Privacy Policy

DRAFT for review by a qualified person before publishing. Not yet in force.

Version [1], last updated [date]. This policy explains what GravIITy collects, why, where it is kept, and what you can do about it. GravIITy is run by [legal name of the person or entity], [city, India] ("we").

Who GravIITy is for

GravIITy helps students prepare for the JEE examinations. Most users are between 15 and 19. If you are under 18, a parent or guardian must agree to this policy on your behalf before you use GravIITy with an account. [Review note: the Digital Personal Data Protection Act, 2023 and its rules require verifiable parental consent for users under 18; the method and timing must be confirmed by a qualified person.]

What we collect, and why

When you sign in with Google: your name, your email address and your Google account identifier, received from Google when you choose to sign in. We use them to create and recognise your account and to pre-fill your name. We do not receive your password, your contacts, your files or anything else from your Google account. Staff and a small number of early accounts sign in with an email address and a password instead; Supabase stores those passwords in hashed form.

What you tell us in the app: your full name, your class (11, 12 or dropper), your target exam year, your target exam, your dream college, your display name and the choices that make up your avatar. We use them to personalise the app and, for the display name and avatar only, to show you to other students where the app does so (for example on a leaderboard).

Your study activity: the questions you attempt and your answers, your test attempts and results, bookmarks, notes, items in your Improvement Book, question reports you send, your answers in the optional diagnostic, and, if you tried GravIITy as a guest, your answers in the free preview. We use them to show you your results and progress and to improve the question bank with anonymous statistics.

Your devices: a random identifier created on each phone or browser you use, the device model or browser name, the operating system, the app version, and when it was first and last used. We use them to limit the number of devices on one account, to show you your devices, and to let you sign a device out.

Your consent: the time and the version of the Terms and this policy you accepted, and the platform and app version you used.

Sign-up progress: which step of sign-up or onboarding was reached, with a one-way hash of the device identifier, the platform and the app version. We use it to see where people give up and to improve the flow.

We do not collect your location, your contacts, your photos, your phone number (in this version), or anything from other apps. We do not use advertising identifiers, advertising networks or third-party analytics tools.

Where your data is kept

Your data is stored in a Supabase database and file store located in Mumbai, India, and in backups kept by us. The website is served by Firebase Hosting (Google). Sign-in uses Google. These providers process data on our behalf under their own terms. We do not sell your data and we do not share it with anyone else.

Who can see what

Other students can see only your display name and your avatar, and only where the app shows them. Your name, email address, class, year, college, activity and devices are visible only to you and to GravIITy's administrators. Rules enforced in the database, not only in the app, keep it that way.

How long we keep it

As long as your account exists. If you delete your account, it is hidden at once and permanently deleted 14 days later, unless you restore it in that time. After permanent deletion, only anonymous per-question totals remain (how many times a question was attempted and answered correctly), with no link to you. Guest accounts that are not turned into a real account are deleted after 30 days of inactivity.

Your choices and rights

You can edit your profile in Settings, remove a device, change your display name, and delete your account in Settings or at https://graviity16.web.app/delete-account. You can ask us for a copy of your data, for a correction, or for deletion by writing to [support email]. We answer within [30] days. [Review note: the grievance officer or contact that the Act requires, and the escalation route, must be added.]

Cookies and local storage

The app keeps your sign-in session and your preferences (such as theme and text size) in your browser's or phone's storage. We do not use tracking cookies.

Security

All traffic is encrypted in transit. Access to your data in the database is controlled row by row. Students never have a GravIITy password: sign-in goes through Google.

Changes

When this policy changes in a way that matters, the app will ask you to accept the new version before you continue, and will record the version you accepted.

Contact

[Legal name], [postal address], [support email].