Rain Alert Privacy Policy

1.3 / 2026-10-23

Rain Alert connects to Rain Classroom through a reminder service and sends notifications to your devices. It therefore processes account authorization, course information, and notification data on a server. Review this scope before connecting or authorizing an account.

1. Scope and maintainers

雨水提醒 (Rain Alert) is an independent classroom-event reminder Web App under Sparkle, created and maintained by 唐梓耀 / AdrianSparkle and 丁铭 / EliasSparkle. This policy covers the Sparkle-operated instance, device pairing, Rain Classroom QR authorization, classroom monitoring, and Web Push. This policy also covers classroom entry-status checks and Study with friends invitations that you actively create.

It is not an official product of Rain Classroom and does not represent schools, teachers, Rain Classroom, WeChat, Apple, or browser vendors. Their services have separate privacy rules. Independently operated instances require disclosures from their own operators; our hosting and administration arrangements do not automatically apply to them.

2. Account details, courses, and credentials

Requesting an official sign-in QR code automatically creates a device session; no connection code is required. After you confirm the official QR sign-in, the service receives the account ID, name or nickname, school, and student number returned by Rain Classroom, along with enrolled courses, classroom IDs, names, teachers, and related organization identifiers. These identify the account and display courses.

The server also stores official login cookies, session authorization, and necessary classroom tokens to continue querying after you close the page. We neither request nor store your Rain Classroom or WeChat password. Cookies and tokens can represent login authority and require special protection. Scanning does not keep authorization solely on your phone.

3. Classroom events and information about others

The service queries ongoing classes, necessary learning logs, and check-in modes. With in-class reminders enabled, it receives the official classroom event stream. Stored notification fields include course and classroom names, event types and identifiers, platform or detection times, and necessary summaries.

Random-selection events can contain names and student numbers announced to the class by the teacher. These may be stored in encrypted event records and shown in notification bodies, including information about classmates. Manage lock-screen previews and shared devices carefully and do not republish these details. The service does not use them to profile students.

The current implementation does not retain question text or answers as persistent reminder content, answer questions, respond to roll calls or quick answers, or collect device location. Ordinary attendance may trigger an entry request through enabled in-class reminders. You may also actively invite a friend for a class confirmed as not entered; the friend submits a matching classroom QR code’s decoded text, and the service uses the inviter’s official session for the verified normal entry flow. These requests may change official entry or attendance records; see the Terms of Service.

4. Devices, notifications, and technical information

We process random device identifiers, hashed connection sessions, device labels, creation and last-opened times, 30-day expiry, account associations, and reminder switches. The initial device category is derived from the browser User-Agent. Device renaming and the device list are not exposed in the current interface; the related data and management endpoints remain.

When you enable notifications, the browser supplies a push endpoint, p256dh public key, and auth secret. The server stores the subscription to send to that device. Delivery attempts, accepted or failed status, timestamps, and hashes of random receipts support troubleshooting, deduplication, and confirmation of system handling. A receipt does not prove that you saw, heard, or read a notification.

Providing a network service involves processing IP addresses, request headers, origins, connection times, and error information. IP addresses also support in-memory abuse-rate limiting. The current app has no advertising or behavioral analytics SDK and does not use these data for cross-site tracking or selling personal information. Infrastructure and communication providers may process technical logs under their own rules.

5. Purposes and authorization boundaries

These data support pairing, identifying your authorized account, querying and displaying classes, sending selected events, maintaining sessions, migrating origins, protecting security, troubleshooting, and recovery. Account and course data are not used for advertising, commercial profiling, or AI training. Without QR authorization, courses cannot be read. Without notification permission, a signed-in page can still display information but cannot send system notifications to that device.

Sensitive credentials, information about classmates, and cross-region processing require the notices, lawful grounds, and consent procedures applicable under law. This policy explains actual flows. Viewing it, requesting a sign-in QR code, or scanning a QR code is not treated as satisfying every separately required consent. Do not authorize accounts or information you have no right to provide.

6. Cookies, browser storage, and permissions

Device connection uses a rain_session cookie; the server stores its hash. Over HTTPS it has Secure, HttpOnly, and SameSite=Strict attributes and lasts up to 30 days with the device connection, resetting upon renewal. It is an authentication cookie, not an advertising cookie. Signing out of Rain Classroom does not automatically clear this device-connection cookie.

Browser permissions govern device notifications. Co-study and invitation-assistance pages use the camera only after you actively start scanning and grant access, and can also accept an image. QR decoding happens in the browser; only decoded text is submitted, without uploading video or selected images. Camera zoom uses hardware or digital zoom as the device supports. Microphone, location, and contacts are not requested.

7. Recipients, hosting, and international transfers

The current Sparkle-operated instance runs on Tencent Cloud in Hong Kong, China. If you are in mainland China or another region, account details, cookies, courses, events, and device subscriptions sent to this instance are transferred to and stored in Hong Kong. Authorization and monitoring also communicate with official Rain Classroom APIs and classroom-event services. Anyone holding a valid study invitation can read the inviter’s display name, class name, expiry time, and processing status and submit an entry QR code for the specified class. Decoded text passes through the Hong Kong service to official Rain Classroom interfaces. The friend does not receive the inviter’s cookies, password, or full course list. Share invitations only with trusted people who are permitted to help.

Depending on the browser, Web Push uses infrastructure such as Apple, Google, Mozilla, or Microsoft, which may process data in other countries or regions. The service sends encrypted push payloads and necessary routing information to the subscription endpoint; browsers and operating systems display them. Plaintext notifications can appear on the device. Push encryption does not mean the reminder server cannot read the underlying data.

Cloudflare currently provides domain registration and DNS. Under the existing configuration, application traffic does not pass through its CDN proxy; DNS processing still involves necessary query information. We do not sell or rent personal information. Disclosures required by law, necessary security handling, or other transfers you expressly direct should be limited to the relevant purpose.

8. Encryption and security limits

Account profiles, course caches, login cookies, classroom credentials, event payloads, and push subscriptions are stored using AES-256-GCM. Account and device identifiers, associations, switches, times, statuses, and other operational fields are not all individually encrypted. The database and master key are managed on the same host; this is not end-to-end encryption that withstands full server compromise.

The service uses HTTPS, session hashing, origin checks, rate limiting, and restricted push endpoints. Authorized administrators may have access needed for decryption. For a personal-information security incident, we will take remedial action and notify affected people and authorities as required by applicable law, explaining the information involved, possible impact, measures taken, and contact routes. Absolute security is not promised. Connect only trusted devices and do not share connection codes, cookies, migration links, or private notifications.

9. Online retention

Device connections last 30 days from creation or manual renewal; an expired session no longer grants access. Invalid official authorization pauses relevant monitoring. When the last valid associated device signs out, is revoked, or expires, logout handling or periodic maintenance clears the account’s login cookies and stored classroom credentials and pauses connections.

Completed classes and their delivery records, historical events outside active classes, and simulated push records are cleaned during periodic maintenance using a 90-day threshold in the code. Active classes and protected related records may remain longer. Migration credentials are single-use and expire after five minutes. Study invitations use random tokens. A hash index in process memory holds the inviter’s display name, specified class, approximately 30-minute expiry, attempt count, and result state. Expired invitations cannot be used, and invitations do not survive a service restart. Expired memory entries are cleared when later invitations are created, rather than guaranteed byte-level erasure at expiry. Decoded QR text is used for the current request; the study module does not write camera frames, selected images, or QR text to the database. Official entry records and infrastructure technical logs follow their respective actual handling rules.

The current implementation has no uniform automatic deletion period for all account profiles, course caches, device metadata, status fields, or backups. The 30-day connection and 90-day history rules do not erase an entire account at those times. Contact maintainers if you stop using the service and want remaining data removed. The absence of automated cleanup is not permission for indefinite retention. When data are no longer necessary or deletion is legally required, we will act under applicable law and verify the scope requiring manual handling.

10. Backups, support material, and cleanup scope

Recovery backups include database snapshots, service keys, push keys, and origin configuration. Exported backups use a random AES-256-GCM data key wrapped with a separate RSA-OAEP public key; the decryption private key is held separately. However, cloud storage can also retain SQLite snapshots protected by file permissions, and host privileges can access operational data. Backup protection therefore depends on the type of copy and where it is held.

The existing backup process has no uniform automatic expiry; offline exports may remain. Removing online data does not immediately erase historical backups. A deletion request may ask about remaining backups, retention reasons, and disposition arrangements. This requires manual verification; no unimplemented instant one-click erasure is promised. Support conversations and submitted attachments are retained as needed for the matter, not for advertising or training.

11. Disable, sign out, revoke, and request deletion

You can disable each of five reminder types, revoke system notifications, sign out of Rain Classroom on this device, or stop renewing a connection. The current interface has no device list or revocation controls; contact maintainers to review or revoke other devices. A switch stops only that device’s corresponding reminders. Monitoring may continue when another device has reminders enabled. Sign-out unlinks this device and removes its server-side push subscription; browser permissions or subscription state may require separate system management.

Releasing login credentials after the last valid device leaves does not erase all profiles, history, other device metadata, or backups. There is no automatic whole-account deletion button in the current product. Contact maintainers to request information, access, a copy, correction, deletion, restriction, withdrawal of authorization, or handling of an objection concerning another person’s information.

12. Verification, legal retention, and remedies

We verify the relationship between a request and an account in proportion to risk and ask only for necessary information. Do not send cookies, passwords, or migration credentials. Requests should be handled promptly as required by law. If technical separation, backups, disputes, or legal retention obligations prevent immediate completion, reasons, scope, and subsequent arrangements should be explained. Where law requires other processing to stop, retained data are restricted to necessary storage and security rather than returned to ordinary monitoring. Restoration requires checking previously handled rights requests. Statutory rights are not limited to existing interface buttons. You may complain to the competent regulator.

13. Minors and learning contexts

The service is for users able to lawfully authorize their accounts and devices. Minors require appropriate guardian authorization and must follow school rules. Account connection is not directed to children under 14. There is currently no age-verification mechanism; contact maintainers if children’s information may have been processed without required authorization so it can be investigated and handled under law.

Names, student numbers, and classroom events are used for reminders, not to judge another person’s attendance or performance. School and teacher records through official channels remain authoritative.

14. Changes and language versions

Material changes to data categories, purposes, hosting, or recipients will be described here and dated. Updating text or continued use cannot replace legally required additional notice, separate consent, or other procedures. The language versions aim to describe the same scope; differences do not diminish your rights under applicable law.

15. Contact

For privacy questions, rights requests, support, or infringement reports, contact maintainer 唐梓耀 / AdrianSparkle on QQ at 2410710390. The developer’s public profile is https://github.com/Tang1206cc. Identify the product, version, and your request. Do not include passwords, login cookies, connection codes, entire recordings, or unnecessary personal information in your initial message.

Specify “Rain Alert / 雨水提醒” and the scope of your request. For another selected student’s information, provide minimal event-time and course context rather than publicly posting a full name and student number.

15. Friend pools, individual authorization, and co-study assistance

The Co-study friend pool always includes its owner and supports up to five friends, isolated by owner account and current device. Each friend must personally confirm official QR sign-in. The service stores the returned account identifier, display profile, and official session to verify identity, show sign-in status, and assist with entry following an active scan request. Friend passwords are neither requested nor stored. Official credentials are processed by the server, not solely on the scanning phone. Friend sessions are kept outside the owner’s reminder-account table and do not automatically enable classroom reminders for those friends.

Friend profiles and credentials are encrypted in a separate friend database. Owner/device associations, statuses, timestamps, and other operational fields do not amount to whole-database encryption. The current device holder can view friend display names, available avatars, and sign-in status and initiate assistance. Friends should understand this scope and authorize only trusted, permitted devices. The service may retrieve display avatars from permitted official sources, whose rules govern those requests.

Help friends co-study uses the camera or an image only when you initiate it. The browser decodes the QR locally. The service receives its text and uses each pooled account’s session separately to check the classroom, submit supported requests, and verify official results. This can change official entry records; it neither answers exercises nor responds to roll calls. Video and selected images are not uploaded; decoded text is used for that operation. Jobs and results are held temporarily in process memory, not as permanent records or proof of physical attendance.

Removing a friend deletes that pool’s matching record and invalidates old jobs without sending an official sign-out request for the friend. Signing out, switching owner accounts, or revoking the device invalidates friend credentials for that owner/device pool. Expired devices are handled during maintenance. Friend relationships and profiles remain as invalid records, without a uniform automatic deletion deadline; reauthorize the same friend or request deletion. Other valid devices’ pools are unaffected. An expired owner official login does not automatically invalidate friend credentials while the device session remains valid, so valid friends may still be assisted. The separate friend database is included in existing encrypted backups; deleting online records does not simultaneously erase historical backups.