Privacy Policy

Last updated: 13 November 2026

In short: we collect the minimum needed to run a learning app for your family, children never give us an email or a photo of themselves, there are no ads or trackers, we never sell data, and you can see or delete everything at any time.

1. Who we are

IvySity (IvySity, #164/1, 3rd Floor, MSA Complex, Bagalur Road, Kattigenahalli, Bengaluru - 560064, Karnataka, India) runs IvySity and is the data fiduciary / data controller for the personal data described here. Privacy questions: info@ivysity.com.

2. What we collect

About	Data	Where it comes from
Parent	Full name, email, phone number, password (stored only as a salted hash), account status, sign-in times	You, when you sign up
Payments	Plan, amount, coupon used, payment method type (e.g. UPI) and the transaction reference you give us. No card numbers, UPI PINs or bank passwords.	You, when you pay
Child	First name or nickname, a picture avatar, country, state and city, school board and grade, optional school name, PIN (stored only as a hash). No email, no photo of the child, no exact address.	The parent, when adding the child
Learning progress	Chapters played, stars, accuracy, hints used, XP, streaks, guild points, booster quests, the questions a child answered wrongly (for the Mistake Lab), Blitz Arena best scores, study-pet XP and the preferred hint language	Created as your child plays
Snap-to-Game photos	Photos of textbook pages or worksheets your child chooses to upload, and the levels made from them	Your child, when they use Snap-to-Game
Teach the study pet	The short explanation (up to 300 characters) your child types to teach the study pet. It is sent to our AI provider to be graded and is not stored: only the pet's XP is kept	Your child, when they use Teach the Pet
Technical	Sign-in cookies (see the Cookie Policy). Our hosting provider processes IP addresses to deliver and protect the Service; we don't store them in our database.	Your device

3. How we use it, and our legal bases

To run your account and the games (sign-in, progress, stars, parent reports): to perform our contract with you.
To process children's data: on the verifiable consent the parent gives when creating the profile (DPDP Act s.9, COPPA, GDPR Art. 8).
To confirm payments and keep accounting records: contract and legal obligation.
To keep IvySity safe (lockouts after wrong PINs or passwords, abuse prevention, audit logs): legitimate interests and legal obligation.
To show leaderboards and Guild Wars: only a child's first name, avatar, and city or school totals, never contact details or exact location.

4. What we never do

We never sell or rent personal data, and we never "share" it for cross-context advertising.
We show no advertising and use no third-party analytics or tracking scripts.
We never profile children for marketing or show them targeted content based on their data.
We never offer chat or let children contact each other.
We don't use your family's data to train AI models.

5. Service providers

We use a small number of providers who process data only on our instructions:

Cloudflare, Inc.: hosting, database (D1), file storage (R2), caching (KV) and the AI models (Workers AI) that turn Snap-to-Game photos into levels, grade the explanations children type for the study pet, and explain hints in another language. Explanations are not stored and are not used to train AI models.
Clerk, Inc.: only if we enable sign-in with Clerk for parent accounts. Children never use Clerk.
Your bank or UPI app processes your payment under its own privacy policy.

We may also disclose data where the law requires it, or to protect a child's safety.

6. International transfers

Cloudflare runs a global network, so data may be processed outside your country. Where data from the EU, UK or Switzerland is transferred, we rely on the provider's Standard Contractual Clauses (or the UK addendum) and its security measures. Transfers from India follow the DPDP Act and any countries the Government restricts.

7. How long we keep data

Account, child profiles and progress: while your account is open.
Snap-to-Game source photos: deleted 30 days after upload; the generated level stays until you delete the account.
Sign-in sessions: up to 30 days (12 hours for admin sessions).
When an account is deleted, the parent account, every child profile, their progress and Snap-to-Game photos are deleted straight away (we act on a request within 30 days); encrypted backups roll off within a further 30 days.
After deletion we keep a short record (email, name, family code, dates and the payment history) for as long as tax and accounting law requires (up to 8 years in India) and to handle payment disputes. It holds no child data. If you sign up again later, it is a new account.

8. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Passwords and PINs are stored only as salted hashes. Sign-in cookies are httpOnly and can't be read by scripts. Accounts lock after repeated wrong attempts, and every admin action is logged. If a personal-data breach affects you, we will notify you and the authorities as the law requires (within 72 hours where GDPR applies).

9. Your rights

Depending on where you live, you can:

Everyone: access your family's data, correct it, delete it (or a child's profile), and withdraw consent for a child at any time. Many of these you can do yourself in the parent dashboard.
India (DPDP Act 2023): get a summary of the data processed and who it was shared with, correction and erasure, grievance redressal, and nominate someone to exercise your rights. You may complain to the Data Protection Board of India after using our grievance process.
EU, UK, EEA (GDPR): also restriction, portability and objection, and the right to complain to your data protection authority.
US (COPPA and state laws such as the CCPA/CPRA): review your child's data, have it deleted and refuse further collection. We don't sell or share personal data, and we won't discriminate against you for using your rights.

To use a right, email info@ivysity.com from your account email. We may need to confirm it's you. We reply within 30 days (45 days where US state law allows), free of charge.

10. Children

IvySity is designed for children, with parents in control. Our Children's Privacy & Safety notice explains exactly what we collect from children and how parents stay in charge.

11. Changes

We will post any change here and update the date at the top. If a change affects how we use children's data, we will ask for the parent's consent again before it applies.

12. Contact and Grievance Officer

Privacy: info@ivysity.com. Grievance Officer: Grievance Officer, IvySity, info@ivysity.com, IvySity, #164/1, 3rd Floor, MSA Complex, Bagalur Road, Kattigenahalli, Bengaluru - 560064, Karnataka, India.