Privacy Policy

Genius Quizzes (“we”, “us”) is the Data Fiduciary for personal data processed through this app. This policy explains what we collect, why, who we share it with, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (“DPDP”).

1. Information We Collect

Account Information

When you create an account we collect your name, email address, and optionally your phone number, profile picture, and Indian state (used to surface state-specific exam content). If you sign in with Google or Apple, we receive the basic profile information those providers expose to us (name, email, profile photo, sub).

Usage Data

We record how you use the app — quizzes attempted, answers selected, time spent on questions, bookmarks, streaks, achievements, and goals — so the app can show your dashboard and personalise practice.

Device & Diagnostic Information

We collect device type, OS version, app version, an installation-scoped device identifier, and (for sessions you start with us) push-notification tokens. For payment, security, and abuse-prevention events we also log your IP address and User-Agent.

What we don’t collect

We do not collect Aadhaar, PAN, or any government ID; precise geolocation; biometric data; card numbers (Razorpay handles those directly); or health data.

2. How We Use Your Information

• Deliver and personalise the quiz experience (contractual basis)
• Track your progress, streaks, and performance analytics
• Display leaderboards, achievements, and friend challenges
• Process payments securely via Razorpay or in-app purchase (Apple / Google)
• Send you transactional notifications (welcome, payment receipt, password reset) — these cannot be turned off without affecting service
• Send you optional reminders, weekly digests, and promotional messages — these are off by default and you can toggle them in Settings → Notifications
• Diagnose technical issues and improve app stability (only if you have opted in to crash reporting / analytics)
• Detect fraud and abuse

3. Data Storage & Security

Your data is stored on Supabase’s managed PostgreSQL in the ap-south-1 (Mumbai, India) region with row-level security policies. All in-transit traffic is encrypted with TLS. On your device, authentication tokens are kept in platform-secure storage (Keychain on iOS, EncryptedSharedPreferences on Android), and the local quiz cache is encrypted with SQLCipher. Backups are managed by Supabase using their standard at-rest encryption.

4. Third-Party Services (Sub-processors)

We share the minimum personal data needed with the following sub-processors:

Cross-border transfers above are made under DPDP §16, which permits transfers to any country not specifically restricted by the Government of India. Each sub-processor is bound by its own data-processing terms and we maintain DPAs where the vendor offers them.

5. Data Retention

We retain personal data only for as long as we need it for the purpose collected:

• Active accounts: personal profile data is kept until you delete your account.
• Inactive accounts: if you have not signed in for 24 months we will email you and, if there is no response, anonymise your account.
• Security audit logs (IP, User-Agent): 365 days for fraud and chargeback investigation.
• Admin activity logs: 90 days.
• Notifications: 90 days after read, 180 days if unread.
• Support tickets: personal fields are anonymised 365 days after the ticket is closed.
• Push tokens / device records: dropped after 180 days of inactivity.
• Financial records (orders, payments, invoices): retained for the period required by Indian tax law (currently 8 years), even after account deletion, with the user identifier anonymised.

If you delete your account, we remove or anonymise your personal data within 30 days, subject to the financial-records exception above.

6. Your Rights

Under DPDP §11–§14 you have the right to:

• Access a summary of your personal data — Settings → Privacy → Export my data, or email us
• Correct inaccurate data — Settings → Edit Profile / Change Email
• Delete your account and associated data — Settings → Delete Account, or visit geniusquizzes.in/delete-account/
• Withdraw consent at any time — Settings → Privacy. Withdrawal is as easy as granting; existing transactional service continues only where another lawful basis (contract performance) applies
• Nominate another person to exercise these rights on your death or incapacity — email us
• Lodge a grievance with our Grievance Officer (see §9), and if unresolved, with India’s Data Protection Board

7. Children’s Privacy

Under DPDP, anyone under 18 is a child. Genius Quizzes is intended for users aged 18 and above. If you are between 13 and 18 you may use the app only with verifiable parental consent; we will collect the minimum data needed and we do not run behavioural tracking, session replay, or marketing on accounts identified as belonging to minors. We do not knowingly process data from anyone under 13. If you believe a child has provided us with personal information, please email our Grievance Officer (§9) and we will delete it.

8. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes via in-app notice or email. Continued use of the app after changes constitutes acceptance of the updated policy. Previous versions are available on request.

9. Contact & Grievance Officer

For any privacy question, exercise of rights, or grievance under DPDP:

• Grievance Officer: Genius Quizzes Privacy Team
• Email: privacy@geniusquizzes.in (acknowledged within 7 days, resolved within 30 days)
• General contact: hello@geniusquizzes.in