Privacy Policy

We collect only the minimum personal data strictly necessary to deliver high-precision handwriting recognition, step-by-step mistake diagnostics, and customized study coaching.

• Account & Profile Data: When you register, we collect your name, email address, password hash (cryptographically salted via bcrypt/Argon2), class or educational grade (e.g., Classes 1–12, Undergraduate, JEE/NEET prep), and preferred learning language (e.g., English, Hindi, Hinglish, Marathi, etc.).
• Handwritten Notebook Artifacts: Images and photos of student handwritten notes, homework solutions, derivations, equations, diagrams, and notebook pages uploaded voluntarily by you for scanning and diagnosis.
• Diagnostic & Study Intelligence Data: Text extracted through Optical Character Recognition (OCR), mathematical formulas parsed, mistake classifications (calculation slips, conceptual misunderstandings, notation errors), quiz responses, scores, and doubt conversations conducted with the AI Tutor.
• Technical & Session Metadata: IP address, device model, browser user-agent, operating system, and session timestamps used solely for security monitoring, intrusion defense, rate limiting, and session continuity.

Under India's Digital Personal Data Protection (DPDP) Act 2023, we process personal data exclusively under lawful consent and for legitimate uses related to your educational experience:

• Educational Diagnostics: To analyze handwritten steps, locate mathematical errors, pinpoint missing derivations, and provide explanatory feedback.
• Personalized Quiz & Revision Generation: To construct practice quizzes and spaced repetition flashcards targeting your specific weak areas.
• Account Security & Anti-Abuse: To prevent unauthorized access, mitigate brute-force attacks on OTP verification codes, and protect our server infrastructure.
• Communication: To dispatch critical transactional emails, including 6-digit OTP verification codes, password resets, plan activation confirmations, and usage balance top-ups. We do not engage in unsolicited marketing spam.

To convert unstructured handwriting into structured learning intelligence, ShikshaJet interfaces with trusted enterprise cloud infrastructure providers under strict confidentiality and data protection agreements:

• Google Gemini Multimodal AI (Google Cloud Platform): Images of your notebook pages and prompts are transmitted securely via TLS 1.3 encryption to the Google Gemini 2.5 Flash / Flash Lite model endpoints. Google processes this content strictly as an enterprise processor; your uploaded notes and queries are not used to train public foundation models.
• Supabase Inc. (Database & Auth): User account credentials, usage quotas, and encrypted metadata are housed in hardened PostgreSQL cloud instances equipped with Row Level Security (RLS) policies.
• Resend / Nodemailer (Transactional Email Gateway): Used exclusively for dispatching authentication OTPs and subscription notifications from our verified domain (@shikshajet.in).

We implement multi-layered technical, administrative, and physical safeguards matching and exceeding the requirements of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011:

• Encryption in Transit & at Rest: All traffic is strictly enforced over HTTPS (TLS 1.3). Database tables are encrypted at rest using AES-256 bit encryption.
• Multi-Tenant Row Level Security (RLS): Strict database-level isolation policies guarantee that no student can inspect, retrieve, or alter another student's notebooks, scans, or quiz history.
• Cryptographic Stateless OTPs: Account verification tokens are signed with HMAC-SHA256 signatures with 10-minute expiry windows, anti-replay guards, and a 5-attempt brute force lock.
• Rate Limiting & Cooldowns: Email dispatch and authentication endpoints are throttled to prevent spamming, flooding, and credential stuffing.

As a Data Principal under Indian law, you possess explicit rights regarding your personal information:

• Right to Access: You may request a summary of the personal data processed by ShikshaJet and the identities of any processors involved.
• Right to Correction & Completion: You can update inaccurate profile credentials or preferences at any time directly in your account settings.
• Right to Erasure (Right to be Forgotten): You may request the irrevocable deletion of your account, all associated notebook scans, OCR text, and diagnostic reports.
• Right of Grievance Redressal: You have the right to swift, responsive redressal for any concerns regarding your personal data.
• Right to Nominate: In the event of death or incapacity, you have the right to nominate another individual to exercise these rights on your behalf.

ShikshaJet is an educational diagnostic platform designed for learners across primary, secondary, higher secondary, and college levels. In strict alignment with Section 9 of the DPDP Act 2023:

• We do not engage in targeted advertising, behavioral tracking, or psychological profiling of children.
• We do not undertake any processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
• Users under the age of 18 are encouraged to use ShikshaJet with parental, guardian, or institutional awareness and consent.

We retain personal data and scanned notebook artifacts only as long as your account remains active or as required to fulfill educational continuity. You can manually delete individual notebook scans from your library at any time. When an account deletion is requested, all personal identifiable records, images, and diagnostic tables are permanently purged within 30 days.