1. Who we are
The CBSE Class 10 Companion mobile application
(com.vikramshilasoftwares.cbseclass10) is published by
Vikramshila Softwares ("we", "us"). Under India's Digital
Personal Data Protection Act, 2023 ("DPDP Act") we are the
Data Fiduciary for the personal data described here, and
you are the Data Principal.
This policy covers the mobile app on Android and iOS, and this website. It does not cover NCERT, CBSE, Google, or any other site the app links out to; those have their own policies.
2. What we collect
The short version Your name and email so the account exists, and your study activity so your progress follows you between devices. That is the whole list.
| What | Why it exists |
|---|---|
| Email address | Identifies the account and is the only way we can reach you about it — a password reset, or a reply to a deletion request. |
| Display name | Shown on your own dashboard. It is never shown to anyone else. |
| Account identifier | An opaque identifier issued by Firebase Authentication that links your profile and progress to your sign-in. |
| Class and board | Fixed at Class 10 and CBSE. Stored so the app can widen later without a migration. |
| Target exam date | Optional, and set by you. It drives the countdown on the dashboard. Leave it blank and the countdown is simply not shown. |
| Study streak and last active date | Counts consecutive days of study activity. |
| Enrolled subjects | Which subjects you chose, so your dashboard shows those and not all eleven. |
| Test attempts | Your answers, score, marks and timestamps for each test. This is what the progress screen, the score trend and the chapter-mastery list are computed from. Grading happens on our server, not on your phone. |
| Paper progress | Which previous year papers you marked as attempted. |
| Downloaded files | PDFs you download are written to your device's own storage. The list of what you downloaded stays on the device and is not sent to us. |
If you sign in with Google
Google gives us your email address and display name for the Google Account you pick. We do not receive your Google password, your contacts, your Drive, or anything else in that account.
Notifications
If you allow notifications, the app subscribes your device to broadcast topics — "new papers", for example. Notifications are addressed to a topic, never to you individually, so we do not store a registry of device tokens and cannot send a message to one identified student. You can turn notifications off in your device settings at any time.
3. What we never collect
This list matters as much as the one above, and it is enforced by what is not built into the app rather than by a promise:
- No analytics SDK. The app ships no Google Analytics, no Firebase Analytics, and no third-party analytics library. We do not have a screen-by-screen record of what you tapped.
- No crash or performance reporting SDK. No Crashlytics, no session replay, no heatmaps.
- No location. The app never requests location permission, at any precision.
- No contacts, photos, microphone or camera. None of these permissions are requested. The Android media permissions that one of our dependencies would otherwise declare are explicitly stripped from the app's manifest, because a PDF reader has no business asking for them.
- No phone number, address, school name, date of birth or payment details. The app is free and has no in-app purchases, so there is no billing information to hold.
- No advertising profile built by us. See Advertising.
4. Why we process it, and on what basis
Under the DPDP Act, personal data is processed for a lawful purpose with consent. You give that consent by creating an account, having been shown this policy. The purposes are limited to these:
- To give you an account and let you sign in on more than one device.
- To keep your progress — test scores, chapter mastery, papers attempted — so it survives reinstalling the app or changing phones.
- To grade tests correctly. Answers are checked on our server so a score cannot be altered on the device.
- To tell you about new content, if you allowed notifications.
- To keep the service working and honest — preventing abuse of our servers, and meeting a legal obligation if one arises.
We do not use your data to train machine learning models, we do not profile you, and we do not make automated decisions that produce a legal or similarly significant effect on you.
5. Advertising
Personalised ads are not a setting here They are not available to this app at all. The DPDP Act prohibits targeted advertising directed at children, and everyone using this app is one.
The app is free and is supported by occasional full-screen ads served through Google AdMob. Before the ad SDK is initialised — not after, which would leave the first few requests unprotected — the app applies two settings to every ad request for every user, unconditionally:
- Age-restricted (teen) treatment, which disables personalised advertising and the identifiers used to build an advertising profile.
- A maximum content rating of G, the strictest rating AdMob offers, so the creative itself is suitable for all ages.
Google still processes limited technical information to deliver and measure a non-personalised ad — approximate location inferred from the IP address at country level, the device type, and whether an ad was shown — and to prevent click fraud. Google is an independent controller of that processing; see How Google uses information from sites or apps that use our services.
We do not receive an advertising profile about you, we cannot target an ad at you, and we do not pass your name, email or test scores to any ad network.
6. Children's privacy
The DPDP Act defines a child as anyone under eighteen. Almost every user of this app is one. We designed around that rather than around an age gate:
- We do not track children or monitor their behaviour, and we run no analytics that would make it possible.
- We do not serve targeted advertising to children — see Advertising.
- We collect the minimum a study account needs, and nothing that would identify a child outside the app.
- There is no leaderboard and no public ranking. No student can see another student's scores, name or activity. Nothing you do in the app is visible to other users.
If you are under eighteen, a parent or guardian must read this policy and the Terms & Conditions and agree to them before you create an account. A parent or guardian may contact us at any time to see what is held about their child, correct it, or have it deleted, using the details in Contact. We will act on a verified parental request the same way we act on the student's own.
8. Where it is stored
Accounts, progress and the PDF library are hosted on Google Cloud in the asia-south1 (Mumbai) region. Your study data is stored in India.
Some Google services that support this — authentication and advertising in particular — are operated globally and may process limited data outside India. That processing is governed by Google's own terms and safeguards.
9. How long we keep it
- While your account exists, we keep your profile, progress and test attempts — that is the point of the account.
- When you ask us to delete it, we delete your profile, progress and test attempts, and remove your sign-in credentials, within 30 days of verifying the request.
- Backups may retain a copy for a short period after that before they rotate out.
- Where the law requires us to keep something, we keep only that, and only for as long as required.
Files you downloaded to your own device are yours; deleting your account does not reach into your phone. Uninstall the app, or clear its storage, to remove them.
10. Your rights
Under the DPDP Act you have the right to:
- Access — get a summary of the personal data we hold about you and what we do with it.
- Correction and completion — have inaccurate or incomplete data fixed. You can edit your name and exam date in the app yourself.
- Erasure — have your account and data deleted, unless we are legally required to keep something.
- Withdraw consent — as easily as you gave it. Withdrawing consent for the account means deleting the account, since there is nothing left to process without it.
- Grievance redressal — raise a complaint with us first, and receive a response.
- Nominate — name someone to exercise these rights on your behalf if you are unable to.
How to delete your account and data
Email vikramshilasoftwares@gmail.com from the email address on the account, with the subject "Delete my account". Sending from the account's own address is how we verify the request is yours. We will confirm within 7 days and complete the deletion within 30 days.
A parent or guardian may make the same request on behalf of a student under eighteen. Tell us the student's account email and your relationship to them.
If you are not satisfied with how we handled your grievance, you may complain to the Data Protection Board of India.
11. Security
- Traffic between the app and our servers is encrypted in transit (TLS), and data is encrypted at rest by Google Cloud.
- Passwords are handled and stored, hashed, by Firebase Authentication. We never see or store your password.
- Database security rules are enforced on the server: a signed-in student can read and write their own profile, progress and attempts, and nobody else's. This is not a check the app performs and could be tricked into skipping — it runs on the server for every request.
- Test grading runs server-side, so a score cannot be edited on the device.
- Firebase App Check rejects requests that do not come from a genuine copy of the app.
No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
12. Changes to this policy
If we change this policy we will update the "Last updated" date at the top. Where a change materially affects how your data is used — a new category of data, a new purpose, a new recipient — we will tell you in the app before it takes effect, and where consent is required we will ask for it again rather than assume it.
13. Contact
For anything in this policy — a question, an access request, a correction, a deletion, or a grievance — write to us. We read every message.
- Data Fiduciary
- Vikramshila Softwares
- Grievance Officer
- vikramshilasoftwares@gmail.com
- General contact
- vikramshilasoftwares@gmail.com
- Response time
- Within 7 days; deletion completed within 30 days
You may also refer to the Terms & Conditions, which govern your use of the app.