How upload works (in order)
- You drop the OMR JPG/PNG into the upload box.
- It’s read into memory, graded against the official ACPC answer key, and the in-memory bytes are released. The image is never written to disk and never leaves the request handler.
- Your seat number is HMAC-SHA-256 hashed with a server-side pepper. The hash, your branch, and your scores are saved.
- The plaintext seat number is dropped before the database write.
- You get redirected to a page keyed by an auto-generated nickname (e.g.
CyberGlitch4092).
What we store
- roll_hash – HMAC of your seat number. Practically irreversible without the server pepper. Used only to keep your nickname stable across re-uploads.
- nickname – auto-generated handle (adjective + branch noun + 4-digit suffix). The only public identifier on this site.
- branch – the preferred branch you picked from the dropdown.
- scores – BE01, BE02, total, right/wrong/attempted counts.
- raw answers (A/B/C/D/E) – per question, so we can re-grade you when ACPC publishes a key revision.
- graded_at – when we processed your sheet. Stored in IST.
What we explicitly do not store
- Your seat number. The plaintext is discarded after hashing.
- The OMR image. Deleted from memory the moment your result is computed; never persisted to disk, S3, or anywhere else.
- Your name, phone number, email address, photograph, signature region of the sheet – any of it.
- A link between your IP address and your result in our database. Server logs and the Microsoft Clarity analytics pixel (see below) do see IPs for rate-limiting and geo-region stats, but the results collection itself doesn’t carry an IP field at all.
Answer keys are always official
We grade only against the official ACPC answer keys. When ACPC issues a revision, every stored result is re-scored automatically against the new key – you don’t need to re-upload. The full keys we use are public on the answer keys page; cross-check them against the official PDF before trusting your score.
What’s public
The leaderboard shows nickname, series, section marks, totals, and preferred branch. That’s it. Without the seat number, no one (including us) can map a leaderboard row back to a specific student.
What we don’t do
- We don’t sell or share data with third parties.
- We don’t run any advertising network on this site – no banner ads, no Google AdSense, no affiliate trackers.
- We don’t ask for your name, phone, email, or any personally identifying info.
- We don’t store the OMR image, even temporarily on disk.
Analytics – Microsoft Clarity
We use Microsoft Clarity for site analytics: anonymous click /
scroll heatmaps and session recordings that help us spot UX bugs (e.g. an upload
button that nobody can find). Clarity runs in your browser as third-party JavaScript
from www.clarity.ms; what it captures is governed by Microsoft’s
privacy statement.
Clarity does not see your seat number (we never render or store it), and it cannot deanonymise the leaderboard – the rows it captures show only your auto-generated nickname. If you want to opt out of Clarity specifically, install a tracker blocker like uBlock Origin, or enable “Do Not Track” in your browser; Clarity respects DNT.
Server logs
Standard request metadata (IP, user-agent, timestamp) is kept short-term for rate-limiting and abuse protection. It’s isolated from the results database – nothing in the logs links back to your scores or nickname.
Removal requests
The leaderboard only gives meaningful rank estimates if it’s complete, so we don’t remove individual entries. Because we don’t store the seat number, we genuinely cannot identify a specific student’s row to remove on request. If you’d rather not be listed at all, don’t upload – the tool will still be free for everyone else.
Contact
Questions? Email [email protected].