Privacy Policy

ChemWarrior is operated by ChemWarrior, India. For anything in this policy, write to our support address.

Only what the product needs to work. Specifically:

• Your account. Name, email address, mobile number, the class you are in (11, 12, or a repeat year), and the exam you are preparing for. Your password is never stored — we keep only a one-way hash of it, and cannot read it back.
• Your practice. The tests you attempt, the answers you give, how long you spend, your scores, and any questions you bookmark or report. This is what produces your progress page; it is the point of the product.
• Your sessions. When you sign in we record the device description your browser sends and the IP address the request came from, against that session. This is how you can be signed out everywhere if your account is ever misused, and how we detect a stolen session token.
• Payments, if you buy access. The plan, the amount, and the payment and order identifiers our payment gateway returns. Card, UPI and bank details are entered on the gateway’s own page and never reach us.

There is no behavioural analytics on this site. No Google Analytics, no advertising or tracking pixels, no third-party profiling, and no cross-site tracking. This is a deliberate choice, not an omission: most of our users are school students under 18, and India’s Digital Personal Data Protection Act prohibits behavioural tracking and targeted advertising directed at children. We do not do it, and there is an automated test in our codebase that fails the build if anyone adds an analytics library.

We also do not sell personal data, rent it, or share it for anyone else’s marketing.

We process your account and practice data to provide the service you asked for. We process session and security records because we have a legitimate need to keep accounts safe. We process payment records because we are required to keep them for tax and accounting. Where the law requires your consent, we ask for it, and you can withdraw it by deleting your account.

Most of our users are school students, and we take that seriously. If you are under 18, a parent or legal guardian must read these terms and agree to them on your behalf before you create an account, and they may contact us at any time to see what we hold about you, to correct it, or to have the account deleted.

We never show advertising, never build behavioural profiles, and never use a student’s activity for anything other than showing that student their own progress.

We use a small number of processors, each for one job, and each sees only what that job needs:

• Google Firebase — sends the SMS that verifies your mobile number, and therefore receives that number.
• Resend — delivers transactional email such as verification and password reset links, and therefore receives your email address.
• Razorpay — processes payments, and handles your card or UPI details directly under its own privacy policy. We never see them.
• Vercel and Amazon Web Services — host the website, the API and the database.

Our questions are drafted with an AI model, and then reviewed by a person before publication. No student data is sent to that model. It receives syllabus material and nothing about you — not your name, not your answers, not your scores.

We will also disclose data where a law or a court validly requires it, and we will tell you when we are permitted to.

Your account and practice history stay while your account is open, because that history is the service. Session records are discarded when the session expires or is revoked. Payment records are kept as long as tax law requires, typically eight years, even after an account is closed. When you delete your account we remove your personal data and either delete or irreversibly anonymise your attempts.

You can ask us to:

• show you everything we hold about you;
• correct anything that is wrong;
• delete your account and the personal data in it;
• tell you who we have shared it with.

Write to our support address and we will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Passwords are hashed with Argon2id. Traffic is encrypted in transit. Sessions use rotating tokens, so a stolen token is detected and the whole session family is revoked. Access to the production database is restricted to named administrators, and administrative actions are logged.

No system is perfect. If a breach ever affects your data we will tell you and the Data Protection Board, as the law requires.

If this policy changes we will update the effective date above, and tell you by email or an in-app notice if the change is significant. Continuing to use ChemWarrior after that means you accept the revised policy.

See also our Terms of Use, Refund Policy and contact details.