Privacy Policy

PrepMojo is a study app for Indian olympiad aspirants Class 3-11. Parents create an account; children practice using it. We collect the minimum information needed to show your child the right questions and to keep your account secure. We don't sell your data. We don't serve advertising. You can ask us to delete your account and your child's practice history at any time.

The full policy below spells out the legal specifics under India's Digital Personal Data Protection Act, 2023 (DPDP).

“PrepMojo”, “we”, “us” refers to the operators of prepmojo.in, app.prepmojo.in and api.prepmojo.in. For data-protection questions reach out to privacy@prepmojo.in.

Account information (parent / primary guardian)

• Email address (used to sign in)
• Name, if you choose to provide one
• Authentication tokens issued by Supabase, our auth provider

Child profile (provided by the parent)

• Child's display name
• Class level (3-11) and board (CBSE / ICSE / State / IB)
• Target olympiads selected during onboarding
• Optional school name and avatar choice

Practice activity

• Which questions were attempted, when, and the answer given
• Whether the answer was correct, time spent per question
• Bookmarks, mistakes queue, daily streaks, XP totals

Technical telemetry

• Server logs containing your IP address, request timestamp, user agent — kept for 30 days for security and abuse-prevention
• We do not use third-party analytics, pixels, or advertising cookies on the apex marketing site (prepmojo.in)

• Consent (DPDP §6) — you consent at sign-up; consent is freely revocable
• Performance of service — to actually deliver personalized practice and reports your child needs
• Legitimate uses (DPDP §7) — security, fraud prevention, fixing bugs, complying with legal obligations

PrepMojo is designed for school-going children (typically ages 8-16). Per DPDP §9, we treat all child data with extra care:

• The child's profile is created only by a parent or guardian
• We do not target advertising at children. We do not run any ads.
• We do not track child data outside the practice surface (no cross-site tracking)
• A parent can request deletion of all child profile + practice data on demand by emailing privacy@prepmojo.in

Practice and account data is stored on a single private server in Falkenstein, Germany (Hetzner Cloud) under our exclusive control. The following processors see narrow slices of it:

• Supabase (sign-in tokens, email-OTP delivery)
• Hetzner Cloud GmbH (server hosting infrastructure)
• Let's Encrypt (TLS certificates — sees only domain names)
• Google(only if you choose “Continue with Google” sign-in)

We do not sell, rent, or trade personal data with third parties. We do not share data with advertisers.

• Account data — kept while your account is active; deleted within 30 days of account closure
• Practice activity — same lifecycle as the child profile
• Server logs — 30 days
• Backups containing your data — rotated out within 90 days of source deletion

• Access — get a copy of the personal data we hold about you
• Correction— fix anything that's inaccurate
• Erasure — ask us to delete your account and child profiles
• Withdraw consent — revoke consent at any time; doing so terminates the service
• Grievance redressal — escalate complaints to our grievance officer

To exercise any of these, email privacy@prepmojo.in. We respond within 7 business days. If unsatisfied you may approach the Data Protection Board of India.

Data is encrypted in transit (TLS 1.3 via Let's Encrypt). The database lives on a private Docker network and is not exposed to the public internet. Authentication uses signed JWTs with short expiration. Passwords are not stored — sign-in is via email magic link or Google OAuth.

We'll update the “Last updated” date at the top of this page when material changes happen, and notify signed-in users by email if the change affects how their data is used.

Questions, deletion requests, grievances: privacy@prepmojo.in.