Legal

Privacy Policy

Last revised: 2026-09-18

This policy states what BITS Goa Prep collects, why each field is collected, how long it is kept, and how an account holder exercises data rights. It applies to https://bitsgoa.goatedd.tech.

Data collected

Data collected, the reason, and the retention period
Data	Reason	Retention
Email address	Identifies the account and receives the six-digit sign-in code	While the account exists
Name	Labels the account on screen and in support requests	While the account exists
Google account identifier	Matches a returning account when Google sign-in is used	While the account exists
Sign-in code, stored as a SHA-256 hash	Verifies the code entered at sign-in	10 minutes, then the row is closed
Device identifier, fingerprint hash, browser and platform label	Enforces the limit of two devices and detects a cleared cookie	While the account exists
Session token, stored as a SHA-256 hash	Keeps one session signed in and ends the older session on a new device	30 days from last use
IP address, city, country and approximate coordinates	Shows the device list, and flags one account signing in from two distant cities	24 months
Study progress, answers, timings and error log	Produces mastery, readiness, the study plan and the revision queue	While the account exists
Written exam answers	Sent to Google's Gemini API to be marked, and not used to train its models. Only the mark is stored; the answer itself is not	Mark kept while the account exists. Answer not stored
Usage analytics: pages opened, controls used, question outcomes, study time, and session recordings with input values masked	Measures which material works, and supports the product case study	24 months
Audit and anomaly records	Supports account recovery and detects credential sharing	24 months
Razorpay order id, payment id, event id, plan and access dates	Proves the purchase and sets the access period	As required by Indian tax and accounting law

Payment details

Card numbers, UPI identifiers, bank credentials and one-time passwords are entered on Razorpay’s checkout and never reach this server. BITS Goa Prep receives the order identifier, the payment identifier, the amount and the status, and stores those against the account.

Cookies and local storage

Session cookie: an httpOnly, secure cookie holding a session token. Required for sign-in.
Device cookie: a random device identifier, kept for the device limit.
Local storage: theme choice and a cache of study progress, held on the device only.
Analytics cookie: a random visitor identifier set by PostHog, used to join one person's activity across visits.

Who else receives the data

Google LLC receives written exam answers submitted for marking, through the Gemini API, and does not use them to train its models.
Razorpay Software Private Limited processes payments and returns the payment identifiers listed above.
Google LLC verifies identity when Google sign-in is used.
The mail server that delivers the six-digit sign-in code receives the email address.
PostHog Inc. receives usage analytics: pages opened, controls used, question outcomes, study time, error reports, and session recordings in which every input value and the sign-in fields are masked.
Umami, self-hosted on stats.goatedd.tech, receives a page-view count with no cookie and no cross-site identifier.

Security

Transport: HTTPS on every request
Secrets: Sign-in codes and session tokens stored as SHA-256 hashes
Access: Administrator access limited to the addresses in ADMIN_EMAILS

Rights and how to exercise them

A copy of the personal data held on an account is available on request.
An incorrect name or email address is corrected on request.
An account and its progress data are deleted on request, subject to records that tax law requires to be kept.
Consent to optional processing is withdrawn on request.
Requests go to hello@goatedd.tech from the email address on the account, and are answered within 30 days.

Grievance officer

Name: To be confirmed
Designation: To be confirmed
Email: hello@goatedd.tech
Phone: To be confirmed

Acknowledgement: Within 48 hours of receipt
Resolution: Within one month of receipt