Privacy Policy

Last updated: placeholder — set on launch.

This is a plain-language draft, not a lawyer-reviewed legal document. For the product-level “what’s actually tracked” explanation, see our transparency page — this page is the more formal companion to it and should be reviewed by counsel before real use.

1. What we collect

Account details (name, email, role); learning activity (quiz attempts, study sessions, syllabus progress); AI Tutor conversation summaries and flagged weak areas — never full conversation transcripts, which are discarded after a summary is generated. Nothing beyond this is collected, and no demographic or preference data is gathered beyond what teaching requires.

2. Legal basis: verified parental consent

Every student account is created only after a parent completes identity verification and gives explicit, granular consent — not a bare checkbox. A parent can withdraw consent at any time, which immediately stops all further data collection for that account without deleting existing history, or delete the account entirely, which does delete the underlying data.

3. How data is used

To operate the product: personalizing the AI Tutor, scheduling reviews, generating parent reports, and showing progress. We do not use student data for behavioural advertising or sell it to third parties — this is a hard rule, not a default that can be changed via settings.

4. Third parties

AI Tutor messages are sent to our AI provider (currently xAI, via the Grok API) to generate responses — this is necessary for the feature to work. We don’t share data with advertisers, data brokers, or anyone outside what’s needed to run the product. [Placeholder — list any additional processors, e.g. hosting/database providers, by name before launch.]

5. Data retention

Data is kept only as long as the account is active. Deleting an account deletes the underlying data with it, including practice history, focus sessions, AI Tutor summaries, and reports.

6. Children’s privacy

Every CBSE student using LockIN is legally a “child” under Indian law (the threshold is 18). We don’t do behavioural tracking or targeted advertising directed at students, full stop — this is a hard rule, not just our own preference.

7. Your rights

A parent can, at any time:

See exactly what’s tracked on the transparency page
Withdraw consent, pausing all further collection
Delete their child’s account and all associated data
Delete their own parent account (their child’s account stays independent)

8. Security

Access to student data is enforced at the database layer via row-level security, not just application code — a bug in one part of the app can’t leak another student’s data. Passwords are hashed, never stored in plain text.

9. Grievance Officer

[Placeholder — add a named Grievance Officer contact for data complaints before launch.]

10. Changes to this policy

We’ll update this page if our practices change, and ask for consent again where a change affects what a parent originally agreed to.