Privacy policy

PrepLift is used by children between about eight and thirteen. That changes what we are allowed to do with their data under India’s Digital Personal Data Protection Act, 2023, and it changes what we are willing to do regardless of what we are allowed.

This page is meant to be readable. Where it is vague, assume the stricter reading and ask us.

The short version

• A parent consents before a child account exists.
• We do not advertise to children or profile them for advertising.
• We do not track your child across other websites.
• We do not sell data. There is no arrangement under which we would.
• Homework photographs are deleted 90 days after they are sent.
• You can have everything deleted, and it takes one email.

Who we are

We are the Data Fiduciary for the information described here. Our registration details and the Grievance Officer are at the bottom of this page.

What we collect

From the parent

• A WhatsApp number, which is how you sign in — there is no password.
• An email address, if you give us one, so we can reach you.
• The PIN you set for the parent area, stored hashed and never in readable form.
• A record that you consented, and when.

From the child

• Their first name or nickname, their class, and their board.
• Photographs of homework they send, and the text read out of those photographs.
• Questions they type or ask as follow-ups.
• Which skills they are getting right and wrong, so explanations and practice can aim at the right thing.

We do not ask a child for their address, their school, their phone number, or their date of birth.

Automatically

Basic technical records needed to run and secure the service: approximate location from an IP address, browser and device type, and the times of requests. We do not use advertising identifiers or third-party tracking pixels anywhere on the app.

What we do with it

• Read the question in the photograph and explain it.
• Remember what your child found difficult, so the next explanation slows down in the right place and the practice questions are aimed usefully.
• Show you, the parent, which topics are solid and which need work.
• Keep the service running, and stop abuse of it.
• Answer you when you contact us.

We do not use your child’s homework or their mistakes to target advertising, and we do not build an advertising profile of a child. The DPDP Act prohibits tracking and behavioural monitoring of children, and we would not do it in any case.

Consent

A parent or guardian consents before a child account is created. You can withdraw that consent at any time, which stops the processing and lets you delete everything — see Delete my data. Withdrawing consent does not undo processing that already lawfully happened.

Who else sees it

We use a small number of processors to run the service, each bound to use the data only for what we ask:

• Cloud hosting and database — storing the account and the learning history.
• Text recognition — reading the text out of a homework photograph.
• Language models — producing the explanation. They receive the text of the question, not the photograph, and not your child’s name.
• WhatsApp (Meta) — delivering the sign-in link to your number. Their handling of that message is covered by their own terms.

We do not sell data, and we do not share it with anyone for their own purposes. We would disclose it if a law or a valid court order required it, and we would tell you unless we were prohibited from doing so.

Where it is stored

On servers operated by our cloud providers. Some processing happens outside India, including the language models that produce explanations. Where that is the case, the data sent is the question text, without your child’s name or your contact details attached.

How long we keep it

• Homework photographs: 90 days from when they were sent, then deleted automatically.
• Questions, explanations and progress: while the account is open, because that is what makes the next explanation better than the last.
• After deletion: removed within 7 days, and aged out of encrypted backups within 30.
• Records we must keep by law: only those, only for as long as required, and containing no homework.

Your rights

Under the DPDP Act you may ask what we hold, have it corrected, have it deleted, withdraw consent, and nominate someone to act for you. Write to privacy@preplift.in and we will answer within 5 business days. We do not charge for any of this.

Security

Traffic is encrypted in transit. Homework photographs sit in private storage that is not publicly reachable; the app reaches them through short-lived links. The database enforces, at the database level rather than only in our code, that one family’s rows cannot be read by another. PINs are hashed. No system is perfect, and if a breach affects you we will tell you and the Data Protection Board as the Act requires.

Changes

If we change this in a way that matters, we will tell you before it takes effect rather than quietly changing the date at the top.

Grievance Officer

If you are unhappy with how we have handled your child’s data, write to the Grievance Officer below. If we do not resolve it, you may complain to the Data Protection Board of India.

The app itself is at app.preplift.in, and this policy covers it as well as this website.