Privacy Policy — EduZone
Last updated: 17 August 2026
This Privacy Policy explains how EduZone ("we", "us", "our"), operated by SvasthiTech ("Company", website: svasthitech.com), collects, uses, stores, shares, and protects your information when you use the EduZone mobile application and related web services (collectively, the "Service").
By creating an account or using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.
Contact for privacy matters: support@svasthitech.com
1. Who We Are
EduZone is a gamified learning platform for the Indian school curriculum (CBSE/ICSE, Grades 1–12), offering lessons, quizzes, progress tracking, streaks, leagues, and social features between users. It is published by SvasthiTech (https://svasthitech.com/).
We act as the data controller for the personal data described in this policy.
2. Information We Collect
2.1 Information You Provide Directly
| Data | Purpose | Required? |
|---|---|---|
| Email address | Account creation and login via one-time password (OTP). Used to send you login codes and, if you request it, service communications. | Yes |
| Display name | Shown publicly to other users on the social feed, leaderboards, and recommendations. | Yes |
| Avatar style & personality seed | Renders your chosen avatar in the app. | Optional |
| Board and grade | Customises your curriculum (CBSE/ICSE, Grade 1–12). | Yes (after onboarding) |
2.2 Information We Collect Automatically (Within the Service)
| Data | Purpose |
|---|---|
| Learning progress | Topics completed, question answers, stars, mastery scores, practice sessions. |
| Gamification stats | XP, hearts, streaks, league tier, leaderboard rank. |
| Social relationships | Followers, following, friends, friend requests, notifications. |
| Account timestamps | Sign-up date, last activity date (used for streak calculation, in IST timezone). |
2.3 Information Stored Only on Your Device
The following data is stored locally on your device (browser/local storage) and is not transmitted to our servers:
- Authentication token (JWT) for keeping you signed in
- Theme preference
- Last selected subject
- Engagement timer for in-app support prompts
- "Notes seen" flags for study notes
2.4 Information We Do NOT Collect
- Precise or approximate location
- Phone number, contacts, or SMS data
- Photos, videos, or microphone/audio recordings
- Device identifiers (IMEI, advertising ID, etc.)
- Financial or payment information
- Browsing activity outside the app
- Data from third-party tracking or analytics SDKs (we use none)
3. How We Use Your Information
We use your information solely for:
- Providing the Service — authentication, curriculum delivery, progress tracking, gamification (XP, hearts, streaks, leagues), and social features.
- Personalising content — selecting the correct curriculum for your board/grade and avatar rendering.
- Service communications — sending login OTPs and responding to support requests.
- Security and integrity — preventing abuse, rate-limiting authentication attempts, and diagnosing technical issues.
- Aggregated, non-identifiable analytics — we do not use third-party analytics; any internal statistics use anonymised data only.
We do not sell your personal data, and we do not use it for advertising (the Service contains no ads).
4. How Your Information Is Stored and Protected
4.1 Storage Location
Your data is stored on Amazon Web Services (AWS) infrastructure located in the ap-south-1 region (Mumbai, India), using:
- AWS DynamoDB — primary data store (users, progress, social graph, leaderboards)
- Redis — transient caching of leaderboard data and configuration
- AWS Lambda — application logic hosting
- AWS SES — sending login OTP emails
4.2 Security Measures
- Encryption at rest: Your email address is encrypted (Fernet encryption) before storage; lookups use irreversible cryptographic hashes — plaintext emails are never stored.
- Encryption in transit: All traffic between the app and our servers is transmitted over HTTPS (TLS) in production.
- OTP security: Login codes expire within 5 minutes, are single-use, and are rate-limited to prevent brute force.
- Access control: Only authorised personnel with a legitimate need can access systems; administrative scripts are credential-gated.
- Backups: Data is backed up within AWS; retention of backups is limited to operational necessity.
5. Third-Party Services
We share only the minimum data required with the following third parties, solely to operate the Service:
| Third party | What is shared | Why |
|---|---|---|
| Amazon Web Services (SES, DynamoDB, Lambda) | Your email address and account data | Hosting, storage, and OTP email delivery |
| DiceBear (api.dicebear.com) | An avatar seed derived from your account identity | Rendering your personalised avatar image (request is made from your device) |
| Google Fonts | Your IP address (standard web request) | Loading the Nunito font used in the app |
| Google Gemini API | No personal data | Server-side generation of educational quiz content; we do not send your data to Gemini |
These third parties have their own privacy policies, and we encourage you to review them. We remain responsible for ensuring our use of these services complies with this policy.
6. Children's Privacy (Important — Please Read)
EduZone is an educational app designed for school students in Grades 1–12, which includes children under the age of 13.
- We collect only the minimum personal information needed to operate the Service (email address for login, display name, board/grade).
- Parental consent: By allowing a child under 13 to create an account, the parent/legal guardian consents to the collection and use of the child's information as described in this policy. If you are a parent and have not provided consent, or wish to withdraw consent, contact us at support@svasthitech.com or use the deletion process in Section 8.
- Social features: The Service includes social features (follow, friends, leaderboards). We encourage parents to supervise children's use of these features.
- No behavioural advertising: We do not show ads, and we never use children's data for advertising or profiling.
- We comply with the COPPA (Children's Online Privacy Protection Act) and India's DPDP Act 2023 to the extent applicable.
7. Data Retention
| Data type | Retention period |
|---|---|
| OTP login codes | Deleted automatically 5 minutes after issue (TTL) |
| Account data (email, display name, progress, gamification, social) | Until you request deletion (Section 8) or account inactivity per applicable law |
| Weekly leaderboard data | Reset weekly; aggregated history retained for league placement |
| Backups | Limited to operational necessity |
We retain your data only as long as necessary for the purposes described in this policy or as required by applicable law (e.g., tax, legal, or security obligations). When retention is no longer necessary, data is deleted or anonymised.
8. Account Deletion and Data Deletion Requests
You may request deletion of your account and all associated data at any time:
8.1 In-App Deletion
Navigate to Profile → Account → Delete Account within the app.
8.2 Web-Based Deletion
Submit a deletion request via our Data Deletion Request page (URL: https://eduzone.svasthitech.com/delete-account/), or email us at support@svasthitech.com from the email address registered with your account.
8.3 What Gets Deleted
Upon a verified deletion request, we permanently delete:
- Your user account and encrypted email record
- Learning progress, mastery, stars, and session history
- Gamification profile (XP, hearts, streaks, league) and leaderboard entries
- Social data (followers, following, friends, notifications)
- OTP records and any cached data
Deletion is permanent and irreversible — we do not merely deactivate or freeze accounts. Processing is completed within 30 days of verification (in most cases sooner). Certain data may be retained only where required by law (e.g., legal disputes, fraud prevention), and we will disclose any such retention to you.
9. Your Rights
The Service is offered to users in India, and your rights are governed by the Digital Personal Data Protection (DPDP) Act, 2023 and other applicable Indian laws. Under the DPDP Act, you have the right to:
- Access — obtain confirmation of the personal data we hold about you and a summary of how it is processed
- Correction — update or correct inaccurate or incomplete data (you can also update display name, avatar, board, and grade in-app)
- Erasure — request deletion of your data and cessation of processing (Section 8)
- Withdraw consent — for any processing based on your consent
- Grievance redressal — lodge a complaint with our Grievance Officer; if unresolved, you may approach the Data Protection Board of India (DPBI)
- Nominate — nominate another individual to exercise your rights in the event of death or incapacity
Note: The DPDP Act 2023 does not provide a right to data portability (export of all your data). If you need a copy of specific data, contact us and we will assess the request on its merits.
To exercise any of these rights, contact support@svasthitech.com or our Grievance Officer (Section 12). We may need to verify your identity before acting on your request.
10. Data Localization and International Transfers
Your data is stored on AWS infrastructure in Mumbai, India (ap-south-1 region). The Service is released for users in India, and we do not transfer your personal data outside India except where necessary to operate the Service (e.g., avatar rendering via DiceBear, font delivery via Google Fonts). We take appropriate safeguards to protect your data during such transfers.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we make material changes:
- The "Last updated" date at the top of this page will be revised
- We will notify you via the app or the email address on file where feasible
Continued use of the Service after changes take effect constitutes acceptance of the revised policy. We encourage you to review this page periodically.
12. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal data:
SvasthiTech — https://svasthitech.com/ EduZone Email: support@svasthitech.com
Grievance Officer: [Grievance Officer Name / Designation] Email: support@svasthitech.com We respond to grievance requests within 30 days, as required under the DPDP Act 2023.
We aim to respond to all legitimate requests within 30 days.
This policy is a draft prepared for Google Play Store release compliance and should be reviewed by legal counsel before publication.