Rourkela and the instructions of the organisers, volunteers and security staff.
+
Individual events may have their own rules, eligibility and judging, which apply alongside these terms.
+
+ We may refuse entry to or remove anyone who breaks these rules or behaves unsafely or abusively, without a refund.
+
+
You are responsible for your belongings. We are not liable for loss or damage to personal property.
+
+ The fest is photographed and filmed. Photos and videos may appear on this site and on our social media.
+
+
+
+
Changes to the fest
+
+ Schedules, venues, line-ups, prizes and event formats may change. We will post changes on the site. If the fest
+ has to be postponed or cancelled, we will announce what happens to registrations.
+
+
+
Using this website
+
+
Don't try to break, overload or get around the site's security, registration or payment checks.
+
Don't submit someone else's details, or create accounts or registrations on their behalf without their consent.
+
The site's design, text and artwork belong to INNOVISION and its creators. Don't reuse them without permission.
+
We may suspend accounts or cancel registrations that break these terms.
+
+
+
Liability
+
+ We run the site and the fest with reasonable care, but we provide the site “as is” and can't promise it
+ will always be available or error-free. As far as the law allows, our liability for any registration is limited to
+ the fee you paid for it.
+
+
+
Changes to these terms
+
+ We may update these terms. The date at the top shows the latest version. Continuing to use the site after a change
+ means you accept the updated terms.
+
+
+
Contact us
+
For questions about registration, payments or these terms, contact the organising team: