Privacy Policy

1. Who we are

XamBaaz (“we”, “us”) operates www.xambaaz.com — a free-to-start exam-preparation platform for students in Class 8–12. You can install XamBaaz to your phone or desktop straight from the site, which gives it its own icon and a full-screen app experience; there is no separate app-store download, and the installed app is this same website. This policy therefore covers both, and explains what data we collect, why, and your rights over it. For any privacy request, contact hello@xambaaz.com.

2. Information we collect

Account information: when you sign in with Google, we receive your name, email address and profile picture from Google. We do not see or store your Google password.

Profile information: the class, target exam and (optionally) school/institute code you provide during onboarding.

Learning activity: the quizzes and mock tests you attempt, your answers, scores, time taken, streaks and XP — used to power your dashboard, analytics and progress tracking.

Time spent in the app: while you are signed in, how many minutes you actively use XamBaaz each day, kept as one total per day. It stops counting when the tab is in the background or you have not touched the screen for two minutes. Only the XamBaaz team sees it, to understand how the platform is used; it is not shared with schools or anyone else, and never used for advertising.

Prompts you see: while you are signed in, we record which in-app prompts are shown to you (such as an upgrade offer or the reminder request) and how you answer your browser's notification permission request, kept as a count per day and used only to improve those prompts.

Checkout steps: if you start a purchase, we record the steps you reach — a tap on 'Sign in & buy' (counted by Google Analytics on our public pages, without your identity), reaching the payment page, secure checkout opening, and whether a payment did not go through with a general reason only (never card or bank details) — kept as a count per day and used only to fix problems in checkout.

Feedback you choose to send: after your first quiz we ask one question about how it went. Answering is optional, the short note that follows is optional, and we never ask for anything that identifies you beyond the account you are already signed in to.

Payment information: when you upgrade, payments are processed by our payment provider (Razorpay). We receive a confirmation and your billing email to activate access; we do not store your card or bank details.

Technical data: standard server logs (IP address, browser type, timestamps) for security and reliability.

Approximate location at sign-up: the city and state your internet connection appears to come from when you first set up your account, as provided by our hosting provider. We do not store your IP address with it, record it only once, and use it only to see which cities our students come from, in aggregate. It is never shown publicly or shared.

How you found us: when you create an account, we also record which website, app or campaign link brought you to XamBaaz and the first page you opened (your browser keeps this note until you sign up); it holds no identifiers and is used only to see which channels bring new students.

WhatsApp messages (optional): if you ask for your daily challenge or for help with your studies on WhatsApp, we store your mobile number and the time you agreed. The daily reminder is at most one short message a day, after school hours, containing only your first name, your rank and a link to the app — never your scores. If you asked for help, a member of the XamBaaz team may also send you personal study notes, which can mention the chapters you are finding hard. You can stop all of it any time under Settings. The number is not used for sign-in, advertising or anything else, and is never shared.

Parent updates (optional): a student may add a parent's or guardian's WhatsApp number and/or email address, with the parent's or guardian's consent recorded at that moment. We then send that parent at most one short update a day about the student's practice (whether they practised that day and how many quizzes, the latest score, their strongest chapter and the next chapter to work on, their streak, a summary of their last 7 days and their rank among XamBaaz students) with a private link to the student's progress page. The parent can unsubscribe from every email in one click or reply STOP on WhatsApp, and the student can remove the contact under Settings at any time; we never use these details for anything else or share them.

Reminder subscription (optional): if you allow notifications, we store your browser's push subscription (an endpoint issued by your browser vendor, not your phone number or email) so we can send one short practice reminder a day. The reminder contains only your rank, your streak and the name of the day's concept for your class (the same concept every student in that class sees). Turn it off any time under Settings → Reminders, or by blocking notifications in your browser; the subscription is deleted when it stops working.

3. How we use your information

To provide the service: authenticate you, save your progress, generate your performance dashboard, and unlock content you are entitled to.

To improve the product: understand which chapters are hard, fix mis-keyed questions, and improve content quality (in aggregate).

To process payments and grant access after a successful upgrade.

To communicate essential service messages (e.g. account or access changes). We do not sell your data or send third-party marketing.

4. Institutes and schools

If you sign in using a school or institute code, your account is tagged to that institute so its coordinator can view aggregate and individual performance reports for their students. This is limited to learning activity and profile data — never your password or payment details. If you did not intend to join an institute, contact us to be untagged.

5. Data sharing

We share data only with service providers who help us run XamBaaz — our hosting and database providers (Vercel, Neon), authentication (Google), payments (Razorpay), WhatsApp (only for the optional WhatsApp messages described above) and website analytics on our public pages (Google Analytics, see 5a) — strictly to deliver the service. We may disclose data if required by law. We do not sell personal data.

5a. Cookies and website analytics

XamBaaz sets only the first-party cookies it needs in order to work: the sign-in session cookie, and small markers that tell our server whether a request is signed in and where you are in onboarding. Your language and theme choice, and the state of the help widget, are kept in your browser's own storage rather than in cookies.

On our public pages — the home page, blog, FAQ, pricing, and our public practice and mock-test listings — we use Google Analytics 4 to understand how people find XamBaaz: which searches and referring sites bring visitors, and which pages they arrive on. This sets Google Analytics cookies (_ga and _ga_*) that recognise a returning browser.

Analytics does not run on the app pages where you practise. On your home, dashboard, subject, chapter, quiz and result pages the analytics tag is not loaded at all, and is additionally switched off in your browser, so your route through your own practice is never measured or sent to Google. Where analytics does run, we remove the query string from the page address before reporting it, and we have turned off Google's advertising and cross-device signals — so this data cannot be used to build an advertising profile of you.

Because our users include children, we do not use analytics for behavioural profiling, remarketing or advertising, and we run no advertising or social-media tracking pixels anywhere on XamBaaz.

6. Data retention

We keep your account and learning data for as long as your account is active. You can request deletion at any time (see your rights below), after which we remove your personal data except where we must retain limited records for legal or accounting reasons.

6a. Spoken-English (voice) practice

Our spoken-English practice feature uses your device's own browser to convert your speech to text — your audio is processed entirely on your device and is never recorded, uploaded or stored on our servers. We receive only the resulting text transcript, which we score and store alongside your other learning data so you can track your progress. You can do voice practice or skip it entirely; either way, no voice recording leaves your device.

6b. Mobile number (optional)

Your profile has an optional mobile number field. You do not have to fill it in, and nothing in the app is withheld if you leave it blank. If you do provide one, we use it only to contact you about your own account — for example if a payment or access problem needs sorting out. We do not verify it, we do not send marketing SMS, and we never sell or share it with third parties. You can change or clear it at any time from your Profile page, and clearing it deletes it from our records.

7. Your rights (DPDP Act, 2023)

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to access, correct and update your data, the right to erasure, the right to grievance redressal, and the right to nominate. To exercise any of these, email hello@xambaaz.com and we will respond within a reasonable period.

For users under 18, processing relies on verifiable parental/guardian consent where required; a parent or guardian may contact us to exercise these rights on the child's behalf.

8. Security

We use industry-standard measures — HTTPS everywhere, security headers, and access controls — to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your information and to address issues promptly.

9. Children's privacy

XamBaaz is intended for school students and is used with parental/guardian awareness. We collect only the data needed to provide the learning service. If you believe a child has provided data without appropriate consent, contact us and we will delete it.

10. Changes to this policy

We may update this policy as the product or law evolves. The “last updated” date below reflects the latest version; material changes will be highlighted on this page.

11. Contact & grievance officer

For privacy questions, data requests or grievances, contact: Bithindra Biswas, XamBaaz — hello@xambaaz.com. We aim to acknowledge and resolve grievances in line with the DPDP Act, 2023.