1. Data we collect
We collect the following categories of personal data:
- Account & identity data: name, email address, and (if you provide it) phone number, target exam, target year, and profile/avatar preferences.
- Authentication data: login credentials and session tokens (passwords are stored in hashed form by our authentication provider; we never see your plain password).
- Purchase & transaction data: records of purchases, subscriptions, and entitlements. Card/bank details are collected and processed directly by our payment processor (Razorpay) — we do not store your full payment credentials.
- Usage & content data: study sessions, focus time, test attempts and scores, streaks, coins, groups you join, and messages you send in community features.
- Device & technical data: IP address, device type, operating system, app version, and basic diagnostics/log data.
- Notifications data: push-notification tokens, if you enable notifications.
2. How & why we use your data
We use your data to:
- create and manage your account and provide the Services;
- process purchases, subscriptions, and entitlements, and prevent fraud;
- personalise your experience (e.g., recommendations, streaks, stats, leaderboards);
- operate community, chat, and live-room features you choose to use;
- send service-related and, where permitted, reminder or product communications (you can opt out of non-essential messages);
- maintain security, debug, and improve the Services; and
- comply with legal obligations and enforce our Terms.
3. Legal bases (where applicable)
Where the GDPR or similar laws apply, we process personal data on the following bases: performance of a contract (to provide the Services you request), legitimate interests (to secure and improve the Services), consent (for example, for optional notifications — which you may withdraw at any time), and legal obligation (to comply with applicable law).
4. Cookies & similar technologies
We use strictly necessary cookies and local storage to keep you signed in, remember preferences (such as your theme), and operate core functionality. We do not use these to build advertising profiles. You can control cookies through your browser settings, but disabling essential cookies may break parts of the Services.
5. Service providers & sharing
We do not sell your personal data. We share it only with trusted providers who process it on our behalf under appropriate safeguards, including:
- Razorpay — payment processing;
- Supabase — database, authentication, and storage;
- Cloudinary — image delivery/optimisation;
- Hosting & infrastructure providers — to run and deliver the Services.
We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of PYQAir, our users, or the public. If we are involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction.
6. International transfers
Your data may be stored or processed in countries other than your own. Where data is transferred across borders, we take reasonable steps to ensure it is protected consistently with this Policy and applicable law.
7. Data retention
We keep personal data for as long as your account is active or as needed to provide the Services, and thereafter only as required to comply with our legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymise it.
8. Security
We use reasonable technical and organisational measures — including encryption in transit, access controls, and provider-level protections — to safeguard your data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Your rights
Depending on where you live (including under the EU/UK GDPR and India's Digital Personal Data Protection Act, 2023), you may have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data;
- delete your data (subject to legal retention requirements);
- object to or restrict certain processing, and withdraw consent where processing is based on consent;
- request a copy of your data in a portable format; and
- lodge a complaint with your local data-protection authority.
To exercise any of these rights, email us at pyqair@gmail.com. We will respond within the timeframe required by applicable law.
10. Children's privacy
The Services are not intended for children under 13, and we do not knowingly collect their personal data. Users between 13 and 18 should use the Services only with the consent and involvement of a parent or guardian. If you believe a child has provided us data without appropriate consent, contact us and we will take steps to delete it.
11. Changes to this Policy
We may update this Policy from time to time. We will update the "Last updated" date and, for material changes, provide additional notice where appropriate. Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.
12. Contact & grievances
For any questions, requests, or grievances regarding your personal data or this Policy, contact us at pyqair@gmail.com or via our contact page. We take your concerns seriously and will address them promptly.