Privacy Policy

1. Who is responsible

The data controller ("data fiduciary" under the Digital Personal Data Protection Act, 2023) is [Legal name of proprietor / firm / company], trading as MyMedha, [Registered address], India. Contact: [support email].

2. What we collect

You give us

• Account: your email address and, if you sign in with Google, the name and profile picture Google shares. We never receive your Google password.
• Payment details: when you buy a plan, Razorpay sends us the payment ID, order ID, amount, status and the email and phone number you entered on the payment page. Card, UPI and bank details go to Razorpay only; we never see them.
• Messages: anything you send us by email, WhatsApp or the in-app report form, including screenshots you attach.

The app records

• Study activity: which questions you answered, your chosen option, whether it was correct, time taken, mode (practice, test, review), test attempts with scores, bookmarks, review queue, daily goal, chosen exams and exam date.
• Ability estimates: a numeric rating per topic derived from your answers, used to pick your next question and to estimate a score range.
• Preview usage: how many free questions you have used per exam.
• Technical: app version, device platform (Android version), and anonymous crash diagnostics if the app crashes. We do not collect advertising identifiers, contacts, location, photos or files.

We do not collect

We do not run third-party advertising, do not use ad networks or social-media trackers, and do not sell or rent personal data to anyone.

3. Why we use it

4. Where it is stored and who sees it

• Supabase (database, authentication and file hosting), project region [e.g. ap-south-1, Mumbai]. Supabase processes data on our instructions under its data-processing terms.
• Razorpay (payments), India. Razorpay is an independent controller for the payment transaction; see Razorpay's privacy policy.
• Google (optional Google sign-in; Play Store distribution). Google's privacy policy applies to your Google account.
• Cloudflare (hosting this website and the admin console). Standard server logs (IP address, user agent, requested page) are kept by Cloudflare for a short period for security.
• WhatsApp / email providers, if you contact us through them.

Access to personal data inside MyMedha is restricted to the people who run the service, protected by individual logins and row-level security. We do not transfer data outside the providers listed above. If a provider stores data outside India, it does so under contractual safeguards.

5. On your device

The app stores question banks, tests, your answers and progress locally so that it works offline. This data is in the app's private storage and is removed when you uninstall the app or clear its data. Your progress syncs to our servers when you are online so you can restore it on another device.

6. How long we keep it

• Account and study data: for as long as your account exists, then deleted within 30 days of an account-deletion request.
• Payment records: 8 years from the financial year of the transaction, as required by Indian tax and company law. These are kept even after account deletion, but are no longer linked to a usable account.
• Support messages: 2 years from the last message, unless needed for an open dispute.
• Aggregated, anonymous statistics (for example, how many people got a question right): kept indefinitely; they cannot identify you.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 and the Information Technology Rules, 2011, you can:

• Access a copy of the personal data we hold about you;
• Correct inaccurate data (your email can be changed by contacting us);
• Delete your account and personal data (see below);
• Withdraw consent where processing is based on consent;
• Complain to our grievance officer (details on the Terms page) and, if unresolved, to the Data Protection Board of India.

To exercise any right, email [support email] from the address on your account. We respond within 30 days.

8. Deleting your account

You can delete your account and all personal data at any time, in either of two ways:

1. In the app: open Profile → Account → Delete account, then confirm. Deletion starts immediately.
2. By email: send a message with the subject "Delete my account" to [support email] from the email address registered on the account. We will confirm by reply and complete the deletion within 30 days.

What is deleted: your profile, sign-in identity, study activity, ability estimates, bookmarks, review queue, test attempts, preview usage, reports you filed and any entitlements (unused paid access is forfeited; see the refund policy). What is kept: payment records required by law (Section 6), in a form no longer linked to a usable account, and anonymous aggregate statistics. Full details are on the Delete your account page.

9. Children

MyMedha is intended for adults preparing for competitive examinations. We do not knowingly collect data from children under 18 without verifiable parental consent. If you believe a child has created an account, contact us and we will delete it.

10. Security

Data is encrypted in transit (TLS) and at rest. Database access is governed by row-level security so that each user can read and write only their own rows. Payment data never touches our servers. We review access regularly and will notify affected users and the authorities of any breach as required by law.

11. Cookies and analytics

This website sets no cookies and loads no third-party scripts. It stores one value in your browser's local storage: your light/dark theme preference, if you change it. The app does not use cookies or analytics SDKs.

12. Changes

We will post any changes here and update the date at the top. For material changes we will notify you in the app or by email before they take effect.

13. Contact