Core9XLearn. Practice. Master.
Log in

Draft. Still to be added (in src/lib/business.ts): registered business name, registered address, grievance officer's name, grievance officer's email, grievance officer's phone.

Privacy Policy

Last updated 8 October 2026

This Privacy Policy explains what personal data Core9X collects, why, and the choices you have. Core9X is run by [registered business name] ("we", "us"), [registered address], which decides how this data is used (the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023).

Most of our users are students under 18. We treat their data with extra care: a parent or guardian must give consent before a student's account opens, and we never show advertisements, sell personal data, or track students for advertising.

1. What we collect

When a student signs up

  • name, username, email address (optional) and date of birth;
  • for students who join through a pilot school, the school and the code they used;
  • a password — stored only as a secure one-way hash (Argon2), never in readable form;
  • board, class, academic session, subjects and preferred language for explanations.

About the parent or guardian (students under 18)

  • name, relationship to the student and mobile number, and, if given, an email address;
  • whether they want the weekly progress report by email;
  • a record of the consent: when the one-time code was sent and confirmed (the code itself is stored only as a hash and expires), or which school collected the signed form, and when.

While the student studies

  • lessons opened and finished;
  • answers to practice questions and tests, marks the student gives their own written answers, time taken, and questions marked for review;
  • the Mistake notebook: questions answered wrongly, the reason the student chose, and when each is due again;
  • chapter mastery, readiness estimates, badges and study streaks worked out from the above;
  • flashcard progress, saved lessons and questions, and study-planner settings (minutes a day, study days) and daily plans;
  • problems the student reports in our content, with any note they write.

Searches are not saved to the student's account (like any page request, they can appear in the short-lived server logs described below).

When someone pays

  • the plan, subjects, amount, date, and the order and payment reference numbers from Razorpay.
  • We do not receive or store card numbers, UPI IDs, bank details or OTPs. These go directly to Razorpay, our payment partner.

Technical information

  • an essential cookie that keeps you signed in, and a short-lived one used during sign-up;
  • basic server logs (IP address, browser type, time and the page or action requested), kept for security and to fix problems.

We do not use advertising cookies or third-party analytics trackers.

2. Why we use it

We use personal data only to:

  1. create and secure the account, and confirm a parent's consent;
  2. provide lessons, practice, tests and the Mistake notebook, and show the student's progress;
  3. take payments and unlock what was paid for;
  4. answer questions and complaints, and send messages about the account or a purchase, such as a password-reset link (not marketing, unless you agree to it separately);
  5. send the parent or guardian a weekly progress report by email, if they gave an email address (they can turn it off at any time);
  6. keep Core9X safe, prevent misuse and fix faults, including mistakes students report in our content;
  7. meet legal duties, such as keeping payment records for tax law.

We use data on the basis of your consent (for a student under 18, the verified consent of a parent or guardian), and where the law requires or permits it. We use only the data needed for these purposes.

3. Children's data

For students under 18:

  1. a parent or guardian must give consent before the account opens: either by confirming a one-time code sent to their mobile number (and email, if given), or, for students joining through a pilot school, by signing the consent form that comes with the school code, which the school collects and keeps;
  2. we do not carry out tracking, behavioural monitoring or targeted advertising directed at children;
  3. the parent or guardian can ask to see, correct or delete the student's data, or withdraw consent, at any time (see section 7).

4. Who we share it with

We do not sell personal data. Other students never see a student's name or answers: weekly mock results show each student only their own rank and percentile, and how scores were spread across everyone, with no names.

We share personal data only with:

  1. Razorpay (Razorpay Software Private Limited), to process payments;
  2. the companies that host Core9X and send our emails and SMS messages (for example the parent's one-time code), who may use the data only to provide their service to us;
  3. authorities, where the law requires us to, or to protect the safety of our users or the public.

Some of these providers may store data on servers outside India. We use only providers that protect it properly, and only where Indian law allows the transfer.

5. How we protect it

Data travels over encrypted connections (HTTPS). Passwords and one-time codes are stored only as hashes. Access to personal data is limited to people who need it to run Core9X. If a personal data breach happens, we will inform the Data Protection Board of India and the affected users as the law requires.

6. How long we keep it

  1. We keep account and study data while the account is open.
  2. If you ask us to delete an account, or it has been inactive for three years, we delete or anonymise its personal data within 30 days.
  3. Payment records are kept for as long as tax and accounting laws require (currently up to eight years), even after an account is deleted.
  4. We may keep statistics that cannot identify anyone, to improve our content.

7. Your rights

Under the DPDP Act you can:

  1. ask for a summary of the personal data we hold about you and how we use it;
  2. ask us to correct, complete or update it;
  3. ask us to delete it (except what the law requires us to keep);
  4. withdraw your consent — we will then stop using the data and close the account, as Core9X cannot work without it;
  5. nominate someone to exercise these rights for you if you die or become unable to;
  6. complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.

You can download a copy of your data, and delete your account, yourself from the Profile page. A parent or guardian can exercise these rights for a student under 18. To use any other right, write to our Grievance Officer (below) from the email address on the account. We may ask you to confirm who you are. We will reply as soon as possible, and within the time the law sets.

8. Changes to this policy

If we change this policy in an important way, we will tell you on Core9X or by email before the change takes effect, and ask for fresh consent where the law requires it.

9. Contact and Grievance Officer

[grievance officer's name], Grievance Officer, [registered business name] [registered address] Email: [grievance officer's email] · Phone: [grievance officer's phone]

We acknowledge complaints within 48 hours and aim to resolve them within one month.