Privacy Policy

1. Data we collect

• Phone number and one-time-password tokens, used only to authenticate you.
• Profile data you provide: chosen exam (RAS or REET), preparation level, optional first name.
• Usage data: MCQ answers, mains-writing submissions, mastery scores, study progress, current-affairs reads.
• Device data: a Firebase Cloud Messaging push token (when you enable notifications) and crash diagnostics from Sentry. We do not collect contacts, calendar, microphone, or precise location.
• Payment data: Razorpay handles card and UPI details directly; we receive only an order ID, plan amount, GST breakdown, and a receipt for the seven-year retention required by Indian tax law.

2. How we use your data

• To run the app: serving questions tuned to your mastery, surfacing the right study notes, scoring mains answers, syncing your progress across devices.
• To send transactional notifications you opt into (daily question, current-affairs digest, plan-expiry reminder).
• To improve the product through aggregate analytics — which questions are too easy or too hard, which study notes get the most usage. Aggregates are anonymised before analysis.
• We never sell your data, never share it with advertisers, and never use it to train third-party AI models.

3. How we share your data

• Cloud infrastructure: Google Cloud (asia-south1), Vercel, Neon, Firebase, Sentry, Razorpay. Each is bound by a data-processing agreement that limits them to providing service to us.
• Legal disclosure: only if compelled by a valid Indian court order or law-enforcement request, and only the minimum scope required.
• No cross-border data sale, no advertising partners, no data brokers.

4. How long we keep your data

• Profile, mastery, study history, push tokens, referral relationships: until you request deletion. We delete these immediately when you trigger account deletion in the app, or within thirty days of an email request.
• Payment receipts: retained for seven years as required by the Indian Income-Tax Act and the GST Act. After deletion, the receipts are anonymised and disconnected from your identity wherever possible.
• Anonymised aggregate analytics: retained indefinitely.

5. Account deletion

• In the app: Profile → Delete account. Type your phone number to confirm. The deletion is immediate and irreversible.
• By email: write to support@aspirant.academy from the email or phone number on your account. We complete deletion within thirty days.
• A public landing page describing the same flow is available at https://aspirant.academy/delete-account — registered with Google Play as our data-deletion URL.

6. Your rights

• Access: request a copy of the data we hold about you.
• Correction: ask us to fix any factual error in your profile.
• Deletion: as described above.
• Withdraw consent: turn off push notifications in app settings, or unsubscribe from any non-transactional email at any time.
• Grievance: email dpo@aspirant.academy for DPDP-specific data-protection concerns, or support@aspirant.academy for general queries. We respond within fifteen days as required by India's DPDP Act, 2023.

7. Children

• Aspirant Academy targets civil-services and REET aspirants — a primarily adult audience aged eighteen and over. We do not knowingly collect data from anyone under thirteen. If you believe a child under thirteen has created an account, write to support@aspirant.academy and we will delete it.

8. Security

• All traffic is served over HTTPS. Authentication tokens use Firebase's standard encryption at rest. Database backups are encrypted. We restrict employee access to user data on a strict need-to-know basis and audit access regularly.
• No system is perfect — if we ever suffer a breach affecting your data, we will notify you and the relevant Indian authority within seventy-two hours of detection, in line with DPDP Act timelines.

9. Changes to this policy

• We may update this policy as the product evolves. Material changes (new data we collect, new third-party processors, changes to retention) will be highlighted at the top of this page and announced in-app. Continued use after a material change means you accept the updated policy; if you do not, you can delete your account at any time.

Contact

Email support@aspirant.academy for general queries, or dpo@aspirant.academy for DPDP-specific data-protection concerns. We are an Indian-origin company; jurisdiction is the courts of Jaipur, Rajasthan.