diff --git a/.env.example b/.env.example
index 3837642e..12f40f07 100644
--- a/.env.example
+++ b/.env.example
@@ -12,6 +12,12 @@ DB_HOST=localhost
 DB_PORT=5432
 DB_NAME=tigertype
 
+## Feedback Email
+FEEDBACK_EMAIL_FROM=cs-tigertype@princeton.edu
+FEEDBACK_EMAIL_TO_TEAM=cs-tigertype@princeton.edu,it.admin@tigerapps.org
+FEEDBACK_REPLY_TO=cs-tigertype@princeton.edu,it.admin@tigerapps.org
+SITE_URL=https://tigertype.tigerapps.org
+
 # Scraping Configuration
 OPENAI_API_KEY=your_api_key_here
 PRINCETON_API_KEY=""
@@ -43,3 +49,11 @@ CHANGELOG_PUBLISH_TOKEN=your_shared_secret_token
 
 # Start PostgreSQL service
 # brew services start postgresql
+
+# Delegated SMTP OAuth (device code, cached)
+# Run: node server/scripts/seed_smtp_oauth_device_login.js (saves a cache file and prints JSON)
+# For Heroku, set SMTP_OAUTH_CACHE to the printed JSON
+AZURE_TENANT_ID=
+AZURE_CLIENT_ID=
+SMTP_SENDER=cs-tigertype@princeton.edu
+SMTP_OAUTH_CACHE=  (optional; JSON blob of MSAL cache for headless servers)
diff --git a/.gitignore b/.gitignore
index d55778a4..b5643184 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,6 +14,7 @@ AGENTS.*
 # Environment and Configuration
 .env
 .venv
+server/.smtp_oauth_cache.json
 
 # Dependencies
 node_modules
@@ -34,4 +35,4 @@ __pycache__
 .gitattributes
 
 # Miscellaneous
-.bak
\ No newline at end of file
+.bak
diff --git a/client/src/components/FeedbackModal.css b/client/src/components/FeedbackModal.css
new file mode 100644
index 00000000..163e088f
--- /dev/null
+++ b/client/src/components/FeedbackModal.css
@@ -0,0 +1,124 @@
+.feedback-form {
+  display: flex;
+  flex-direction: column;
+  gap: 1.25rem;
+}
+
+.feedback-form label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  font-size: 0.95rem;
+  color: var(--mode-text-color, #f5f5f5);
+}
+
+.feedback-form select,
+.feedback-form textarea,
+.feedback-form input {
+  width: 100%;
+  padding: 0.75rem;
+  border-radius: 8px;
+  border: 1px solid rgba(245, 128, 37, 0.25);
+  background: var(--input-bg, rgba(18, 18, 18, 0.85));
+  color: var(--mode-text-color, #f5f5f5);
+  font-family: inherit;
+  font-size: 0.95rem;
+  transition: border-color 0.2s ease, box-shadow 0.2s ease;
+}
+
+.feedback-form select:focus,
+.feedback-form textarea:focus,
+.feedback-form input:focus {
+  outline: none;
+  border-color: #F58025;
+  box-shadow: 0 0 0 2px rgba(245, 128, 37, 0.2);
+}
+
+.feedback-form textarea {
+  min-height: 160px;
+  resize: vertical;
+}
+
+.feedback-hint {
+  font-size: 0.8rem;
+  color: var(--subtle-text-color, rgba(255, 255, 255, 0.6));
+  align-self: flex-end;
+}
+
+.feedback-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.75rem;
+}
+
+.feedback-primary-button,
+.feedback-secondary-button {
+  padding: 0.65rem 1.4rem;
+  border-radius: 6px;
+  font-weight: 600;
+  cursor: pointer;
+  transition: transform 0.2s ease, box-shadow 0.2s ease, background-color 0.2s ease;
+  border: none;
+}
+
+.feedback-primary-button {
+  background-color: #F58025;
+  color: #121212;
+  box-shadow: 0 2px 8px rgba(245, 128, 37, 0.35);
+}
+
+.feedback-primary-button:hover:not(:disabled) {
+  transform: translateY(-1px);
+  box-shadow: 0 4px 10px rgba(245, 128, 37, 0.4);
+}
+
+.feedback-secondary-button {
+  background: transparent;
+  border: 1px solid rgba(245, 128, 37, 0.5);
+  color: var(--mode-text-color, #f5f5f5);
+}
+
+.feedback-secondary-button:hover:not(:disabled) {
+  transform: translateY(-1px);
+  border-color: #F58025;
+}
+
+.feedback-primary-button:disabled,
+.feedback-secondary-button:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+  transform: none;
+  box-shadow: none;
+}
+
+.feedback-error {
+  margin: 0;
+  color: #ff7676;
+  font-size: 0.85rem;
+}
+
+.feedback-success {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+  font-size: 0.95rem;
+  color: var(--mode-text-color, #f5f5f5);
+  align-items: center;
+  text-align: center;
+}
+
+.feedback-success p {
+  margin: 0;
+  line-height: 1.5;
+}
+
+.feedback-success .feedback-primary-button {
+  min-width: 220px;
+}
+
+@media (max-width: 600px) {
+  .feedback-actions {
+    flex-direction: column;
+    align-items: stretch;
+  }
+}
diff --git a/client/src/components/FeedbackModal.jsx b/client/src/components/FeedbackModal.jsx
new file mode 100644
index 00000000..cb9130b0
--- /dev/null
+++ b/client/src/components/FeedbackModal.jsx
@@ -0,0 +1,172 @@
+import { useEffect, useState } from 'react';
+import PropTypes from 'prop-types';
+import Modal from './Modal';
+import './FeedbackModal.css';
+import { useAuth } from '../context/AuthContext';
+
+const CATEGORY_OPTIONS = [
+  { value: 'feedback', label: 'General feedback' },
+  { value: 'bug', label: 'Report a bug' },
+  { value: 'idea', label: 'Feature request' },
+  { value: 'other', label: 'Something else' }
+];
+
+function FeedbackModal({ isOpen, onClose }) {
+  const { authenticated, user } = useAuth();
+  const [category, setCategory] = useState('feedback');
+  const [message, setMessage] = useState('');
+  const [contactInfo, setContactInfo] = useState('');
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState('');
+  const [submitted, setSubmitted] = useState(false);
+
+  useEffect(() => {
+    if (isOpen) {
+      setCategory('feedback');
+      setMessage('');
+      setError('');
+      setSubmitted(false);
+      if (authenticated && user?.netid) {
+        setContactInfo(`${user.netid}@princeton.edu`);
+      } else {
+        setContactInfo('');
+      }
+    }
+  }, [isOpen, authenticated, user]);
+
+  const closeIfAllowed = () => {
+    if (!submitting) {
+      onClose();
+    }
+  };
+
+  const handleSubmit = async (event) => {
+    event.preventDefault();
+    if (submitting) return;
+
+    const trimmedMessage = message.trim();
+    if (trimmedMessage.length < 10) {
+      setError('Please include at least a few details so we can help.');
+      return;
+    }
+
+    setSubmitting(true);
+    setError('');
+
+    try {
+      const response = await fetch('/api/feedback', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          category,
+          message: trimmedMessage,
+          contactInfo: contactInfo.trim() || null,
+          pagePath: typeof window !== 'undefined' ? window.location.pathname : null
+        })
+      });
+
+      if (!response.ok) {
+        const data = await response.json().catch(() => ({}));
+        throw new Error(data.error || 'Unable to send feedback right now.');
+      }
+
+      setSubmitted(true);
+      setMessage('');
+    } catch (err) {
+      setError(err.message || 'Unable to send feedback right now.');
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  return (
+    <Modal
+      isOpen={isOpen}
+      onClose={closeIfAllowed}
+      title={submitted ? 'Thanks for your feedback!' : 'Send Feedback'}
+      showCloseButton
+      isLarge={!submitted}
+    >
+      {submitted ? (
+        <div className="feedback-success">
+          <p>We appreciate you taking the time to help improve TigerType.</p>
+          <button
+            type="button"
+            className="feedback-primary-button"
+            onClick={closeIfAllowed}
+          >
+            Close
+          </button>
+        </div>
+      ) : (
+        <form className="feedback-form" onSubmit={handleSubmit}>
+          <label>
+            Category
+            <select
+              value={category}
+              onChange={(event) => setCategory(event.target.value)}
+              disabled={submitting}
+            >
+              {CATEGORY_OPTIONS.map(option => (
+                <option key={option.value} value={option.value}>
+                  {option.label}
+                </option>
+              ))}
+            </select>
+          </label>
+
+          <label>
+            Describe what happened
+            <textarea
+              value={message}
+              onChange={(event) => setMessage(event.target.value)}
+              disabled={submitting}
+              rows={8}
+              maxLength={2000}
+              placeholder="Share details, steps to reproduce, or anything else we should know."
+            />
+            <span className="feedback-hint">{message.trim().length}/2000 characters</span>
+          </label>
+
+          <label>
+            Contact (optional)
+            <input
+              type="email"
+              value={contactInfo}
+              onChange={(event) => setContactInfo(event.target.value)}
+              disabled={submitting}
+              placeholder="we'll follow up here if we need more info"
+            />
+          </label>
+
+          {error && <p className="feedback-error">{error}</p>}
+
+          <div className="feedback-actions">
+            <button
+              type="button"
+              className="feedback-secondary-button"
+              onClick={closeIfAllowed}
+              disabled={submitting}
+            >
+              Cancel
+            </button>
+            <button
+              type="submit"
+              className="feedback-primary-button"
+              disabled={submitting}
+            >
+              {submitting ? 'Sending…' : 'Send feedback'}
+            </button>
+          </div>
+        </form>
+      )}
+    </Modal>
+  );
+}
+
+FeedbackModal.propTypes = {
+  isOpen: PropTypes.bool.isRequired,
+  onClose: PropTypes.func.isRequired
+};
+
+export default FeedbackModal;
diff --git a/client/src/components/Navbar.css b/client/src/components/Navbar.css
index 93604570..23be22b6 100644
--- a/client/src/components/Navbar.css
+++ b/client/src/components/Navbar.css
@@ -26,6 +26,26 @@
   gap: 0.5rem;
 }
 
+.navbar-feedback-icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 36px;
+  height: 36px;
+  color: var(--mode-text-color);
+  border-radius: 6px;
+  transition: background-color 0.2s ease, color 0.2s ease, transform 0.2s ease;
+  background: none;
+  border: none;
+  cursor: pointer;
+}
+
+.navbar-feedback-icon:hover {
+  background-color: rgba(245, 128, 37, 0.1);
+  color: #F58025;
+  transform: translateY(-1px);
+}
+
 .settings-button-wrapper {
   position: relative;
   display: inline-flex;
@@ -104,6 +124,7 @@
   transform: rotate(90deg);
 }
 .navbar-icons button:focus-visible,
+.navbar-feedback-icon:focus-visible,
 .navbar-github-icon:focus-visible,
 .navbar-logo button:focus-visible {
   outline: 2px solid #F58025;
diff --git a/client/src/components/Navbar.jsx b/client/src/components/Navbar.jsx
index 332f45b6..1eb7e463 100644
--- a/client/src/components/Navbar.jsx
+++ b/client/src/components/Navbar.jsx
@@ -9,6 +9,7 @@ import PropTypes from 'prop-types'; // Import PropTypes
 import navbarLogo from '../assets/logos/navbar-logo.png';
 import TutorialGuide from './TutorialGuide'; // Import TutorialGuide
 import { useTutorial } from '../context/TutorialContext';
+import FeedbackModal from './FeedbackModal';
 
 function Navbar({ onOpenLeaderboard, onLoginClick }) {
   const [isSettingsOpen, setIsSettingsOpen] = useState(false);
@@ -16,15 +17,11 @@ function Navbar({ onOpenLeaderboard, onLoginClick }) {
   const { authenticated, user, logout, markTutorialComplete } = useAuth();
   const { isTutorialRunning, startTutorial, endTutorial } = useTutorial();
   const navigate = useNavigate();
-  const {
-    raceState,
-    typingState,
-    setPlayerReady,
-    resetRace
-  } = useRace();
+  const { resetRace } = useRace();
 
   // State to track hover state of each link
   const [hoveredLink, setHoveredLink] = useState(null);
+  const [isFeedbackOpen, setIsFeedbackOpen] = useState(false);
 
   const settingsButtonLabel = user?.has_unseen_changelog ? 'Open settings (new changelog available)' : 'Open settings';
 
@@ -126,6 +123,15 @@ function Navbar({ onOpenLeaderboard, onLoginClick }) {
               />
             </svg>
           </a>
+          <button
+            type="button"
+            className="navbar-feedback-icon"
+            onClick={() => setIsFeedbackOpen(true)}
+            title="Send feedback or report a bug"
+            aria-label="Send feedback or report a bug"
+          >
+            <span className="material-icons" aria-hidden="true">bug_report</span>
+          </button>
         </div>
       </div>
       <nav className="navbar-links">
@@ -188,6 +194,10 @@ function Navbar({ onOpenLeaderboard, onLoginClick }) {
         onClose={handleCloseSettings}
         initialTab={settingsStartTab}
       />
+      <FeedbackModal
+        isOpen={isFeedbackOpen}
+        onClose={() => setIsFeedbackOpen(false)}
+      />
     </header>
   );
 }
diff --git a/package.json b/package.json
index 4ea00696..e68f66c2 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
     "changelog:publish": "node server/scripts/publish-changelog.js"
   },
   "dependencies": {
+    "@azure/msal-node": "^3.8.1",
     "@jridgewell/gen-mapping": "^0.3.8",
     "aws-sdk": "^2.1692.0",
     "axios": "^1.6.2",
@@ -34,6 +35,7 @@
     "express": "^4.18.2",
     "express-session": "^1.17.3",
     "multer": ">=2.0.2",
+    "nodemailer": "^7.0.10",
     "pg": "^8.11.3",
     "promptly": "^3.2.0",
     "request": "^2.88.2",
diff --git a/server/routes/api.js b/server/routes/api.js
index 11f34aaf..9e049173 100644
--- a/server/routes/api.js
+++ b/server/routes/api.js
@@ -8,6 +8,7 @@ const { isAuthenticated } = require('../utils/auth');
 const UserModel = require('../models/user');
 const SnippetModel = require('../models/snippet');
 const RaceModel = require('../models/race');
+const { sendFeedbackEmails } = require('../utils/email');
 const ChangelogModel = require('../models/changelog');
 const profileRoutes = require('./profileRoutes'); // Import profile routes
 const { pool } = require('../config/database');
@@ -113,10 +114,81 @@ router.get('/public/leaderboard/timed', async (req, res) => {
 // --- Authenticated Profile Routes ---
 // All profile routes require authentication + are mounted under /profile
 router.use('/profile', requireAuth, profileRoutes);
-router.use('/profile', requireAuth, profileRoutes); 
 
 // --- Existing API Routes ---
 
+// simple in-memory rate limiting for feedback (per caller key)
+const FEEDBACK_LIMIT_WINDOW_MS = 5 * 60 * 1000; // 5 minutes
+const FEEDBACK_LIMIT_COUNT = 10; // max 10 submissions per window
+const feedbackRate = new Map(); // key -> { windowStart, count }
+
+function isRateLimited(key) {
+  const now = Date.now();
+  const entry = feedbackRate.get(key);
+  if (!entry || (now - entry.windowStart) > FEEDBACK_LIMIT_WINDOW_MS) {
+    feedbackRate.set(key, { windowStart: now, count: 1 });
+    return false;
+  }
+  entry.count += 1;
+  if (entry.count > FEEDBACK_LIMIT_COUNT) return true;
+  return false;
+}
+
+router.post('/feedback', async (req, res) => {
+  try {
+    // Use req.ip which honors Express trust proxy; doesn't trust raw X-Forwarded-For header
+    const clientIp = (req.ip || req.connection?.remoteAddress || req.socket?.remoteAddress || '').toString();
+    const key = (isAuthenticated(req) && req.session?.userInfo?.user)
+      ? `uid:${req.session.userInfo.user}|ip:${clientIp}`
+      : `ip:${clientIp}`;
+    if (isRateLimited(key)) {
+      return res.status(429).json({ error: 'Too many feedback submissions. Please try again later.' });
+    }
+    const { category = 'feedback', message, contactInfo, pagePath } = req.body || {};
+
+    if (!message || typeof message !== 'string' || message.trim().length < 10) {
+      return res.status(400).json({ error: 'Please include a description with at least 10 characters so we can help.' });
+    }
+
+    const sanitizedMessage = message.trim().slice(0, 4000);
+    const sanitizedContact = typeof contactInfo === 'string' ? contactInfo.trim().slice(0, 255) : null;
+    const sanitizedPagePath = typeof pagePath === 'string' ? pagePath.trim().slice(0, 255) : null;
+
+    let netid = null;
+    if (isAuthenticated(req)) {
+      if (!req.user && req.session?.userInfo) {
+        req.user = {
+          id: req.session.userInfo.userId,
+          netid: req.session.userInfo.user
+        };
+      }
+      netid = req.user?.netid || req.session?.userInfo?.user || null;
+    }
+
+    const userAgent = req.get('user-agent')?.slice(0, 500) || null;
+
+    // acknowledgement policy: only ack authenticated users at their Princeton address
+    const ackTo = (isAuthenticated(req) && netid) ? `${netid}@princeton.edu` : null;
+
+    // fire and forget to avoid hanging if mail provider is slow
+    sendFeedbackEmails({
+      category,
+      message: sanitizedMessage,
+      contactInfo: sanitizedContact,
+      netid,
+      userAgent,
+      pagePath: sanitizedPagePath,
+      createdAt: new Date(),
+      ackTo
+    }).catch(err => console.warn('feedback email send failed', err));
+
+    return res.json({ success: true });
+  } catch (err) {
+    console.error('Error submitting feedback:', err);
+    return res.status(500).json({ error: 'Unable to submit feedback right now. Please try again later.' });
+  }
+});
+
 /**
  * Mark tutorial as completed for the current user
  * PUT /api/user/tutorial-complete
diff --git a/server/scripts/seed_smtp_oauth_device_login.js b/server/scripts/seed_smtp_oauth_device_login.js
new file mode 100644
index 00000000..db5b4552
--- /dev/null
+++ b/server/scripts/seed_smtp_oauth_device_login.js
@@ -0,0 +1,57 @@
+// Seed delegated SMTP OAuth token cache via device code, then persist to file
+// Usage: node server/scripts/seed_smtp_oauth_device_login.js
+
+require('dotenv').config();
+const { PublicClientApplication } = require('@azure/msal-node');
+const fs = require('fs');
+const path = require('path');
+
+const tenantId = process.env.AZURE_TENANT_ID || process.env.TENANT_ID;
+const clientId = process.env.AZURE_CLIENT_ID || process.env.CLIENT_ID;
+const CACHE_PATH = process.env.SMTP_OAUTH_CACHE_PATH || path.join(__dirname, '..', '.smtp_oauth_cache.json');
+
+if (!tenantId || !clientId) {
+  console.error('Missing AZURE_TENANT_ID or AZURE_CLIENT_ID');
+  process.exit(1);
+}
+
+const SMTP_SCOPES = ['https://outlook.office365.com/SMTP.Send', 'offline_access', 'openid', 'email'];
+
+const tokenCachePlugin = {
+  beforeCacheAccess: async (context) => {
+    try {
+      if (fs.existsSync(CACHE_PATH)) {
+        const data = fs.readFileSync(CACHE_PATH, 'utf-8');
+        context.tokenCache.deserialize(data);
+      }
+    } catch (_) {}
+  },
+  afterCacheAccess: async (context) => {
+    if (context.cacheHasChanged) {
+      try {
+        fs.writeFileSync(CACHE_PATH, context.tokenCache.serialize(), 'utf-8');
+      } catch (e) {
+        console.warn('Failed to write cache file', e);
+      }
+    }
+  }
+};
+
+const pca = new PublicClientApplication({
+  auth: { clientId, authority: `https://login.microsoftonline.com/${tenantId}` },
+  cache: { cachePlugin: tokenCachePlugin }
+});
+
+(async () => {
+  await pca.acquireTokenByDeviceCode({
+    scopes: SMTP_SCOPES,
+    deviceCodeCallback: (info) => console.log(info.message)
+  });
+  console.log('Access token acquired. Token cache stored at:', CACHE_PATH);
+  // Print cache JSON to stdout for copying into SMTP_OAUTH_CACHE env var (Heroku)
+  const cacheJson = await pca.getTokenCache().serialize();
+  console.log('--- BEGIN SMTP_OAUTH_CACHE JSON ---');
+  console.log(cacheJson);
+  console.log('--- END SMTP_OAUTH_CACHE JSON ---');
+  console.log('If deploying to Heroku, set config var SMTP_OAUTH_CACHE to the JSON above.');
+})();
diff --git a/server/scripts/test_feedback_email.js b/server/scripts/test_feedback_email.js
new file mode 100644
index 00000000..1088fdc3
--- /dev/null
+++ b/server/scripts/test_feedback_email.js
@@ -0,0 +1,44 @@
+// minimal test sender using the same helpers as the API
+require('dotenv').config();
+
+const { sendFeedbackEmails } = require('../utils/email');
+
+async function main() {
+  const to = process.argv[2] || process.env.TEST_EMAIL_TO;
+  const category = process.argv[3] || 'test';
+  const message = process.argv[4] || 'this is a test message from tigertype test script';
+
+  if (!to) {
+    console.error('Usage: node server/scripts/test_feedback_email.js <recipient-email> [category] [message]');
+    console.error('');
+    console.error('Examples:');
+    console.error('  node server/scripts/test_feedback_email.js ah0952@princeton.edu');
+    console.error('  node server/scripts/test_feedback_email.js ah0952@princeton.edu bug');
+    console.error('  node server/scripts/test_feedback_email.js ah0952@princeton.edu feature "I would like dark mode"');
+    console.error('');
+    console.error('Available categories: bug, feature, feedback, question, test');
+    process.exit(1);
+  }
+  try {
+    await sendFeedbackEmails({
+      category,
+      message,
+      contactInfo: to,
+      netid: null,
+      userAgent: 'script',
+      pagePath: '/test',
+      createdAt: new Date(),
+      // For this test script we force the acknowledgement to the provided email
+      ackTo: to
+    });
+    console.log(`✓ Test email(s) sent successfully!`);
+    console.log(`  Category: ${category}`);
+    console.log(`  To: ${to}`);
+    console.log(`  Message: "${message}"`);
+  } catch (e) {
+    console.error('✗ Send failed:', e.message);
+    process.exit(2);
+  }
+}
+
+main();
diff --git a/server/utils/email.js b/server/utils/email.js
new file mode 100644
index 00000000..aa44a2e3
--- /dev/null
+++ b/server/utils/email.js
@@ -0,0 +1,343 @@
+// SMTP OAuth (delegated) using MSAL public client + token cache
+const { PublicClientApplication } = require('@azure/msal-node');
+const fs = require('fs');
+const path = require('path');
+const nodemailer = require('nodemailer');
+
+const firstEnv = (...keys) => {
+  for (const k of keys) {
+    if (process.env[k]) return process.env[k];
+  }
+  return undefined;
+};
+
+const smtpUser = firstEnv('SMTP_SENDER', 'GRAPH_SENDER_USER', 'FEEDBACK_EMAIL_FROM');
+const tenantId = firstEnv('AZURE_TENANT_ID', 'TENANT_ID');
+const clientId = firstEnv('AZURE_CLIENT_ID', 'CLIENT_ID');
+const siteUrl = process.env.SITE_URL || 'https://tigertype.tigerapps.org';
+
+// token cache persistence
+const CACHE_ENV = 'SMTP_OAUTH_CACHE';
+const CACHE_PATH = process.env.SMTP_OAUTH_CACHE_PATH || path.join(__dirname, '..', '.smtp_oauth_cache.json');
+
+const tokenCachePlugin = {
+  beforeCacheAccess: async (context) => {
+    try {
+      const envJson = process.env[CACHE_ENV];
+      if (envJson) {
+        context.tokenCache.deserialize(envJson);
+        return;
+      }
+      if (fs.existsSync(CACHE_PATH)) {
+        const data = fs.readFileSync(CACHE_PATH, 'utf-8');
+        context.tokenCache.deserialize(data);
+      }
+    } catch (_) {}
+  },
+  afterCacheAccess: async (context) => {
+    if (context.cacheHasChanged) {
+      try {
+        fs.writeFileSync(CACHE_PATH, context.tokenCache.serialize(), 'utf-8');
+      } catch (_) {}
+    }
+  }
+};
+
+// Lazily create MSAL PCA only if SMTP OAuth is configured
+let pca = null;
+function getPcaInstance() {
+  if (!tenantId || !clientId) return null;
+  if (!pca) {
+    try {
+      pca = new PublicClientApplication({
+        auth: {
+          clientId,
+          authority: `https://login.microsoftonline.com/${tenantId}`
+        },
+        cache: { cachePlugin: tokenCachePlugin }
+      });
+    } catch (e) {
+      // If MSAL fails to construct (e.g., bad/missing config), treat as unconfigured
+      console.warn('msal init failed; feedback email disabled until configured:', e && e.message ? e.message : e);
+      pca = null;
+      return null;
+    }
+  }
+  return pca;
+}
+
+const SMTP_SCOPES = ['https://outlook.office365.com/SMTP.Send', 'offline_access', 'openid', 'email'];
+
+async function getSmtpAccessToken() {
+  const app = getPcaInstance();
+  if (!app) {
+    throw new Error('SMTP OAuth not configured');
+  }
+  const accounts = await app.getTokenCache().getAllAccounts();
+  if (accounts && accounts.length > 0) {
+    try {
+      const result = await app.acquireTokenSilent({ scopes: SMTP_SCOPES, account: accounts[0] });
+      return result.accessToken;
+    } catch (_) {
+      // fall through to device code seed requirement
+    }
+  }
+  throw new Error('No delegated SMTP token available. Run: node server/scripts/seed_smtp_oauth_device_login.js');
+}
+
+const sendMailGeneric = async ({ to, from, subject, text, html, replyTo, cc, attachments }) => {
+  if (!tenantId || !clientId) {
+    console.warn('feedback email disabled: missing AZURE_TENANT_ID/AZURE_CLIENT_ID (skipping send)');
+    return;
+  }
+  if (!from || !smtpUser) {
+    console.warn('feedback email disabled: missing From or SMTP user (skipping send)');
+    return;
+  }
+  let accessToken;
+  try {
+    accessToken = await getSmtpAccessToken();
+  } catch (e) {
+    console.warn('smtp oauth token unavailable; skipping send. seed with device code script.', e && e.message ? e.message : e);
+    return;
+  }
+  const transporter = nodemailer.createTransport({
+    host: 'smtp.office365.com',
+    port: 587,
+    secure: false,
+    requireTLS: true,
+    auth: {
+      type: 'OAuth2',
+      user: smtpUser,
+      accessToken
+    }
+  });
+  const mail = { from, to, subject, text };
+  if (html) mail.html = html;
+  if (replyTo) mail.replyTo = replyTo;
+  if (cc) mail.cc = cc;
+  if (!attachments) attachments = getLogoAttachment();
+  if (attachments && attachments.length) mail.attachments = attachments;
+  await transporter.sendMail(mail);
+};
+
+// quick email regex (declare early for clarity)
+const emailRe = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i;
+
+const sendFeedbackNotification = async ({
+  category,
+  message,
+  contactInfo,
+  netid,
+  userAgent,
+  pagePath,
+  createdAt,
+  to,
+  from,
+  cc
+}) => {
+  const fromAddr = from || process.env.FEEDBACK_EMAIL_FROM;
+
+  const subject = `[TigerType Feedback] ${category.toUpperCase()} from ${netid || 'anonymous user'}`;
+
+  const lines = [
+    `Category: ${category}`,
+    `Submitted: ${createdAt.toISOString()}`,
+    `NetID: ${netid || 'anonymous'}`,
+    `Contact: ${contactInfo || 'not provided'}`,
+    `Page: ${pagePath || 'unknown'}`,
+    '',
+    'Message:',
+    message,
+    '',
+    '---',
+    `User Agent: ${userAgent || 'unknown'}`
+  ];
+
+  // set replyTo to contact email if present so team can reply directly to user
+  let replyTo = undefined;
+  const mReply = contactInfo?.match(emailRe);
+  if (mReply) replyTo = mReply[0];
+
+  const html = `
+  <div style="font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica,Arial,sans-serif;max-width:720px;margin:0 auto;padding:32px 24px;color:#333;background:#ffffff;">
+    <div style=\"margin:0 0 32px 0;text-align:left;\">
+      <a href=\"${siteUrl}\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:inline-block;\">
+        <img src=\"cid:tt-logo\" alt=\"TigerType\" height=\"56\" style=\"display:block;border:none;\"/>
+      </a>
+    </div>
+    <h3 style=\"margin:0 0 16px 0;color:#F58025;font-weight:800;font-size:24px;line-height:1.2;\">New ${escapeHtml(category)} submitted</h3>
+    <ul style=\"margin:0 0 24px 0;padding:0 0 0 20px;font-size:15px;line-height:1.8;color:#555;\">
+      <li><strong>Submitted:</strong> ${escapeHtml(createdAt.toISOString())}</li>
+      <li><strong>NetID:</strong> ${escapeHtml(netid || 'anonymous')}</li>
+      <li><strong>Contact:</strong> ${escapeHtml(contactInfo || 'not provided')}</li>
+      <li><strong>Page:</strong> ${escapeHtml(pagePath || 'unknown')}</li>
+      <li><strong>User Agent:</strong> ${escapeHtml(userAgent || 'unknown')}</li>
+    </ul>
+    <table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" style=\"width:100%;margin:0 0 24px 0;border-collapse:separate;border-spacing:0;\">
+      <tr>
+        <td style=\"background:#f8f8f8;border-left:4px solid #F58025;border-radius:6px;padding:16px 20px;\">
+          <div style=\"font-weight:700;margin:0 0 10px 0;font-size:15px;color:#333;\">Message</div>
+          <div style=\"white-space:pre-wrap;line-height:1.6;color:#555;font-size:15px;\">${escapeHtml(message || '')}</div>
+        </td>
+      </tr>
+    </table>
+    <hr style=\"border:none;border-top:1px solid #e0e0e0;margin:32px 0 16px 0;\"/>
+    <p style=\"margin:0;font-size:13px;color:#999;text-align:center;\">Reply to this email to respond directly to the user.</p>
+  </div>`;
+
+  await sendMailGeneric({ to, from: fromAddr, subject, text: lines.join('\n'), html, replyTo, cc });
+};
+
+const deriveUserEmail = (contactInfo, netid) => {
+  const m = contactInfo?.match(emailRe);
+  if (m) return m[0];
+  if (netid && /^[a-z0-9._-]+$/i.test(netid)) {
+    return `${netid}@princeton.edu`;
+  }
+  return null;
+};
+
+const sendFeedbackAcknowledgement = async ({
+  to,
+  from,
+  category,
+  message,
+  contactInfo,
+  pagePath,
+  createdAt
+}) => {
+  if (!to) return;
+  const subject = 'Thanks for your feedback to TigerType';
+  const submittedLocal = (createdAt instanceof Date ? createdAt : new Date(createdAt))
+    .toLocaleString('en-US', { timeZone: 'America/New_York' });
+  const safeMessage = (message || '').trim();
+  const summaryRows = [
+    pagePath ? `<li><strong>Page:</strong> ${escapeHtml(pagePath)}</li>` : '',
+    contactInfo ? `<li><strong>Contact:</strong> <a href=\"mailto:${escapeAttr(contactInfo)}\">${escapeHtml(contactInfo)}</a></li>` : '',
+    `<li><strong>Submitted:</strong> ${submittedLocal} ET</li>`
+  ].filter(Boolean).join('');
+
+  const html = `
+  <div style=\"font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica,Arial,sans-serif;max-width:640px;margin:0 auto;padding:32px 24px;color:#333;background:#ffffff;\">
+    <div style=\"margin:0 0 32px 0;text-align:left;\">
+      <a href=\"${siteUrl}\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"display:inline-block;\">
+        <img src=\"cid:tt-logo\" alt=\"TigerType\" height=\"56\" style=\"display:block;border:none;\"/>
+      </a>
+    </div>
+    <h2 style=\"margin:0 0 16px 0;color:#F58025;font-weight:800;font-size:28px;line-height:1.2;\">Thanks for your feedback!</h2>
+    <p style=\"margin:0 0 24px 0;font-size:16px;line-height:1.6;color:#555;\">We really appreciate you taking the time to help improve <strong style=\"color:#F58025;\">TigerType</strong>. Here's a quick summary:</p>
+    <ul style=\"margin:0 0 24px 0;padding:0 0 0 20px;font-size:15px;line-height:1.8;color:#555;\">${summaryRows}</ul>
+    ${safeMessage ? `<table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" style=\"width:100%;margin:0 0 24px 0;border-collapse:separate;border-spacing:0;\">
+      <tr>
+        <td style=\"background:#f8f8f8;border-left:4px solid #F58025;border-radius:6px;padding:16px 20px;\">
+          <div style=\"font-weight:700;margin:0 0 10px 0;font-size:15px;color:#333;\">Your message</div>
+          <div style=\"white-space:pre-wrap;line-height:1.6;color:#555;font-size:15px;\">${escapeHtml(safeMessage)}</div>
+        </td>
+      </tr>
+    </table>
+    <p style=\"margin:0 0 8px 0;font-size:15px;line-height:1.6;color:#555;\">We'll take a look and follow up if we need any more details.</p>` : ''}
+    <p style=\"margin:${safeMessage ? '24px' : '0'} 0 0 0;font-size:15px;color:#888;font-style:italic;\">— TigerType Team</p>
+    <hr style=\"border:none;border-top:1px solid #e0e0e0;margin:32px 0 16px 0;\"/>
+    <p style=\"margin:0;font-size:13px;color:#999;text-align:center;\">Reply to this email to continue the conversation with the TigerType team.</p>
+  </div>`;
+
+  const text = [
+    'Thanks for your feedback!',
+    '',
+    `We received your ${category || 'feedback'} and will look into it shortly.`,
+    '',
+    'Summary:',
+    pagePath ? `• Page: ${pagePath}` : null,
+    contactInfo ? `• Contact: ${contactInfo}` : null,
+    `• Submitted: ${submittedLocal} ET`,
+    '',
+    safeMessage ? 'Your message:' : null,
+    safeMessage || null,
+    '',
+    '— TigerType Team'
+  ].filter(Boolean).join('\n');
+
+  // Set Reply-To to team addresses (configurable)
+  const replyTo = process.env.FEEDBACK_REPLY_TO || process.env.FEEDBACK_EMAIL_TO_TEAM;
+
+  await sendMailGeneric({ from, to, subject, text, html, replyTo });
+};
+
+const sendFeedbackEmails = async ({
+  category,
+  message,
+  contactInfo,
+  netid,
+  userAgent,
+  pagePath,
+  createdAt,
+  ackTo // optional: explicit recipient for acknowledgement (null/undefined to suppress)
+}) => {
+  const from = process.env.FEEDBACK_EMAIL_FROM;
+  const teamList = (process.env.FEEDBACK_EMAIL_TO_TEAM || '')
+    .split(',')
+    .map(s => s.trim())
+    .filter(Boolean);
+
+  // acknowledgement recipient policy: only send when explicitly provided (e.g., authenticated user's email)
+  const toUser = (typeof ackTo !== 'undefined') ? ackTo : deriveUserEmail(contactInfo, netid);
+
+  // send acknowledgement first; if it fails, throw
+  if (toUser) {
+    await sendFeedbackAcknowledgement({
+      to: toUser,
+      from,
+      category,
+      message,
+      contactInfo,
+      pagePath,
+      createdAt
+    });
+  }
+
+  // send to team recipients; use first as "to" and rest as "cc" so replies-all includes everyone
+  if (teamList.length > 0) {
+    const [primaryTeamRecipient, ...ccTeamRecipients] = teamList;
+    await sendFeedbackNotification({
+      category,
+      message,
+      contactInfo,
+      netid,
+      userAgent,
+      pagePath,
+      createdAt,
+      to: primaryTeamRecipient,
+      from,
+      cc: ccTeamRecipients.length > 0 ? ccTeamRecipients.join(', ') : undefined
+    });
+  }
+};
+
+module.exports = {
+  sendFeedbackNotification,
+  sendFeedbackEmails
+};
+
+// utils for HTML escaping
+function escapeHtml(str) {
+  return String(str)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/\"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+function escapeAttr(str) {
+  return escapeHtml(str).replace(/\n/g, ' ');
+}
+
+function getLogoAttachment() {
+  try {
+    const logoPath = path.join(__dirname, '../../client/src/assets/logos/navbar-logo.png');
+    if (fs.existsSync(logoPath)) {
+      return [{ filename: 'navbar-logo.png', path: logoPath, cid: 'tt-logo' }];
+    }
+  } catch (_) {}
+  return undefined;
+}