Read the privacy notice (version 1)
# Eddy Learn privacy notice
> **Draft.** This text is a placeholder written for development. It must be replaced by the text counsel approves before Eddy Learn holds real learner data (open question 9 of the reference). A published notice never changes: a new text is published as a new version.
## Who we are
Eddy Learn ("Eddy", "we") is a training platform for JEE Main and similar entrance exams. Eddy decides why and how your personal data is processed and is responsible for it.
## What we collect
- **Account data**: your name, email address, date of birth, preferred language and, if you set one, a password (stored only as a one-way hash).
- **Learning data**: the questions you see, your answers, the time you take, your scores and the practice plans built from them.
- **Technical data**: sign-in sessions, the app version you use and a one-way hash of your network address. We do not store your network address itself.
## Why we use it
You choose the purposes you agree to. Each one is recorded with the version of this notice you saw.
- **Learning service** (`learning_service`): to run your account, show you practice and mock tests, score your answers and track your progress. Without it we cannot provide the service.
- **Email reminders** (`email_reminders`): to remind you of practice you planned or tests you were assigned.
- **Product updates** (`product_updates`): to tell you about new features of Eddy Learn.
You can withdraw a purpose at any time from your account settings. Withdrawing does not affect what was done before.
## Children
If you are under 18, a parent or guardian must agree before your learning data is used, or you can join through your institute. We do not show advertising and we do not track children's behaviour for advertising.
## Who processes it for us
Your data is stored in India (AWS, Mumbai region). We use these processors, each under a data processing agreement:
- **AWS**: hosting, storage, email delivery and logs (logs hold ids only).
- **Sentry**: error reports with ids, never your answers or contact details.
- **healthchecks.io**: job timing only, no personal data.
- **Anthropic**: question-writing rules and example questions only, never your data.
- **Expo**: app builds; later, push notification tokens with generic text.
## How long we keep it
We keep your data while your account is active. An account unused for three years is erased after a warning. When you ask us to erase your account, we wait seven days (you can cancel in that time) and then erase it.
After erasure, copies can survive only in these places and for these times: database backups up to about 63 days, nightly database copies up to 70 days, privacy exports 7 days, request records 7 days, system logs 400 days (ids only) and error reports 90 days (ids only). If a backup is ever restored, every erasure is applied again before the service reopens.
## Your rights
You can see and download your data, correct it, withdraw a consent, and ask us to erase your account, from your account settings. You can also name a person to act for you, and complain to us or to the Data Protection Board of India.
## Contact
The contact details of Eddy's grievance officer will be given here in the approved text.