Privacy & terms

Who runs this

Kehai Engine is an independent, solo-built project — not a company, with no support SLA. It's offered free of charge, as-is, with no warranty of any kind. If something breaks, the best way to reach the maintainer is a GitHub issue on the source repository (linked in the footer).

What is collected

• · Your name, email, and password hash (or, for Google sign-in, your Google account id/email/name/picture) — for login and identifying you to organizers.
• · Which organizations and events/classrooms you're a member of or registered for.
• · GPS coordinates at the moment of check-in only — never tracked continuously or in the background — rounded to about 1.1m precision, plus the device's own reported accuracy and computed distance from the venue.
• · A small set of honest anomaly signals computed at check-in (e.g. an implausible travel speed since your last check-in, or landing on the exact same GPS fix as another attendee). These are shown only to the event's organizer as a flag to review — they never block a check-in on their own, and can be wrong.

What is deliberately not collected

No continuous or background location tracking, no device fingerprinting, no ad tracking, and raw attendee data (names, emails, coordinates) is never sent to the AI provider — only already-aggregated statistics are.

Retention

Attendance and location records are kept for the lifetime of the event or classroom record, since they're the auditable basis for an attendance decision. Refresh tokens are revoked on logout and expire after 30 days.

Known limitations (stated honestly)

Geofence + QR verification proves the reported device location and a valid, time-scoped code were both presented — it is not a claim of spoof-proof presence. A device with a mocked GPS provider can misreport its location, the same limitation every consumer app using browser geolocation has. Treat this as a strong signal, not absolute proof.