How Brain Grain handles personal data
Who We Are
Brain Grain Learning Centre (UDYAM Registration: UDYAM-TN-02-0446699) provides Samacheer Kalvi study resources for Classes 6–12, exam preparation for TET, CTET, TNPSC, SSC CGL, RRB NTPC, UPSC CSE, and other competitive exams, question papers, reviews, and support tools, through the braingrain.in website and the Brain Grain Android app. Operated by Amul. Contact: thebraingrain@gmail.com. Location: Chennai, Tamil Nadu, India.
Data We Collect
We collect the following categories of personal and usage data:
Data you give us directly
- Contact and support requests: Name, email address, phone number, topic, and message when you submit a support form.
- Reviews and feedback: Name, star rating, and comments when you post a review.
- Payment details: Name, email, phone number, amount, order ID, and payment status when purchasing paid access. Payments on the website are processed by Razorpay; purchases made inside the Android app are processed by Google Play Billing. In both cases the processor handles your card or UPI details — we never receive or store them.
- Phone number for login (OTP): When you use phone-based login, your phone number is collected to send and verify a one-time password (OTP) via Supabase Authentication. Your phone number is stored as your authentication identity.
- WhatsApp notification subscription: When you submit a support request, your phone number may be stored in our WhatsApp subscriber list to allow us to send you status updates or replies.
The Brain Grain Android app
The Brain Grain app (in.braingrain.app on Google Play) is the same service on a phone, and everything in this policy applies to it. Specific to the app:
- You can use it without an account. Practice, the daily test, chapter reading and reel mode all work signed out. Signing in is only needed to carry your progress between devices, to appear on the leaderboard, and to hold a pass.
- Stored on your phone only: your class or exam choice, language, theme, reminder time, and your study history (answers, streak, bookmarks, chapter progress). Uninstalling the app deletes all of it. Your sign-in session is deliberately excluded from Android backup and phone-to-phone transfer, so a session token is never copied to another device.
- Sent to our servers when you are signed in: XP, streak, topic mastery, your mistake book and your spaced-review queue, so the app and the website show the same learner. Signed out, none of this leaves the phone except the daily-test score below.
- Anonymous device identifier: a random id generated on first launch (no advertising ID, no hardware identifier) used to place your daily-test and mock scores on a rank list, and to group crash reports. It does not identify you.
- Crash and error reports: the error message and stack trace, app version, Android version, device make and model, and the anonymous device id above. Sent so we can fix faults; not used for anything else.
- App analytics: the same event names the website records (opening the app, starting and finishing a quiz, a streak day, signing in, viewing or buying a pass) via Google Analytics 4, tagged as coming from Android. No screen recording, and no session replay in the app.
- Purchases: a pass bought inside the app goes through Google Play Billing. Google handles the payment; we receive only the purchase token, which we check with Google to activate your pass. We never see your card details.
- Permissions: internet and network state, and notifications (only if you turn on the daily reminder). The app asks for no location, contacts, camera, microphone, photos or files.
- No advertising. There are no ads in the app, no ad SDK, and no data is shared with advertising or data-broker networks.
Data we generate automatically
- Anonymous visitor identifier (bg_cid): A randomly generated identifier stored in your browser (localStorage) that is created automatically on your first visit. It links your study XP and progress without identifying you personally.
- XP, study streak, and progress data: Your experience points (XP), daily XP, study streak count, and optional display name are stored in our database, linked to your bg_cid (anonymous) or your logged-in account.
- AI doubt questions (retired): The AI doubt solver has been withdrawn and no longer accepts questions. Records from when it ran (grade, subject, question text, page context, usage count and session identifier) are retained only as long as needed and are not used for anything new.
- Login session tokens: Authentication session tokens stored in your browser (localStorage under sb-auth-token) to keep you signed in across visits.
- Site error logs: When a site error occurs, we automatically log the page URL, browser/device type, viewport size, and scroll position to help us diagnose and fix issues.
- Analytics data: Page views, click events, and usage patterns via Google Analytics 4 and Microsoft Clarity (which also captures session replays and heatmaps). These are processed under Google's and Microsoft's own privacy policies.
- Technical signals: Approximate device/network signals used for abuse prevention and AI usage limits.
Why We Use Data
- To deliver study pages and the Android app, XP progress tracking, and study streak features.
- To process payments and activate paid AI access.
- To respond to support requests and send WhatsApp updates where subscribed.
- To prevent misuse, enforce fair usage limits, and protect paid content.
- To debug errors and improve site reliability.
- To understand how the site is used and improve content quality.
Services We Use
We rely on the following third-party services, each operating under its own privacy policy:
- Supabase — Phone OTP authentication, and database storage for XP, progress, orders, reviews, support requests, WhatsApp subscribers, and error logs.
- Razorpay — Payment processing for purchases made on the website.
- Google Play Billing — Payment processing for purchases made inside the Android app. Google handles the payment and we receive only a purchase token to verify.
- Google Analytics 4 — Site usage analytics. Data is processed by Google.
- Microsoft Clarity — Session recordings and heatmaps for UX improvement. Data is processed by Microsoft.
- Resend — Email delivery for internal support and notification emails.
- Netlify — Web hosting and serverless backend functions.
Children, Parents, and the DPDP Act 2023
Brain Grain is primarily used by school students (Classes 6–12) and exam aspirants. We take our obligations under the Digital Personal Data Protection Act 2023 (DPDP Act) seriously.
- Students under 18 should use paid access, phone or email login, support forms, and reviews with parent or lawful guardian involvement.
- Under the DPDP Act 2023, processing personal data of children (persons under 18 years of age) requires verifiable parental or guardian consent. We do not knowingly collect personal data from minors without such consent.
- We do not use any student data for targeted advertising, behavioural profiling, or commercial tracking.
- Anonymous study data (bg_cid, XP, streak) does not contain any directly identifying information and is used solely to support the learner's experience on our platform.
- If a parent or guardian believes we hold a child's personal data without proper consent, please contact us immediately at thebraingrain@gmail.com and we will delete the relevant data promptly.
Your Rights and Choices
Under applicable Indian law, including the DPDP Act 2023, you have the right to:
- Access a summary of personal data we hold about you.
- Request correction of inaccurate or incomplete personal data.
- Request deletion ("right to erasure") of your personal data where it is no longer necessary.
- Withdraw consent where our processing is based on consent.
- Nominate another person to exercise these rights on your behalf.
- Raise a grievance with our Grievance Officer (see below).
To exercise any right, email thebraingrain@gmail.com with enough detail to identify your request (for example, your phone number, order ID, or registered email).
Deleting Your Account and Data
You can ask us to delete your Brain Grain account and everything attached to it, at any time, for any reason, without giving one.
- From the Android app: Profile → Delete my account and data.
- From anywhere: email thebraingrain@gmail.com from your registered address, or include your registered phone number.
What is deleted: your sign-in identity (email or phone), display name, XP, daily and weekly XP, study streak, topic mastery, mistake book, spaced-review queue, leaderboard entry, and any referral code and referral records.
What we keep, and why: payment and order records where Indian tax and accounting law requires us to retain them, and anonymised, non-identifying counts already aggregated into site statistics. Neither can be used to identify you afterwards.
What deletion cannot do: it does not refund or transfer a pass you have bought — use the refund policy for that — and it cannot reach study progress that only ever existed on your own phone or browser. Uninstalling the app, or clearing your browser storage, removes that.
How long it takes: we reply to confirm the request is genuine, then complete the deletion within 30 days. We confirm in writing when it is done. A deletion request is confirmed before it is carried out precisely because it cannot be undone.
Browser Storage and Cookies
We use browser localStorage (not traditional cookies) to store your anonymous visitor identifier (bg_cid), login session token (sb-auth-token), and study progress preferences. Google Analytics 4 and Microsoft Clarity set their own cookies for analytics. You can clear localStorage and cookies at any time using your browser settings; this will reset your local study progress and log you out.
Data Retention and Security
We keep personal data only as long as reasonably needed for the purposes described in this policy — typically for as long as you have active account activity, plus reasonable periods required for payment records, legal compliance, and abuse prevention. We use HTTPS, server-side API keys, and Supabase access controls to protect data. No internet service can guarantee absolute security.
Grievance Officer
In accordance with the Information Technology Act 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, the following Grievance Officer is designated to address complaints and concerns about personal data and content:
- Name: Amul
- Designation: Grievance Officer, Brain Grain Learning Centre
- UDYAM Registration: UDYAM-TN-02-0446699
- Email: thebraingrain@gmail.com
- Address: Chennai, Tamil Nadu, India
We will acknowledge your complaint within 24 hours of receipt and endeavour to resolve it within 15 days of receipt, as required under applicable law.
Governing Law
This Privacy Policy and any disputes arising from it are governed by the laws of India. Any unresolved disputes are subject to the exclusive jurisdiction of the courts of Chennai, Tamil Nadu, India.
Contact and Complaints
For any privacy concern, contact us first at thebraingrain@gmail.com. If you are not satisfied with our response, you may escalate to our Grievance Officer above, or use remedies available under the DPDP Act 2023 and IT Act 2000.