Rain Alert Privacy Policy 1.0 / 2026-10-17 Rain Alert connects to Rain Classroom through a reminder service and sends notifications to your devices. It therefore processes account authorization, course information, and notification data on a server. Review this scope before connecting or authorizing an account. 1. Scope and maintainers 雨水提醒 (Rain Alert) is an independent classroom-event reminder Web App under Sparkle, created and maintained by 唐梓耀 / AdrianSparkle and 丁铭 / EliasSparkle. This policy covers the Sparkle-operated instance, device pairing, Rain Classroom QR authorization, classroom monitoring, and Web Push. It is not an official product of Rain Classroom and does not represent schools, teachers, Rain Classroom, WeChat, Apple, or browser vendors. Their services have separate privacy rules. Independently operated instances require disclosures from their own operators; our hosting and administration arrangements do not automatically apply to them. 2. Account details, courses, and credentials After you enter an administrator-provided connection code and confirm login through the official QR flow, the service receives the account ID, name or nickname, school, and student number returned by Rain Classroom, along with enrolled courses, classroom IDs, names, teachers, and related organization identifiers. These identify the account and display courses. The server also stores official login cookies, session authorization, and necessary classroom tokens to continue querying after you close the page. We neither request nor store your Rain Classroom or WeChat password. Cookies and tokens can represent login authority and require special protection. Scanning does not keep authorization solely on your phone. 3. Classroom events and information about others The service queries ongoing classes, necessary learning logs, and check-in modes. With in-class reminders enabled, it receives the official classroom event stream. Stored notification fields include course and classroom names, event types and identifiers, platform or detection times, and necessary summaries. Random-selection events can contain names and student numbers announced to the class by the teacher. These may be stored in encrypted event records and shown in notification bodies, including information about classmates. Manage lock-screen previews and shared devices carefully and do not republish these details. The service does not use them to profile students. The current implementation does not persist question bodies or answers as reminder content, answer questions, respond to roll calls or rapid answers, or obtain device location. However, enabling in-class reminders can cause an automatic classroom-entry request for a platform-confirmed ordinary check-in; it may change official attendance status. Restricted check-in rules are explained in the Terms of Service. 4. Devices, notifications, and technical information We process random device identifiers, hashed connection sessions, device labels, creation and last-opened times, 30-day expiry, account associations, and reminder switches. The initial device category is derived from the browser User-Agent; you may rename it. When you enable notifications, the browser supplies a push endpoint, p256dh public key, and auth secret. The server stores the subscription to send to that device. Delivery attempts, accepted or failed status, timestamps, and hashes of random receipts support troubleshooting, deduplication, and confirmation of system handling. A receipt does not prove that you saw, heard, or read a notification. Providing a network service involves processing IP addresses, request headers, origins, connection times, and error information. IP addresses also support in-memory abuse-rate limiting. The current app has no advertising or behavioral analytics SDK and does not use these data for cross-site tracking or selling personal information. Infrastructure and communication providers may process technical logs under their own rules. 5. Purposes and authorization boundaries These data support pairing, identifying your authorized account, querying and displaying classes, sending selected events, maintaining sessions, migrating origins, protecting security, troubleshooting, and recovery. Account and course data are not used for advertising, commercial profiling, or AI training. Without QR authorization, courses cannot be read. Without notification permission, a signed-in page can still display information but cannot send system notifications to that device. Sensitive credentials, information about classmates, and cross-region processing require the notices, lawful grounds, and consent procedures applicable under law. This policy explains actual flows. Viewing it, entering a code, or scanning a QR code is not treated as satisfying every separately required consent. Do not authorize accounts or information you have no right to provide. 6. Cookies, browser storage, and permissions Device connection uses a rain_session cookie; the server stores its hash. Over HTTPS it has Secure, HttpOnly, and SameSite=Strict attributes and lasts up to 30 days with the device connection, resetting upon renewal. It is an authentication cookie, not an advertising cookie. Signing out of Rain Classroom does not automatically clear this device-connection cookie. A Service Worker handles Web Push and notification clicks. It does not cache account pages as an offline representation of live classroom state. The browser maintains its push subscription. Adding to the home screen and allowing notifications are separate actions. The current page does not request camera, microphone, location, or contacts access. Official clients separately manage permissions used for scanning and check-in. 7. Recipients, hosting, and international transfers The current Sparkle-operated instance runs on Tencent Cloud in Hong Kong, China. If you are in mainland China or another region, account details, cookies, courses, events, and device subscriptions sent to this instance are transferred to and stored in Hong Kong. Authorization and monitoring also communicate with official Rain Classroom APIs and classroom-event services. Depending on the browser, Web Push uses infrastructure such as Apple, Google, Mozilla, or Microsoft, which may process data in other countries or regions. The service sends encrypted push payloads and necessary routing information to the subscription endpoint; browsers and operating systems display them. Plaintext notifications can appear on the device. Push encryption does not mean the reminder server cannot read the underlying data. Cloudflare currently provides domain registration and DNS. Under the existing configuration, application traffic does not pass through its CDN proxy; DNS processing still involves necessary query information. We do not sell or rent personal information. Disclosures required by law, necessary security handling, or other transfers you expressly direct should be limited to the relevant purpose. 8. Encryption and security limits Account profiles, course caches, login cookies, classroom credentials, event payloads, and push subscriptions are stored using AES-256-GCM. Account and device identifiers, associations, switches, times, statuses, and other operational fields are not all individually encrypted. The database and master key are managed on the same host; this is not end-to-end encryption that withstands full server compromise. The service uses HTTPS, session hashing, origin checks, rate limiting, and restricted push endpoints. Authorized administrators may have access needed for decryption. For a personal-information security incident, we will take remedial action and notify affected people and authorities as required by applicable law, explaining the information involved, possible impact, measures taken, and contact routes. Absolute security is not promised. Connect only trusted devices and do not share connection codes, cookies, migration links, or private notifications. 9. Online retention Device connections last 30 days from creation or manual renewal; an expired session no longer grants access. Invalid official authorization pauses relevant monitoring. When the last valid associated device signs out, is revoked, or expires, logout handling or periodic maintenance clears the account’s login cookies and stored classroom credentials and pauses connections. Completed classes and their delivery records, historical events outside active classes, and simulated push records are cleaned during periodic maintenance using a 90-day threshold in the code. Active classes and protected related records may remain longer. Migration credentials are single-use and expire after five minutes. The current implementation has no uniform automatic deletion period for all account profiles, course caches, device metadata, status fields, or backups. The 30-day connection and 90-day history rules do not erase an entire account at those times. Contact maintainers if you stop using the service and want remaining data removed. The absence of automated cleanup is not permission for indefinite retention. When data are no longer necessary or deletion is legally required, we will act under applicable law and verify the scope requiring manual handling. 10. Backups, support material, and cleanup scope Recovery backups include database snapshots, service keys, push keys, and origin configuration. Exported backups use a random AES-256-GCM data key wrapped with a separate RSA-OAEP public key; the decryption private key is held separately. However, cloud storage can also retain SQLite snapshots protected by file permissions, and host privileges can access operational data. Backup protection therefore depends on the type of copy and where it is held. The existing backup process has no uniform automatic expiry; offline exports may remain. Removing online data does not immediately erase historical backups. A deletion request may ask about remaining backups, retention reasons, and disposition arrangements. This requires manual verification; no unimplemented instant one-click erasure is promised. Support conversations and submitted attachments are retained as needed for the matter, not for advertising or training. 11. Disable, sign out, revoke, and request deletion You can disable each of five reminder types, revoke system notifications, sign out of Rain Classroom on this device, view and revoke other devices for the same account, or stop renewing a connection. A switch stops only that device’s corresponding reminders. Monitoring may continue when another device has reminders enabled. Sign-out unlinks this device and removes its server-side push subscription; browser permissions or subscription state may require separate system management. Releasing login credentials after the last valid device leaves does not erase all profiles, history, other device metadata, or backups. There is no automatic whole-account deletion button in the current product. Contact maintainers to request information, access, a copy, correction, deletion, restriction, withdrawal of authorization, or handling of an objection concerning another person’s information. 12. Verification, legal retention, and remedies We verify the relationship between a request and an account in proportion to risk and ask only for necessary information. Do not send cookies, passwords, or migration credentials. Requests should be handled promptly as required by law. If technical separation, backups, disputes, or legal retention obligations prevent immediate completion, reasons, scope, and subsequent arrangements should be explained. Where law requires other processing to stop, retained data are restricted to necessary storage and security rather than returned to ordinary monitoring. Restoration requires checking previously handled rights requests. Statutory rights are not limited to existing interface buttons. You may complain to the competent regulator. 13. Minors and learning contexts The service is for users able to lawfully authorize their accounts and devices. Minors require appropriate guardian authorization and must follow school rules. Account connection is not directed to children under 14. There is currently no age-verification mechanism; contact maintainers if children’s information may have been processed without required authorization so it can be investigated and handled under law. Names, student numbers, and classroom events are used for reminders, not to judge another person’s attendance or performance. School and teacher records through official channels remain authoritative. 14. Changes and language versions Material changes to data categories, purposes, hosting, or recipients will be described here and dated. Updating text or continued use cannot replace legally required additional notice, separate consent, or other procedures. The three language versions aim to describe the same scope; differences do not diminish your rights under applicable law. 15. Contact For privacy questions, rights requests, support, or infringement reports, contact maintainer 唐梓耀 / AdrianSparkle on QQ at 2410710390. The developer’s public profile is https://github.com/Tang1206cc. Identify the product, version, and your request. Do not include passwords, login cookies, connection codes, entire recordings, or unnecessary personal information in your initial message. Specify “Rain Alert / 雨水提醒” and the scope of your request. For another selected student’s information, provide minimal event-time and course context rather than publicly posting a full name and student number.