Security & Data Protection

All traffic between your browser and our servers is served over HTTPS/TLS. Your questions, account details, and session are encrypted on the wire, so they can't be read in transit on the networks in between.

• Sessions use a server-side, httpOnly cookie — the credential is not readable by JavaScript, which shuts down a whole class of token-theft attacks. There is no long-lived token sitting in your browser's storage.
• Signing out revokes the session on our server, not just in your browser — so a copied cookie stops working immediately.
• Student logins are handled through Google / Firebase; we verify the sign-in server-side and never see your Google password. Administrator passwords are stored only as a bcrypt hash, never in plain text.
• Cookies are set with SameSite=Lax and Secure in production for baseline CSRF protection.

Payments are processed by our gateway, Razorpay. We never receive or store your full card number, CVV, or UPI credentials — those stay with the gateway under its own PCI-DSS-compliant security. We keep only the transaction reference needed for billing, refunds, and accounting. See our Privacy Policy for details.

To keep the service fast and fair for everyone, requests are rate-limited and abusive traffic is throttled. Sensitive actions — signing in, requesting a verification code, and sending feedback — carry tighter limits to prevent brute-force and spam abuse. Free-tier usage is metered per device. We don't publish the exact thresholds, but they're tuned so normal studying is never interrupted while automated abuse is blocked.

• Standard HTTP security headers are applied to every response (via helmet), including a Content-Security-Policy that restricts where the app can load code and send data.
• Data is stored in a managed PostgreSQL database with access restricted to our application servers.
• Input is validated and length-limited on the server, and identity for protected data is always re-derived from your session — never trusted from the browser.

We collect as little as possible: anonymous users are counted by a one-way device hash, not personal details. We handle personal data in line with India's Digital Personal Data Protection (DPDP) Act. You can request access to, correction of, or deletion of your data at any time — see the Privacy Policy.

If you believe you've found a security issue, please tell us privately at [email protected] rather than disclosing it publicly, and give us a reasonable chance to fix it. We appreciate responsible disclosure and will respond promptly.