Privacy Policy

1. Who We Are

EduGarden ("we", "us", "our") is an AI-powered study companion for Class 12 CBSE students, accessible at edugarden.in. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

We are the Data Fiduciary for the data described below. You are the Data Principal. If you are under 18, your parent or legal guardian acts as your Data Principal.

2. Data We Collect

a) Account data (via Google Sign-In)

• Name and email address (from your Google account)
• Profile picture URL

We never receive or store your Google password. Authentication is handled entirely by Google OAuth.

b) Onboarding profile

• Your preferred name, class, board, stream and target exam year
• Your birth year (used only to apply the protections in section 7)
• If you are under 18: a parent or guardian's email address and a record of their consent (how and when it was given)
• Language and tutor-personality preferences

c) Study and usage data

• Your chat messages with Arya (our AI tutor), and Arya's replies
• Photos you upload of questions or handwritten work, so the AI can read and solve them
• Study session duration and timestamps
• Chapter progress and completion status
• Quiz, chapter-test and board-paper responses and scores
• Study streaks, XP, badges and virtual-garden state
• Weakness, mastery and confusion tracking derived from your answers
• Study-plan configuration and check-offs
• Daily usage counters, used to enforce the free and paid daily limits

d) Payment data

• Plan type, subscription status and expiry
• Razorpay order and payment IDs, amount, and any coupon code used
• Transaction timestamps

We do not store your card numbers, UPI IDs, bank account details, or any payment credentials. All payment processing is handled by Razorpay, a PCI-DSS compliant payment gateway. If a parent pays on your behalf using a link you share, we receive the same payment data and no account is created for the parent.

e) Referral data

• Your invite code, and which accounts signed up through it
• A short-lived eg_ref cookie holding an invite code you clicked

f) Analytics and server data

• Product analytics events (for example: a message was sent, the paywall was viewed, a payment succeeded) via PostHog. For users under 18 these events are never linked to your identity — see section 7
• Standard server and hosting logs, including IP address, kept by our host
• Crash reports. When the app hits an error we record what went wrong via Sentry, together with a replay of your screen in the seconds before it. We do not record your screen at any other time.

g) Data stored on your device

Some data is written to your browser's localStorage: theme, ambience preferences, Pomodoro stats, cached AI content, and a copy of your progress. Preferences and cached content stay on your device. Progress, XP, streaks, weakness data and graded results are also mirrored to our database so they survive a cleared cache or a new device.

3. How We Use Your Data

• Personalise your learning (AI tutor responses, study plans, weakness tracking)
• Track your study progress, streaks and achievements
• Send your messages and photos to our AI provider to generate a response
• Process subscription payments and apply coupons
• Enforce daily usage limits and prevent abuse
• Build the progress report you choose to email to a parent or guardian
• Understand which features are used, so we can improve the product

We do not sell your data, use it for advertising, or share it for marketing purposes. We do not use your chat messages to train our own AI models.

4. Legal Basis for Processing

We process your data on the basis of the consent you give when you create an account and accept this policy, and — where you are under 18 — the verifiable consent of your parent or guardian. Some processing is necessary to provide the service you asked for (for example, sending your question to the AI so it can answer). You may withdraw consent at any time; see section 9.

5. Third-Party Services

We share the minimum data necessary with the following processors:

Some of these providers process data outside India. By using EduGarden you consent to that transfer, which we make subject to the safeguards those providers offer.

6. Cookies and Similar Technologies

• Essential — session cookies set by Supabase to keep you signed in. The site cannot work without these.
• Referral — eg_ref, set for 30 days when you open an invite link, so the friend who invited you gets credit.
• Analytics — cookies set by PostHog to count unique visits and usage events.
• Preferences — we record your acceptance of the cookie notice in your browser's localStorage, not in a cookie.

You can clear or block cookies in your browser settings. Blocking essential cookies will sign you out.

7. Children and Users Under 18

Under the DPDP Act, anyone under 18 is a child. EduGarden is built for Class 12 students, so we expect many of our users to be children, and we have built specific protections for them. Signing in requires a Google account, which carries Google's own minimum age for account holders.

How consent works

• During onboarding we ask for your birth year. If you are under 18, we ask for a parent or guardian's email address and your confirmation that they permit you to use EduGarden.
• We then email your parent or guardian a verification link. Until they click it, your consent is recorded as self-declared; once they do, it is recorded as email-confirmed.
• A parent or guardian may withdraw consent at any time by emailing edugardensupport@gmail.com.

What we do differently for children

• We never behaviourally track or profile a child, even with parental consent. Behavioural monitoring (session analytics, mood and engagement profiling, student-type classification, identified product analytics) is switched off for every user under 18.
• Product analytics for children are never linked to your name, email or account identity.
• We do not serve advertising to any user, and never target advertising at children.
• With parental consent, we do store the data needed to actually teach you — your progress, what you have mastered, where you are struggling, and how you like things explained.
• Without parental consent, you can still ask Arya questions and get answers, but we do not persist that learning data.
• If we do not know your age, we treat you as a child and apply the protections above by default.

8. Data Storage, Retention and Deletion

• Your account and study data are stored in our Supabase database
• Preferences and cached content are stored in your browser and never transmitted
• We retain your data for as long as your account exists
• You can delete your account yourself from your profile page. Deleting your account removes your personal data from our systems.
• Anything already deleted is purged from backups within 30 days. We may retain payment records for as long as tax and accounting law requires.

9. Your Rights (DPDP Act, 2023)

As a Data Principal you have the right to:

• Access — request a summary of your personal data
• Correction — request correction of inaccurate data
• Erasure — request deletion of your personal data
• Withdraw consent — at any time, as easily as you gave it
• Nominate — nominate another person to exercise these rights on your behalf
• Grievance redressal — see section 11

To exercise any of these rights, email edugardensupport@gmail.com. We respond within 30 days.

10. Security

We use industry-standard measures to protect your data, including:

• HTTPS encryption for all data in transit
• Row-level security on our database, so one account cannot read another's data
• Server-side API keys that are never exposed to the browser
• HMAC signature verification on every payment before it is recorded

No system is completely secure. If you suspect a security issue, please contact us immediately at edugardensupport@gmail.com. We will notify you and the Data Protection Board of any personal data breach as required by law.

11. Grievance Redressal

If you have a complaint about how we handle your data, contact our Grievance Officer:

• Name: Sahib Singh
• Email: edugardensupport@gmail.com

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

12. Changes to This Policy

We may update this policy from time to time. We will notify users of significant changes in the app. Continued use of EduGarden after a change constitutes acceptance of the updated policy.

13. Contact Us

• Email: edugardensupport@gmail.com
• Website: edugarden.in