Maxfiylik siyosati — Olympy (Prolymp)

1. Kirish

Ushbu Maxfiylik siyosati Olympy (brend/sayt: prolymp.uz) onlayn olimpiada va ta’lim platformasi foydalanuvchilarining shaxsiy ma’lumotlarini qanday yig‘ishimiz, ishlatishimiz, saqlashimiz va himoya qilishimizni tushuntiradi. Platformadan foydalanish orqali siz ushbu siyosat shartlariga rozilik bildirasiz.

Operator / ishlab chiquvchi: Olympy (Prolymp)

Veb-sayt: https://prolymp.uz

Aloqa: sanjarruzmetov017@gmail.com

Telegram: @proskilluz

2. Qanday ma’lumotlarni yig‘amiz

Biz faqat platformani ishlatish uchun zarur bo‘lgan ma’lumotlarni yig‘amiz.

2.1. Siz taqdim etadigan ma’lumotlar

Hisob ma’lumotlari: telefon raqami (asosiy identifikator), to‘liq ism, ixtiyoriy username, parol (xeshlab saqlanadi).
Profil: avatar rasmi, fanlar, sinf/bosqich, o‘quv maqsadlari, onboarding sozlamalari.
Telegram bog‘lanishi: telefon tasdiqlash, parol tiklash va bildirishnomalar uchun Telegram foydalanuvchi/chat identifikatorlari.
Ta’lim faoliyati: olimpiada/test urinishlari, javoblar, ballar, reyting, sertifikatlar, amaliyot natijalari, kod yechimlari.
Tashkilot ma’lumotlari: o‘quv markazi nomi, manzil/hudud, a’zolik (o‘quvchi, o‘qituvchi, menejer, direktor), markaz rasmlari.
Ota-ona bog‘lanishi: ota-ona farzand hisobiga telefon orqali so‘rov yuboradi; farzand tasdiqlagach, progress ko‘rinadi (farzand telefoni ota-onaga qaytarilmaydi).
To‘lovlar: obuna reja, summa, to‘lov holati va provayder tranzaksiya ID (Click / Payme). Karta raqami bizning serverlarimizda saqlanmaydi.
Qo‘llab-quvvatlash: AI yordamchi va admin chat xabarlari.
2FA (ixtiyoriy): TOTP maxfiy kaliti shifrlangan holda saqlanadi.

2.2. Avtomatik yig‘iladigan ma’lumotlar

Autentifikatsiya cookie’lari (JWT) va brauzer/ilova xotirasi (localStorage/sessionStorage) — sessiya, token va vaqtinchalik test holati.
Xavfsizlik loglari: muvaffaqiyatsiz login urinishlari, IP asosidagi himoya (brute-force oldini olish).
Texnik xatolik monitoringi (Sentry): qurilma/brauzer haqida cheklangan diagnostika ma’lumotlari.
Foydalanish metrikalar: streak, coin, faollik sanalari, analitika (admin/markaz panellari uchun agregat ko‘rsatkichlar).

3. Ma’lumotlardan qanday foydalanamiz

Hisob yaratish, telefon orqali kirish va xavfsizlikni ta’minlash.
Olimpiadalar, testlar, liderbord, sertifikatlar va o‘quv progressini ko‘rsatish.
Markazlar, o‘qituvchilar va ota-onalar uchun boshqaruv panellari va hisobotlar.
Premium/obuna xizmatlari va to‘lovlarni qayta ishlash.
Telegram orqali OTP, eslatma va xizmat bildirishnomalari yuborish.
AI yordamida savol generatsiyasi, PDF import, yordamchi chat va menejer bot funksiyalari.
Xavfsizlik, firibgarlik oldini olish, xatoliklarni tuzatish va xizmat sifatini yaxshilash.
Qonuniy majburiyatlarni bajarish.

4. Uchinchi tomon xizmatlari

Xizmatni taqdim etish uchun ishonchli provayderlar bilan ishlaymiz. Ular faqat o‘z vazifasi doirasida ma’lumot oladi:

Xizmat	Maqsad
Telegram	Telefon tasdiqlash, parol tiklash, bildirishnomalar, bot integratsiyasi
Click / Payme	Obuna to‘lovlarini qabul qilish (to‘lov ma’lumotlari provayderda qayta ishlanadi)
OpenAI / Google Gemini	AI savol generatsiyasi, PDF tahlili, yordamchi chat, menejer bot
Cloudinary	Avatar va markaz rasmlarini saqlash
Sentry	Ilova xatoliklarini monitoring qilish
Judge0	Dasturlash savollari uchun kodni ishga tushirish
Mailgun (ixtiyoriy)	Xizmat xabarlari (agar email sozlangan bo‘lsa)
Hosting / DB / CDN	Render, PostgreSQL/Supabase, Redis, Cloudflare va boshqa infratuzilma
Google Fonts	Interfeys shriftlarini yuklash

Biz shaxsiy ma’lumotlarni reklama tarmoqlariga sotmaymiz.

5. Cookie va mahalliy saqlash

HttpOnly cookie’lar: autentifikatsiya (kirish sessiyasi).
localStorage / sessionStorage: token, foydalanuvchi sessiyasi, test holati, yo‘naltirish va UI sozlamalari.
Bu ma’lumotlar asosan xizmat ishlashi uchun kerak; brauzer sozlamalaridan cookie’larni o‘chirishingiz mumkin (bunda qayta kirish talab qilinadi).

6. Ma’lumotlarni saqlash muddati

Hisob ma’lumotlari — hisob faol bo‘lgan davrda va o‘chirish so‘rovidan keyin tizimdan olib tashlanguncha.
Test natijalari va reyting — ta’lim tarixi va hisobotlar uchun saqlanadi (hisob o‘chirilganda bog‘liq yozuvlar odatda o‘chiriladi).
To‘lov yozuvlari — buxgalteriya va nizolarni hal qilish uchun qonuniy muddat davomida saqlanishi mumkin.
Xavfsizlik va audit loglari — cheklangan muddatga saqlanadi.

7. Xavfsizlik

Biz quyidagi himoya choralarini qo‘llaymiz (to‘liq ro‘yxat emas):

Parollarni xeshlash; JWT cookie autentifikatsiyasi; ixtiyoriy 2FA (TOTP, shifrlangan kalit).
HTTPS, xavfsizlik headerlari, CSRF himoyasi, so‘rov cheklovlari (rate limit), admin brute-force himoyasi.
Telefon raqamlarini loglarda maskalash; rasm yuklash validatsiyasi.

Internet orqali uzatish 100% xavfsiz bo‘lishi kafolatlanmaydi. Shubhali faoliyatni darhol bizga xabar bering.

8. Bolalar va o‘quvchilar

Olympy ta’lim platformasi bo‘lib, maktab o‘quvchilari undan foydalanishi mumkin. Ota-ona/vasiy farzand progressini kuzatishi uchun bog‘lanish funksiyasi mavjud; bog‘lanish farzand tasdig‘ini talab qiladi. Agar bolaning ma’lumotlari ota-ona roziligisiz yig‘ilgan deb hisoblasangiz, biz bilan bog‘laning — tegishli choralarni ko‘ramiz.

9. Sizning huquqlaringiz

Kirish va tuzatish: profil va sozlamalar orqali ma’lumotlaringizni ko‘rish/yangilash.
Hisobni o‘chirish: autentifikatsiya qilingan foydalanuvchi hisobini o‘chirish mumkin (markaz egasi avval egalikni o‘tkazishi kerak; platforma admini o‘z hisobini o‘chira olmaydi).
Telegram bog‘lanishini bekor qilish va ota-ona bog‘lanishini uzish.
Eksport: markaz rahbarlari a’zolar/natijalarni Excel ko‘rinishida yuklab olishi mumkin (ruxsat doirasida).

So‘rov uchun: sanjarruzmetov017@gmail.com

10. Ma’lumotlarni oshkor qilish

Shaxsiy ma’lumotlaringizni quyidagi holatlarda ulashishimiz mumkin:

Siz a’zo bo‘lgan o‘quv markazi rahbariyati/o‘qituvchilari (ta’lim maqsadida, ruxsat doirasida).
Tasdiqlangan ota-ona/vasiy (progress va hisobotlar).
To‘lov, hosting, AI va monitoring provayderlari (xizmat ko‘rsatish uchun).
Qonun talab qilganda yoki huquqlarimizni himoya qilish zarur bo‘lganda.

11. Xalqaro uzatish

Serverlar va uchinchi tomon xizmatlari turli mamlakatlarda joylashgan bo‘lishi mumkin. Ma’lumotlar xizmat ko‘rsatish uchun shu infratuzilma orqali qayta ishlanishi mumkin.

12. Siyosat o‘zgarishlari

Biz ushbu Maxfiylik siyosatini vaqti-vaqti bilan yangilashimiz mumkin. Yangilangan versiya ushbu sahifada e’lon qilinadi va “Oxirgi yangilanish” sanasi o‘zgaradi. Muhim o‘zgarishlarda ilova yoki sayt orqali xabar berishga harakat qilamiz.

13. Bog‘lanish

Maxfiylik bo‘yicha savollar, so‘rovlar yoki shikoyatlar uchun:

1. Introduction

This Privacy Policy explains how Olympy (brand/site: prolymp.uz), an online olympiad and education platform, collects, uses, stores, and protects personal information. By using the Service (website and mobile apps), you agree to this Policy.

Operator / developer: Olympy (Prolymp)

Website: https://prolymp.uz

Contact: sanjarruzmetov017@gmail.com

Telegram: @proskilluz

2. Information we collect

We collect only what is needed to operate the platform.

2.1. Information you provide

Account data: phone number (primary identifier), full name, optional username, password (stored hashed).
Profile: avatar image, subjects, grade/level, learning goals, onboarding preferences.
Telegram linkage: Telegram user/chat IDs for phone verification, password reset, and notifications.
Learning activity: olympiad/test attempts, answers, scores, rankings, certificates, practice results, code submissions.
Organization data: education center details, memberships (student, teacher, manager, owner), center images.
Parent linking: a parent may request a link via the student’s phone; progress is shown only after student confirmation (the child’s phone is not returned to the parent in API responses).
Payments: subscription plan, amount, status, and provider transaction IDs (Click / Payme). We do not store full card numbers on our servers.
Support: AI assistant and admin support chat messages.
Optional 2FA: TOTP secrets stored encrypted.

2.2. Information collected automatically

Authentication cookies (JWT) and local/session storage for sessions, tokens, and temporary test state.
Security logs: failed login attempts and anti-abuse protections.
Error monitoring (Sentry): limited device/browser diagnostics.
Usage metrics: streaks, coins, activity dates, and aggregate analytics for admin/center dashboards.

3. How we use information

Create accounts, authenticate users by phone, and protect accounts.
Run olympiads/tests, leaderboards, certificates, and learning progress.
Provide dashboards and reports for centers, teachers, and parents.
Process premium subscriptions and payments.
Send OTP, reminders, and service notifications via Telegram.
Power AI features (question generation, PDF import, support chat, manager bot).
Security, fraud prevention, debugging, and service improvement.
Comply with legal obligations.

4. Third-party services

We use trusted processors only as needed to provide the Service:

Service	Purpose
Telegram	Phone verification, password reset, notifications, bots
Click / Payme	Subscription payments (card data processed by the provider)
OpenAI / Google Gemini	AI generation, PDF analysis, support chat, manager bot
Cloudinary	Avatar and center image hosting
Sentry	Application error monitoring
Judge0	Code execution for programming tasks
Mailgun (optional)	Transactional email if configured
Hosting / DB / CDN	Render, PostgreSQL/Supabase, Redis, Cloudflare, and related infrastructure
Google Fonts	UI font delivery

We do not sell personal information to advertising networks.

5. Cookies and local storage

HttpOnly cookies: authentication session.
localStorage / sessionStorage: tokens, user session, test state, redirects, and UI preferences.
These are primarily required for core functionality. Clearing cookies will require signing in again.

6. Data retention

Account data — while the account is active and until deletion is processed.
Test results and rankings — for learning history and reports (related records are generally removed when an account is deleted).
Payment records — may be retained for accounting and dispute resolution as required by law.
Security and audit logs — retained for a limited period.

7. Security

We implement safeguards such as:

Password hashing; JWT cookie auth; optional encrypted TOTP 2FA.
HTTPS, security headers, CSRF protection, rate limiting, admin brute-force protection.
Phone masking in logs; image upload validation.

No method of transmission over the Internet is 100% secure. Please report suspicious activity immediately.

8. Children and students

Olympy is an education platform and may be used by school students. Parent/guardian linking requires student confirmation before progress is shared. If you believe a child’s data was collected without appropriate consent, contact us and we will take appropriate action.

9. Your rights

Access and correction: view/update profile data in the app.
Account deletion: authenticated users may delete their account (organization owners must transfer ownership first; platform admins cannot self-delete).
Unlink Telegram and disconnect parent–student links.
Export: authorized center managers may export members/results to Excel within their permissions.

Requests: sanjarruzmetov017@gmail.com

10. Sharing of information

We may share personal data with:

Education centers you join (staff with appropriate roles), for educational purposes.
Confirmed parents/guardians (progress and reports).
Payment, hosting, AI, and monitoring processors needed to run the Service.
Authorities when required by law or to protect our rights.

11. International transfers

Servers and third-party services may be located in different countries. Data may be processed through that infrastructure to provide the Service.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date. For material changes, we will try to notify users via the app or website.

13. Contact

For privacy questions, requests, or complaints: