The Grade Master is a learning app for school pupils, on the web at thegrademaster.com and on Android and iOS. This page explains what we collect, why, who we share it with, and how to get it deleted.

Last updated: 21 October 2026

Who decides how the data is used

Most of our users are children. Under India’s Digital Personal Data Protection Act, 2023, a child’s account only becomes active after a parent or guardian gives verifiable consent: we email the parent a code, and the account stays pending until it is entered. The parent can see, pause or delete the account at any time.

What we collect

• Pupil profile: name, grade, date of birth, gender (optional), school name and address, city, a login ID, and the avatar the pupil picks.
• Parent or guardian: name, email address, mobile number and relationship to the child.
• Sign-in secrets: passwords and PINs, stored only as salted scrypt hashes, never in readable form. One-time codes are stored only as hashes and expire.
• Learning activity: quiz answers, whether they were right, time taken, confidence, points, badges, mistakes to revisit, and Challenge-mode results.
• Consent records: what the parent agreed to, the version of the wording, and when, from which IP address and browser.
• Sign-in sessions and devices: when a session started and was last active, the browser or device name, and for the mobile app a device label and platform.
• Emails we sent: a copy of each account email (recipient, subject, body) so we can show delivery problems.
• Abuse protection: short-lived counters keyed by IP address or login ID that limit repeated sign-in attempts.

We do not use advertising, ad identifiers, or third-party analytics or tracking tools, and we never sell personal data. The mobile app does not access contacts, photos, location or the camera. iOS lists a microphone permission because the sound engine needs it to play quiz music; the app never records you.

Why we use it

• To run the child’s account and let them sign in.
• To save progress, personalise practice and show mistakes to revisit.
• To show class progress to the child’s teachers in school programmes.
• To email the parent account notices and progress summaries.
• Only if the parent opts in: occasional learning tips.

We never use a child’s data to profile them for advertising or to target ads.

Who we share it with

We use these service providers, only to run The Grade Master:

• Supabase: database hosting, in Mumbai, India.
• Our cloud server provider: hosts the website and app API.
• Resend: sends account emails to parents.
• Google Gemini: after a quiz, it gets the questions and the pupil’s answers to suggest what to practise next. We send no name, login ID or other identifier with them.
• Google Maps Places: the school search box at sign-up sends what you type to Google.

We also share data when the law requires it. We do not share data with anyone else.

Cookies and app storage

The website sets only sign-in cookies (secure and httpOnly): one day for pupils, 30 days for parents and 7 days for staff. The mobile app stores its sign-in token in the phone’s secure keychain and keeps your sound settings on the device.

Security

Data travels over HTTPS. Passwords, PINs and one-time codes are hashed. Staff access is limited to accounts that need it.

How long we keep it

We keep account and learning data while the account exists. Sign-in session records are kept for up to a year. When an account is deleted, its profile, learning activity, consent records and sessions are deleted with it; only the log of emails already sent to the parent is kept, with the link to the child removed.

Your rights

A parent or guardian (or an adult pupil) can ask us to:

• give a copy of the data we hold,
• correct anything inaccurate,
• withdraw consent (this pauses the account; you can do it yourself from the parent dashboard), or
• delete the account and its data.

You can also raise a grievance, and if you are not satisfied with our answer, escalate to the Data Protection Board of India.

Changes

If we change this policy we update the date above. If a change affects what a parent agreed to, we ask for consent again.

← Back to The Grade Master