Privacy Policy

1. Data We Collect

We collect only the data necessary to provide the service. This falls into three categories:

Account data (required)

• Name and email address - provided when you register or sign in with Google.
• Username - chosen by you, visible to friends on the leaderboard.
• Password hash - if you use email/password auth, we store a bcrypt hash. We never store your raw password.
• Google profile - if you use Google Sign-In, we receive your name, email, and profile picture from Google via OAuth 2.0. We do not receive your Google password.

Study data (core product)

• Study sessions: Subject, duration, topic, notes, and timestamp for each session you log.
• Timer state: Active timer data (mode, elapsed time, linked session) synced to the server so it survives page refreshes.
• Mock test records: Full-mock and sectional test scores, percentiles, notes, and linked sessions.
• Weekly goal: Your target study hours per week.
• Exam goal: Exam name and target date you configure.
• Custom vocabulary: Words you add via the vocabulary feature.

Optional profile data

• Bio, location, education, and occupation - filled in by you and shown on your public profile only if you choose to make it public.
• Privacy settings - whether your profile, stats, and leaderboard presence are visible to others.

2. How We Use Your Data

• Core functionality: Display your sessions, streaks, heatmaps, weekly progress, and exam countdown.
• Analytics and insights: Compute per-subject breakdowns, peak-hour charts, and mock score trends entirely from your own data.
• AI features: When you use AI Insights or the AI Expert chat, your study data and profile are sent to Google Gemini to generate responses. Gemini's use of this data is governed by Google's API Terms of Service - we do not use it to train our own models.
• Social features: When you opt into leaderboards or friend sessions, your username and weekly hours become visible to the friends you connect with.
• Service reliability: Server logs and error traces are used to diagnose crashes and maintain uptime. These are not linked to individual user activity beyond what is necessary for debugging.
• We do not sell, rent, license, or share your personal data with any third party for advertising, marketing, or analytics purposes.

3. Authentication and Session Management

We use short-lived JSON Web Tokens (JWT) for session authentication, paired with long-lived refresh tokens stored in our database. When you sign in, you receive an access token (expires in 15 minutes) and a refresh token (expires in 30 days if "Remember me" is selected, or at session close otherwise).

Tokens are stored in your browser's localStorage. We do not use cookies for authentication. Refresh tokens are hashed before storage. You can invalidate all sessions by changing your password or requesting account deletion.

4. Data Storage and Security

All data is stored in a PostgreSQL database hosted on Render (render.com) in the United States. Data in transit is encrypted via TLS. Passwords are hashed using bcrypt with a work factor of 12. Refresh tokens are stored as SHA-256 hashes, never in plaintext.

We apply reasonable technical and organisational measures to protect your data. However, no system is perfectly secure - if you believe your account has been compromised, please contact us (see section 12).

5. Cookies and Local Storage

Karma Yogi does not use tracking or advertising cookies. We use browser localStorage for:

• Authentication tokens (karma_auth)
• Theme preference (karma_theme_mode, karma_theme_name, karma_theme_name_date)
• AI chat history (karma_ai_chat_*) - stored locally, never sent to our servers except when generating responses.

6. Third-Party Services

• Google OAuth 2.0 - used for social sign-in. Governed by Google's Privacy Policy.
• Google Gemini API - used for AI Insights, the AI Expert chat, and vocabulary generation. When you trigger these features, relevant context (study data, session notes) is sent to Gemini. Governed by Google AI API Terms.
• Google Analytics 4 - used to understand aggregate page traffic and feature usage. GA4 collects anonymised usage data. You can opt out using the Google Analytics Opt-out Add-on.
• Render.com - our cloud hosting provider. They process data on our behalf under their Data Processing Agreement.

7. Data Sharing

We do not sell or share your personal data except in the following limited circumstances:

• With friends you connect with - your username and weekly hours are shared on the mutual leaderboard when you accept a friend request.
• With service providers - Render (hosting) and Google (AI/auth) process data on our behalf as described above.
• Legal obligations - if required by law, court order, or to protect the safety of users or the public.

8. Your Rights

You have the following rights over your data:

• Access: You can export all your data (sessions, mocks, subjects, vocab) from the Library page in JSON or XLSX format at any time.
• Correction: You can edit your profile, sessions, and mock records directly in the app.
• Deletion: Contact us (see section 12) to request deletion of your account and all associated data. We will process requests within 30 days.
• Portability: Your exported data is in standard JSON or XLSX format, usable in any compatible tool.
• Objection: You can disable the leaderboard, make your profile private, or remove yourself from friend sessions at any time via the Profile page.

9. Data Retention

Your data is retained for as long as your account is active. If you request deletion, we will remove your account, sessions, mock records, vocabulary, and all personally identifying information within 30 days. Anonymised aggregate statistics (e.g. total number of study hours across all users) may be retained indefinitely as they cannot be linked back to you.

10. Children's Privacy

Karma Yogi is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us (see section 12) and we will delete the account promptly.

11. Changes to This Policy

We may update this policy as the app evolves. Material changes will be communicated via an in-app notice or email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the app after a policy update constitutes acceptance of the revised policy.

12. Contact

For any privacy questions, data requests, account deletion, or concerns, reach out to: guruvellianish@gmail.com. We aim to respond within 5 business days.