Privacy Policy

Last Updated: February 2026

At eVidyaKosh ("we", "us", or "our"), accessible from evidyakosh.com, we are committed to protecting the privacy of our users. This Privacy Policy explains what information we collect, how we use it, and the measures we take to safeguard it, in compliance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDPA) of India.

1. Information We Collect

We collect the following types of personal data when you use our platform:

• Account Information: Name, email address, phone number, and profile photo (via Google Sign-In).
• Academic Information: Class, board, subjects of interest, and learning preferences.
• Payment & Wallet Data: Wallet balance, transaction history, and payment details processed through our secure payment gateways (Paytm, PayU, Cashfree, PhonePe). We do not store your card or UPI details directly.
• Educator Data: For registered educators — qualifications, teaching subjects, hourly rates, availability, and bank account details for payouts.
• Usage Data: Pages visited, features used, session duration, and interaction patterns to improve our services.
• Device Information: Browser type, operating system, IP address, and device identifiers.

2. How We Use Your Information

• Provide, operate, and maintain our educational platform and services.
• Process wallet transactions, premium subscriptions, and educator payouts.
• Facilitate live tutoring sessions between students and educators.
• Personalize your learning experience based on your academic profile.
• Process error reports and disburse Report & Earn rewards.
• Communicate with you via email, WhatsApp, or in-app notifications for service updates and support.
• Prevent fraud, abuse, and ensure platform security.

3. Legal Basis for Processing (DPDPA Compliance)

Under the Digital Personal Data Protection Act, 2023, we process your personal data based on:

• Consent: You provide consent when creating an account and using our services.
• Legitimate Use: Processing necessary for providing the services you requested.
• Legal Obligation: Compliance with applicable Indian laws, tax requirements, and regulations.

4. Data Sharing & Third Parties

We do not sell, trade, or rent your personal data. We share data only with the following service providers to deliver our platform features:

• Firebase (Google LLC): Authentication, database, push notifications, and hosting infrastructure.
• Google Generative AI (Gemini API): Processes user-submitted academic queries, math questions, and image inputs strictly to provide real-time educational explanations, OCR formatting, and AI tutoring assistance.
• DeepSeek AI: Processes academic questions and problem-solving prompts to provide step-by-step educational explanations.
• Payment Gateways (Paytm, PayU, Cashfree, PhonePe): Payment processing and invoice verification (governed by their respective privacy policies).
• Law Enforcement: Only when required by applicable Indian laws, statutory regulations, or valid court orders.

5. Cookies & Local Storage

We use cookies and browser local storage to remember your preferences (theme, language), maintain login sessions, and improve user experience. You can manage cookie preferences through your browser settings.

6. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), Firebase security rules, and access controls to protect your personal data. However, no method of transmission over the Internet is 100% secure.

7. Your Rights

Under the DPDPA 2023, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data (subject to legal obligations).
• Withdraw consent at any time by deleting your account.
• File a complaint with the Data Protection Board of India if you believe your rights have been violated.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Transaction records are retained for a minimum of 8 years as required under Indian tax and financial regulations.

9. Children's Privacy & Child Safety Policy

eVidyaKosh serves students of all ages, including school-age children and minors. We are committed to protecting children's privacy in full compliance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and Google Play Families Policy.

9a. Age Gating & Date-of-Birth Verification

All user accounts are required to provide a valid Date of Birth during profile setup. Based on this date of birth:

• Users under 13 years old (or with unknown / unverified age) are automatically classified as child accounts and placed under the strictest protection tier.
• Child accounts cannot independently access social features, direct messaging with unverified strangers, location services, or financial transactions without parental authorisation.
• Users aged 13–17 are treated as minors with intermediate protections under Indian IT law.
• Users 18 and above have full access to all platform features as adults.

9b. Educator Age Restriction (18+ Only)

Educator registration, monetisation features (payouts, session bookings), and all commercial teaching activities on eVidyaKosh are strictly restricted to adults aged 18 years or older. If a user's date of birth indicates they are under 18, the "Register as Educator" page and all navigation paths to it are blocked with a clear notice explaining the adult-only policy. This is enforced both at the UI level and at the server/Firestore security rules level.

9c. Parental PIN & Parental Supervision

For accounts classified as under-13 or where date of birth is not verified, the platform activates Parental Supervision Mode:

• A Parental PIN is required before any financial transaction, social feature toggle, GPS location sharing, or profile modification can be saved by the child.
• The Parental PIN system uses a multi-digit adult-level mathematical challenge (as required by Google Play Families Policy) to prevent accidental authorisation by children.
• Parents can configure, change, or remove the Parental PIN from the child's Student Profile settings.
• If no PIN is set, all protected actions are blocked until a parent sets a PIN first.

9d. Online Safety Consent Modal

Before any child account can open a classroom chat, send a message, post a comment, or initiate an AI tutoring session, a mandatory Online Safety Consent Acknowledgment must be confirmed. This modal displays eVidyaKosh's core online safety rules (never share personal info, never agree to meet strangers, report unsafe behaviour). Children must tap "I Understand & Agree" before proceeding. This consent is re-shown periodically.

9e. Anti-Grooming Contact Filter

All user-generated content — classroom comments, chat messages, and AI session inputs — is filtered by eVidyaKosh's Contact Gate system in real time. This filter automatically detects and blocks:

• Indian mobile phone numbers (10-digit patterns)
• Email addresses
• External social media or personal website URLs (other than evidyakosh.com)
• WhatsApp or other messaging app contact references

The filter preserves legitimate LaTeX / mathematical expressions and evidyakosh.com internal links to avoid false positives during academic tutoring.

9f. Restricted Direct Messaging for Children

Child accounts (under 13 or unknown DOB) can only initiate direct private chat with educators if they are actively enrolled in that educator's classroom. Direct messaging with non-enrolled educators, strangers, or unverified accounts is blocked entirely for child accounts. All class-level messages are moderated.

9g. No Targeted Advertising

eVidyaKosh does not display third-party advertisements to any user, including children. There is no interest-based, behavioural, or targeted advertising of any kind on the platform.

9h. Parental Data Access & Deletion

Parents or legal guardians may contact us at [email protected] or WhatsApp +91 97089 71425 to:

• Review the personal data collected for their child's account.
• Request correction or deletion of their child's personal data.
• Request full account deletion using the in-app "Delete Account" feature or by contacting support.

We will respond to all parental data requests within 72 hours.