Skip to content

Privacy Policy

questionbuddy.in/privacy

Privacy Policy

Last updated 13 October 2026

QuestionBuddy is run by Fitnitro Technology Private Limited ("we", "us"). This policy explains what personal data we collect, why, who we share it with, and the rights you have, including under the Digital Personal Data Protection Act, 2023 (the DPDP Act). Many of our users are under 18, so we have kept it short and plain.

The short version

  • A parent creates the account and gives consent before a child under 18 can practise or upload anything.
  • We collect only what we need to mark work, bring mistakes back and show progress.
  • No ads, no public profiles, no selling of data, and no tracking of children for advertising.
  • Photos of answers are deleted after marking. Only the text and the marks are kept.
  • You can download or delete your family's data at any time from the parent dashboard.

What we collect

  • Parent account: your name, email address and password (stored only as a one-way hash, never readable by us). A student aged 18 or over who signs up for themselves gives the same details.
  • Child profiles: a first name or nickname (we never need a full name), board, class and school year, and the history of past classes and boards so progress carries forward. If you give your child their own login, the username you choose and a PIN (stored only as a hash).
  • Learning activity: the questions answered, the answers given, marks, mistakes and what went wrong, retest results, and time spent practising.
  • Consent records: which version of the consent notice you agreed to, when, and a scrambled (keyed hash) form of the internet address it came from, so we can show consent was given.
  • Uploaded answers (when the Answer Coach launches): photos or PDFs of handwritten answers are read to mark them and then deleted. We keep the text read from them and the marks.
  • Payment records (when paid plans launch): the plan bought, the amount, GST and the payment reference. Card, UPI and bank details are handled by Razorpay and never reach our servers.
  • Technical data: basic server logs (such as request times and errors) needed to run and secure the service.

How we use it

  • To run accounts and sign you in.
  • To mark answers, keep the mistakes notebook, schedule retests and suggest what to practise next.
  • To show parents honest progress: time practised, chapters covered and mistakes fixed.
  • To send service emails, such as password reset links.
  • To keep the service secure, prevent abuse and fix problems.

We do not sell personal data and we do not show advertising. We do not use children's data for behavioural monitoring or targeted advertising.

Children and parental consent

Under the DPDP Act, a child is anyone under 18. Before a child can practise or upload anything, a parent or lawful guardian signed in to their own account must give consent: they read a short notice, confirm they are the child's parent or guardian and an adult, and re-enter their password. A parent can withdraw consent at any time from the parent dashboard; this stops practice and signs the child out. Children never have public profiles, and a child's own login cannot change settings, consent or data.

AI processing

Features that mark written answers or give hints send the relevant material (the question, the marking scheme, and the answer as text or, for an uploaded answer, the photo or PDF so it can be read) to our AI provider, Anthropic, which processes it on our behalf to produce the feedback. Under Anthropic's commercial terms for its API, this data is not used to train its models. We do not send names or email addresses with these requests. AI feedback can be wrong, and we say so next to every AI mark.

Who we share data with

These service providers help us run QuestionBuddy. Each processes data only to provide its service to us:

  • MongoDB Atlas (database, hosted in Mumbai)
  • Railway (application hosting)
  • Vercel (website hosting, and cookieless visit statistics)
  • Anthropic (AI processing, as described above)
  • Resend (sending service emails)
  • Razorpay (payments, when paid plans launch)

Some of these providers may process data outside India. We may also disclose data if the law requires it.

How long we keep it

  • Account and learning data: while the account is open. When you delete a child's profile or your whole account, the data is removed from our live database straight away and from backups within 30 days, except records the law requires us to keep (such as payment and tax records).
  • Answer photos: deleted after marking.
  • Password reset links: expire after one hour. Sign-in sessions: end after 30 days, or when you sign out.

Your rights

Under the DPDP Act you can, for yourself and for your child:

  • Access a copy of the data: use "Download my data" on the parent dashboard.
  • Correct it: change names, board and class on the dashboard, or email us.
  • Erase it: delete a child's profile or your whole account on the dashboard.
  • Withdraw consent at any time, as easily as you gave it.
  • Nominate someone to exercise these rights for you in the event of death or incapacity.
  • Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.

Cookies and storage on your device

We use only essential cookies: two sign-in cookies that keep you signed in securely (they cannot be read by scripts on the page). Your browser also remembers which child was last practising on the device. We use Vercel Web Analytics to count visits, which does not use cookies and does not identify you. We do not use Google Analytics or any advertising cookies, so there is no cookie banner.

Security

Data is encrypted in transit. Passwords and PINs are stored only as one-way hashes, reset links are stored only in hashed form and expire within an hour, and access to production data is restricted. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Grievance officer and contact

Grievance Officer, Fitnitro Technology Private Limited. Email: support@questionbuddy.in. We aim to respond within 7 days.

Bengaluru, Karnataka, India

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Changes to this policy

If we make material changes, we will update the date above and tell you in the product or by email before the change takes effect. Where the change affects children's data, we will ask parents for consent again.