Privacy Policy

Last updated: 20 October 2026 · Version 2026-10-16

This policy explains what Prepology collects, why, who else handles it, how long we keep it and how you can see, correct or delete it. It covers the Prepology website, the web app at /app/ and the Android app.

Who we are

Prepology is an exam-preparation app run by an individual developer in India (“we”, “us”). For the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for the personal data described here. You can reach us at contact@kamaldhami.in.

The short version

• We collect what we need to run your study plan, practice and account. Nothing more.
• We do not show ads, sell your data, or use advertising trackers. The website uses cookie-less visit counting (SnowAnalytics); the app does not.
• Your data is stored in India (Mumbai). Some service providers may process it elsewhere.
• Mentor chats are sent to an AI provider to write a reply and are not saved by us.
• We never see or store your card or UPI details. Payments are handled by Razorpay (and, for plans bought before 20 October 2026, Dodo Payments).
• You can delete your account from Settings. After a 14-day grace period it is permanently deleted.
• Questions or complaints go to our Grievance Officer at contact@kamaldhami.in. We acknowledge within 24 hours and resolve within 7 days.

What we collect

• Account: your name and email address. If you sign up with email, your password, which we store only as a one-way hash. If you sign in with Google, we receive your name, email address and profile picture URL from Google, and your Google account ID; we never receive your Google password.
• Profile: your target exam, exam date, time zone, study availability (study windows, classes, daily time) and preferences you set in onboarding and Settings.
• Learning data: your answers, whether they were right, your response times (how long each answer took), how confident you were, the mastery estimates we calculate from them, your study plans, notes, flashcards and their reviews, and mock tests with your answers and scores.
• Date of birth and consent record: the date of birth you enter, the time you agreed to these documents at sign-up or sign-in, which version you agreed to, and the IP address and device type it came from.
• Device information: your device or browser type (user agent), the app version and the platform (for example Android or web), with your sign-in sessions and error reports. We do not collect your contacts, location, photos or advertising ID.
• Support requests: what you write to us from Settings → Help & support or by email, with your account email so we can reply.
• Subscription records: if you buy Plus, your plan, subscription status, billing period dates, and the customer and subscription IDs Razorpay (or Dodo Payments) gives us. We also keep the payment notifications they send us, which can include your name, email, phone number and the amount paid. We never receive your card number, UPI ID or bank details.
• Security and audit logs: sign-in and account events, and your IP address, used for rate limiting, preventing abuse and investigating security problems.
• App error reports: when the app crashes or hits an error, the error message and stack trace, the app version and the platform (for example Android or web). Error reports never include your password or sign-in tokens.

The AI Mentor

When you message the Mentor, your message, the last few messages of the conversation and a short summary of your exam, plan and progress are sent to Groq, an AI model provider in the United States, to check the message for safety and to generate the reply. We do not send your name, email address or password. Prepology does not store your Mentor chats on its servers; we keep only a daily count of how many messages you sent, to apply the plan limit. Groq processes the request under its own terms and outside India.

Mentor replies come from an AI model and can be wrong. They are not a substitute for a teacher or your textbooks.

Please do not share sensitive personal information (for example health, financial, identity or contact details of you or anyone else) in Mentor chats. The Mentor is for study questions.

What we do not do

• No advertising, and no selling or renting of your personal data.
• No advertising trackers on the website or in the app, and no third-party analytics in the app.
• The public website (not the app) counts visits with SnowAnalytics in cookie-less mode: it records which pages are visited and basic details such as the referring site and browser type, sets no cookies and stores nothing on your device. It honours your browser’s Global Privacy Control and Do Not Track settings.
• We use only the cookies and on-device storage needed to keep you signed in and to remember settings such as light or dark mode.

Why we use it

We use your data only to:

• create and secure your account and sign you in;
• build your study plan, choose practice questions at your level, schedule revision and show your progress;
• answer your Mentor questions and support requests;
• send verification codes and account emails (for example about sign-in, billing or deletion);
• run your Plus subscription and keep the payment records the law requires;
• prevent abuse, fix bugs and keep the service working.

We do not use your data to make decisions with legal or similarly significant effects about you. Readiness and mastery figures are study estimates only.

Legal basis: your consent

We process your personal data on the basis of the consent you give when you enter your date of birth and accept these documents at sign-up or sign-in. The consent box is never pre-ticked. You can withdraw consent at any time by deleting your account from Settings → Account & privacy (see Deleting your account). Withdrawing does not affect processing already done; after it we stop processing your data, except what the law requires us to keep.

Who else handles it

We use these service providers to run Prepology. Each receives only what it needs for its task:

• Vercel hosts the website and runs our server code (Mumbai region). Cloudflare serves the website and passes requests to our servers; it sees IP addresses and request details to deliver and protect the service. We are moving our server code to a virtual machine we run on Oracle Cloud in India, reached through Cloudflare.
• Supabase provides our PostgreSQL database and file storage (Mumbai region, ap-south-1).
• Google provides Google sign-in, if you choose it.
• Resend sends verification codes and account emails; it receives your email address and the message.
• Groq generates Mentor replies; it receives what is described under The AI Mentor. It does not receive your password or email address.
• Razorpay processes Plus payments and runs the recurring-payment mandate (UPI AutoPay or card). You give your payment details directly to Razorpay; it shares your subscription status and payment notifications with us.
• Dodo Payments is the merchant of record for Plus plans bought before 20 October 2026, until they end: for those it takes the payment, issues the invoice, collects GST and runs the mandate.

We may also disclose data where Indian law requires it, for example to comply with a lawful order from a court or government authority.

Where your data is stored

Our database, file storage and server code run in India. Some of the providers above (for example Groq, Resend, Google, Razorpay and Dodo Payments) may process data in other countries to provide their service. We do not transfer data to any country the Government of India has restricted under the DPDP Act.

How long we keep it

• Account, profile and learning data (including answers, response times and mastery estimates): while your account is open. When you delete your account, it is permanently deleted after the 14-day grace period.
• Date of birth and consent records: kept while your account is open, as proof of the consent you gave and the terms version you accepted, and deleted with your account. Our audit log keeps only the fact that an account was deleted and when, without your email.
• Subscription and payment records: our copies (plan, dates, Razorpay or Dodo IDs and payment notifications) are deleted with your account. Razorpay and Dodo Payments keep their own payment records, and we keep invoice and tax records, for as long as the law requires.
• Mentor chats: not stored by us. Only the daily message count is kept, and it is deleted with your account.
• Support requests, security logs and error reports: only as long as needed for their purpose, and deleted or de-identified when your account is deleted unless we need them to resolve an open issue or meet a legal obligation.
• Backups: deleted data can remain in our encrypted database backups until they roll off, within 30 days.

How we protect it

Data is encrypted in transit (HTTPS) and stored with our providers, who encrypt it at rest. Passwords are stored only as hashes. Access to production data is limited to the operator. No system is perfectly secure; if a breach affects your personal data we will notify you and the Data Protection Board of India as the DPDP Act requires.

Age limit: 18 and over

Under the DPDP Act, anyone under 18 is a child, and a child’s data may not be tracked or profiled without verifiable parental consent. Prepology’s study engine learns from every answer you give, so we do not offer it to children at all: you must be 18 or older. At sign-up and sign-in you enter your date of birth, and we keep it with the terms version you accepted, the time, your IP address and device type as the record of your consent. If the date shows you are under 18, no account is opened and the data you typed is deleted.

If we learn that an account belongs to someone under 18, we close it, sign it out everywhere and delete its data. Parents and guardians who believe a child is using Prepology can write to contact@kamaldhami.in and we will act within 7 days.

Your rights

Under the DPDP Act you can:

• Access: ask for a summary of the personal data we hold about you and how we use it, and the providers we share it with.
• Correct and update: change most details yourself in Settings, or ask us to correct or complete anything else.
• Erase: delete your account from Settings, or ask us to delete specific data.
• Withdraw consent: at any time, by deleting your account from Settings → Account & privacy. This does not affect processing already done.
• Nominate: name a person who can exercise these rights for you if you die or become unable to. Email us their name and contact details from your account email.
• Grievance redressal: complain to our Grievance Officer (below), and, if you are not satisfied, to the Data Protection Board of India.

To use any of these rights, email contact@kamaldhami.in from your account email, or write from Settings → Help & support. We may ask you to confirm your identity first. We acknowledge requests within 24 hours and act on them within 7 days.

Deleting your account

Go to Settings → Account & privacy and choose to delete your account. Your account is then scheduled for deletion after a 14-day grace period. During those 14 days you can sign in and choose “Keep my account” to cancel. After 14 days, your account and all your learning data are permanently deleted, except records we must keep by law (such as our minimal invoice and subscription references; Razorpay and Dodo Payments keep their own payment records). Backups roll off within 30 days. Requesting deletion also turns off Plus auto-renewal, so you are not charged again.

Grievance Officer

Grievance Officer: Kamal Singh Dhami, operator of Prepology
Email: contact@kamaldhami.in (subject “Grievance”)
Location: Udham Singh Nagar, Uttarakhand, India. A postal address for legal notices is shared on request by email.

You can raise any complaint about your personal data, the app, a payment or our content with the Grievance Officer, by email or from Settings → Help & support. We acknowledge every grievance within 24 hours and resolve it within 7 days.

Data Protection Board of India: if you are not satisfied with our response, or we do not resolve your grievance within 7 days, you can complain to the Data Protection Board of India, set up under the DPDP Act, through its online complaint process. The Board expects you to contact our Grievance Officer first.

Changes to this policy

If we change this policy, we will update the date and version at the top. For material changes we will tell you in the app or by email before they take effect, and ask for your consent again where the law requires it.

Contact

Questions about privacy: contact@kamaldhami.in. See also our Terms of Service, Refund and Cancellation Policy and Contact page.