ft_intra — Privacy Policy

Last updated: 2026-06-18

ft_intra is an unofficial mobile client for École 42 students. It shows your 42 intra data (profile, projects, evaluations, campus presence) and delivers push notifications. This policy explains what data the app handles, where it lives, and how the design stays within the 42 API General Terms of Use.

Who we are

ft_intra is built and operated by the Guild42 community for 42 students. It is not affiliated with or endorsed by École 42 / the 42 Network.

Contact: ka-kun@actraise.org

Where your data lives (at a glance)

The single most important point: your 42 credentials never reach our server. Your 42 login token stays on your phone. Our server only ever holds a push token, your notification preferences, and a list of mutually-agreed friend ids — none of which is 42 account data.

📱 Your device

42 OAuth token stays here (iOS Keychain)
Friend nicknames & Discord links stays here
Cached profile / presence for display
"Already seen" evaluation markers (for dedupe)

☁️ Our server

FCM push token stored
Notification preferences stored
Friendships: 42 ids + status stored
42 OAuth token never
42 session cookie never
Your profile / grades / messages never

🟦 42 official API

Source of profile, projects, evaluations
Read with the official OAuth (PKCE) flow
Public campus events & presence

Evaluation notifications: the server cannot read your 42 data, so it sends a content-less "wake" ping → your phone uses its own token to read your evaluations from the 42 API → your phone shows the notification locally. No 42 data passes through our server.

Friend-login notifications: we only watch a friend's public campus presence, and only after both of you agreed (friend request → accept). Either side can revoke at any time.

Legend: stays here never leaves the device · stored kept on our server · never we never receive or store it.

How we comply with the 42 API Terms of Use

The app is deliberately designed so that it does not store 42 credentials on a third-party server, does not scrape the intranet, and does not process other students' personal data without their consent. Concretely:

Requirement (42 General Terms of Use)	What ft_intra does
Your 42 token/session must not be handed to third parties	The OAuth token lives in your device Keychain and is never stored on our server. It is transmitted only once, in memory, to verify your identity via the official `/v2/me` endpoint (so nobody can register as someone else), then discarded — never written to disk or database.
No bulk extraction / scraping of the intranet	We removed all cookie-based scraping. Data comes only from the official 42 API.
Another person's data needs that person's consent	Friend-login alerts require a mutual friend request → accept. We watch only public campus presence, and only of users who agreed.
Data minimisation	The server stores only a push token, preferences and friend ids — no names, grades, messages, or profile data.
Right to deletion	You can delete your server-side data anytime in the app; logging out removes the token from your device.

What data we handle

The app works against the official 42 API and a self-hosted backend. Depending on the features you enable, the following data is processed:

Data	When	Why
FCM push token	When notifications are on	To deliver push notifications to your device
42 user id / login	When using the app	To identify you for presence, check-in and notifications
Friend watch list (42 user ids only)	When you enable per-friend login alerts	To notify you when a watched friend logs in

Your 42 OAuth token stays on your device (iOS Keychain) and is never stored on the server. For evaluation notifications the server only sends a content-less "wake" signal; your device then reads your own data from the 42 API and shows the notification locally. The server holds no 42 session cookie and does no scraping.

We do not collect contacts, photos, advertising identifiers, browsing history, or any data for advertising/tracking.

How it is used and stored

Credentials and tokens are used only to generate your notifications and presence — nothing else.
Server-side data (your FCM token, prefs and friend list of 42 ids) is stored in Google Firestore (server-only access; not readable by other app users). No 42 token or session cookie is stored on the server.
On your device, your 42 token is kept in the iOS Keychain (secure storage).
Friend nicknames and Discord links you set stay on your device only and are never sent to the server.

Third parties

Google Firebase (Cloud Messaging + Firestore) — push delivery and storage.
42 API (api.intra.42.fr) — the source of your intra data.
Cloudflare — network tunnel in front of the backend.

We do not sell or share your data with anyone else.

Your choices and deletion

All data sharing is off by default. Each notification type is opt-in with an explicit consent screen.
You can delete your server-side registration at any time in Settings → "My data (server)", and turn off any notification or check-in. Your 42 token can be removed by logging out (it only ever lived on your device).
To request full deletion of any remaining data, contact us at the email above.

Children

The app is intended for École 42 students and is not directed at children under 13.

Changes

We may update this policy; the "Last updated" date will change accordingly.