Privacy Policy

1. Who we are

XamBaaz (“we”, “us”) operates www.xambaaz.com — a free-to-start exam-preparation platform for students in Class 8–12. You can install XamBaaz to your phone or desktop straight from the site, which gives it its own icon and a full-screen app experience; there is no separate app-store download, and the installed app is this same website. This policy therefore covers both, and explains what data we collect, why, and your rights over it. For any privacy request, contact hello@xambaaz.com.

2. Information we collect

Account information: when you sign in with Google, we receive your name, email address and profile picture from Google. We do not see or store your Google password.

Profile information: the class, target exam and (optionally) school/institute code you provide during onboarding.

Learning activity: the quizzes and mock tests you attempt, your answers, scores, time taken, streaks and XP — used to power your dashboard, analytics and progress tracking.

Time spent on XamBaaz: while you are signed in, how many minutes you actively use XamBaaz each day, on the app and on our public pages, kept as a total per day and split by part of the site (for example home, chapter pages, quizzes or results). We do not record which pages or links you open, only the part of the site. It stops counting when the tab is in the background or you have not touched the screen for two minutes (eight minutes on pages meant for reading, such as notes, answers and articles). For this, a small first-party cookie named xb_in is set while you are signed in; it holds no personal data and is removed when you sign out. Only the XamBaaz team sees it, to understand how the platform is used; it is not shared with schools or anyone else, and never used for advertising.

Prompts you see: while you are signed in, we record which in-app prompts are shown to you (such as an upgrade offer or the reminder request) and how you answer your browser's notification permission request, kept as a count per day and used only to improve those prompts.

Checkout steps: if you start a purchase, we record the steps you reach — a tap on 'Sign in & buy' (counted by Google Analytics on our public pages, without your identity), reaching the payment page, secure checkout opening, and whether a payment did not go through with a general reason only (never card or bank details) — kept as a count per day and used only to fix problems in checkout.

Feedback you choose to send: after your first quiz we ask one question about how it went. Answering is optional, the short note that follows is optional, and we never ask for anything that identifies you beyond the account you are already signed in to.

Payment information: when you upgrade, payments are processed by our payment provider (Razorpay). We receive a confirmation and your billing email to activate access; we do not store your card or bank details.

Technical data: standard server logs (IP address, browser type, timestamps) for security and reliability.

Approximate location at sign-up: the city and state your internet connection appears to come from when you first set up your account, as provided by our hosting provider. We do not store your IP address with it, record it only once, and use it only to see which cities our students come from, in aggregate. It is never shown publicly or shared.

How you found us: when you create an account, we also record which website, app or campaign link brought you to XamBaaz and the first page you opened (your browser keeps this note until you sign up); it holds no identifiers and is used only to see which channels bring new students.

WhatsApp (support, and sign-ups before 29 September 2026): if you chat with us on WhatsApp for help, we see your number and messages there and use them only to help you. Students who asked for their daily challenge on WhatsApp before 29 September 2026 may still get at most one short message a day, after school hours, containing only their first name, their rank and a link to the app — never their scores — until they stop it under Settings. The number is not used for sign-in, advertising or anything else, and is never shared.

Telegram messages (optional): XamBaaz sends its daily messages on Telegram. If you link your Telegram account by tapping Start on the XamBaaz bot, we store your Telegram chat ID and the time you linked it, and send you one short invitation a day to that day's challenge — never your scores. If you tap Start, the bot sends the challenge questions in the chat and records your answers as your daily challenge, exactly as if you had answered in the app, then shows your result. Send /stop to the bot or turn it off under Settings to stop, and the chat ID is deleted. It is not used for anything else and is never shared.

Parent updates (optional): a student may send a parent or guardian a Telegram link and/or add their email address. The parent's own tap on Start in Telegram, or their own press of Confirm in the one email we send to a newly added address, is their agreement (nothing else is sent to an address until it is confirmed); for Telegram we store the parent's chat ID and the time they linked. We then send that parent at most one short update a day about the student's practice (whether they practised that day and how many quizzes, the latest score, their strongest chapter and the next chapter to work on, their streak, a summary of their last 7 days and their rank among XamBaaz students) with a private link to the student's progress page. The parent can send /stop on Telegram or unsubscribe from every email in one click, and the student can remove either under Settings at any time; we never use these details for anything else or share them. Parent WhatsApp numbers added before 29 September 2026 are kept only until the parent replies STOP or the student removes them.

Reminder subscription (optional): if you allow notifications, we store your browser's push subscription (an endpoint issued by your browser vendor, not your phone number or email) so we can send one short practice reminder a day. The reminder contains only your rank, your streak and the name of the day's concept for your class (the same concept every student in that class sees). Turn it off any time under Settings → Reminders, or by blocking notifications in your browser; the subscription is deleted when it stops working.

3. How we use your information

To provide the service: authenticate you, save your progress, generate your performance dashboard, and unlock content you are entitled to.

To improve the product: understand which chapters are hard, fix mis-keyed questions, and improve content quality (in aggregate).

To process payments and grant access after a successful upgrade.

To communicate essential service messages (e.g. account or access changes). We do not sell your data or send third-party marketing.

4. Institutes and schools

If you sign in using a school or institute code, your account is tagged to that institute so its coordinator can view aggregate and individual performance reports for their students. This is limited to learning activity and profile data — never your password or payment details. If you did not intend to join an institute, contact us to be untagged.

5. Data sharing

We share data only with service providers who help us run XamBaaz — our hosting and database providers (Vercel, Neon), authentication (Google), payments (Razorpay), WhatsApp and Telegram (only for the optional messages described above), website analytics (Google Analytics, on our public pages and for six one-time account steps, see 5a) and advertising measurement (Meta, on our page for parents only, see 5b) — strictly to deliver the service. We may disclose data if required by law. We do not sell personal data.

5a. Cookies and website analytics

XamBaaz sets only the first-party cookies it needs in order to work: the sign-in session cookie, and small markers that tell our server whether a request is signed in and where you are in onboarding. Your language and theme choice, and the state of the help widget, are kept in your browser's own storage rather than in cookies.

On our public pages — the home page, blog, FAQ, pricing, and our public practice and mock-test listings — we use Google Analytics 4 to understand how people find XamBaaz: which searches and referring sites bring visitors, which pages they arrive on, and which buttons they tap there (such as Sign in, WhatsApp or the language switch). On a chapter page's practice questions we also count whether each tapped answer was right and the score at the end, never which option was chosen. On the sign-in page we count that it was opened and whether Google or an email code was chosen, never the email address typed. This sets Google Analytics cookies (_ga and _ga_*) that recognise a returning browser.

Analytics does not run on the app pages where you practise. On your home, dashboard, subject, chapter, quiz and result pages the analytics tag is not loaded at all, and is additionally switched off in your browser, so your route through your own practice is never measured or sent to Google. Where analytics does run, we keep only campaign tags (utm_…) in the page address and remove the rest of the query string before reporting it, and we have turned off Google's advertising and cross-device signals — so this data cannot be used to build an advertising profile of you.

Six one-time steps: so we can see which channels bring students who stay, our server tells Google Analytics, at most once each per account, when you create your account, choose your class, finish your first quiz, add a parent's email or WhatsApp number, ask for help on WhatsApp, and when a purchase goes through. Each message carries only the Google Analytics cookie ID our public pages already set, your class, the subject and type of that first quiz, whether the parent contact is WhatsApp or email, and the plan and amount paid. It never includes your name, email, phone number, school, answers or scores, and nothing else about your practice is sent. If your browser has no Google Analytics cookie, nothing is sent.

Because our users include children, we do not use analytics for behavioural profiling, remarketing or advertising, and we run no advertising or social-media tracking pixels on any page students use. The one exception is a single page written for parents, described in 5b.

5b. Meta Pixel on our page for parents

Our page for parents (xambaaz.com/for-parents) and its payment page (xambaaz.com/for-parents/pay), where our advertisements for parents lead, load the Meta Pixel so we can measure whether those advertisements work. It runs on those two pages only — never on the home page, practice, mock-test or blog pages, and never on any page after you sign in.

On those pages the pixel tells Meta that the page was visited, when a visitor taps the button to get their child complete access, when a visitor starts a payment, when a payment is completed (with its amount only), and when a visitor taps Sign in. Meta's automatic collection of other clicks and page details is switched off, and nothing more is sent once you leave the page. Meta may set its own cookie (_fbp) and link the visit to a Meta account you are signed in to, under Meta's own privacy policy. We do not send Meta any name, email, phone number or anything about a student's practice.

You can avoid it by blocking third-party cookies or trackers in your browser, or by adjusting your ad settings in your Meta account.

6. Data retention

We keep your account and learning data for as long as your account is active. You can request deletion at any time (see your rights below), after which we remove your personal data except where we must retain limited records for legal or accounting reasons.

6a. Spoken-English (voice) practice

Our spoken-English practice feature uses your device's own browser to convert your speech to text — your audio is processed entirely on your device and is never recorded, uploaded or stored on our servers. We receive only the resulting text transcript, which we score and store alongside your other learning data so you can track your progress. You can do voice practice or skip it entirely; either way, no voice recording leaves your device.

6b. Mobile number (optional)

Your profile has an optional mobile number field. You do not have to fill it in, and nothing in the app is withheld if you leave it blank. If you do provide one, we use it only to contact you about your own account — for example if a payment or access problem needs sorting out — and, if you enter it when enrolling in the XamBaaz Olympiad, about the Olympiad: reminders, results and prizes. We do not verify it, we do not send marketing SMS, and we never sell or share it with third parties. You can change or clear it at any time from your Profile page, and clearing it deletes it from our records.

6c. The XamBaaz Olympiad

When you take the XamBaaz Olympiad, we use your scores, the time you took and your practice days to rank each category and decide the monthly prizes. Rankings shown to other students and the winners shown on our website use your first name and the initial of your surname only — never your full name, email, school or photo. We email prize winners at their account email.

7. Your rights (DPDP Act, 2023)

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to access, correct and update your data, the right to erasure, the right to grievance redressal, and the right to nominate. To exercise any of these, email hello@xambaaz.com and we will respond within a reasonable period.

For users under 18, processing relies on verifiable parental/guardian consent where required; a parent or guardian may contact us to exercise these rights on the child's behalf.

8. Security

We use industry-standard measures — HTTPS everywhere, security headers, and access controls — to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your information and to address issues promptly.

9. Children's privacy

XamBaaz is intended for school students and is used with parental/guardian awareness. We collect only the data needed to provide the learning service. If you believe a child has provided data without appropriate consent, contact us and we will delete it.

10. Changes to this policy

We may update this policy as the product or law evolves. The “last updated” date below reflects the latest version; material changes will be highlighted on this page.

11. Contact & grievance officer

For privacy questions, data requests or grievances, contact: Bithindra Biswas, XamBaaz — hello@xambaaz.com. We aim to acknowledge and resolve grievances in line with the DPDP Act, 2023.