Legal

Privacy Policy

Last revised: 2026-09-11

This policy states what Sem 5 Prep collects, why each field is collected, how long it is kept, and how an account holder exercises data rights. It applies to https://sem5.goatedd.tech.

Data collected

Data collected, the reason, and the retention period
Data	Reason	Retention
Email address	Identifies the account and receives the six-digit sign-in code	While the account exists
Name	Labels the account and forms the watermark shown on content pages	While the account exists
Google account identifier	Matches a returning account when Google sign-in is used	While the account exists
Sign-in code, stored as a SHA-256 hash	Verifies the code entered at sign-in	10 minutes, then the row is closed
Device identifier, fingerprint hash, browser and platform label	Enforces the limit of two devices and detects a cleared cookie	While the account exists
Session token, stored as a SHA-256 hash	Keeps one session signed in and ends the older session on a new device	30 days from last use
IP address, city, country and approximate coordinates	Shows the device list, and flags one account signing in from two distant cities	24 months
Study progress, answers, timings and error log	Produces mastery, readiness, the study plan and the revision queue	While the account exists
Audit and anomaly records	Supports account recovery and detects credential sharing	24 months
Razorpay order id, payment id, event id, plan and access dates	Proves the purchase and sets the access period	As required by Indian tax and accounting law

Payment details

Card numbers, UPI identifiers, bank credentials and one-time passwords are entered on Razorpay’s checkout and never reach this server. Sem 5 Prep receives the order identifier, the payment identifier, the amount and the status, and stores those against the account.

Cookies and local storage

Session cookie: an httpOnly, secure cookie holding a session token. Required for sign-in.
Device cookie: a random device identifier, kept for the device limit.
Watermark cookie: the name and email rendered as a faint overlay on content pages.
Local storage: theme choice and a cache of study progress, held on the device only.

Who else receives the data

Razorpay Software Private Limited processes payments and returns the payment identifiers listed above.
Google LLC verifies identity when Google sign-in is used.
The mail server that delivers the six-digit sign-in code receives the email address.

Security

Transport: HTTPS on every request
Secrets: Sign-in codes and session tokens stored as SHA-256 hashes
Access: Administrator access limited to the addresses in ADMIN_EMAILS

Rights and how to exercise them

A copy of the personal data held on an account is available on request.
An incorrect name or email address is corrected on request.
An account and its progress data are deleted on request, subject to records that tax law requires to be kept.
Consent to optional processing is withdrawn on request.
Requests go to hello@goatedd.tech from the email address on the account, and are answered within 30 days.

Grievance officer

Name: To be confirmed
Designation: To be confirmed
Email: hello@goatedd.tech
Phone: To be confirmed

Acknowledgement: Within 48 hours of receipt
Resolution: Within one month of receipt