Shishya Privacy Policy

1. Introduction

Welcome to Shishya ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App").

By using Shishya, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our App.

2. About Shishya

Shishya is an AI-powered learning companion application that allows users to:

• Access personalized educational content tailored to their learning style
• Track learning progress and achievements
• Receive AI-driven recommendations for courses and materials
• Engage with interactive learning modules
• Manage subscription plans and preferences

3. Information We Collect

3.1 Information You Provide Directly

• Account Information: Email address and password when you create an account
• Authentication Data: If you sign in using Google or Apple, we receive your email address and authentication tokens from these providers
• Learning Preferences: Topics of interest, skill levels, and learning goals you provide
• Payment Information: When you subscribe, payment details are collected and processed securely by Stripe (see Section 6)

3.2 Information Collected Automatically

• Device Information: Device type and platform (iOS/Android) for push notification delivery
• Push Notification Token: If you enable notifications, we store your device token to send you updates
• Usage Data: Learning progress, completed modules, and interaction timestamps

3.3 Information We Do NOT Collect

• Location data
• Contact lists
• Browsing history outside the App
• Analytics or behavioral tracking data
• Advertising identifiers

4. How We Use Your Information

We use the information we collect to:

• Provide Services: Create and manage your account, deliver personalized learning content
• Process Payments: Handle subscription billing and payment processing through Stripe
• Send Notifications: Deliver push notifications about learning reminders and progress updates (if enabled)
• Improve the App: Understand usage patterns to enhance features and user experience
• Customer Support: Respond to your inquiries and provide assistance
• Legal Compliance: Comply with legal obligations and protect our rights

5. Data Storage and Security

5.1 Where Your Data is Stored

Data Type	Storage Location
Account & Profile Data	Supabase (PostgreSQL database)
Payment Information	Stripe (PCI-compliant)
Session Tokens	Your device (local storage)
Cached Content	Your device (temporary, auto-clears)

5.2 Security Measures

• All data transmission uses HTTPS encryption
• Database access is protected by Row Level Security (RLS) policies
• Payment data is handled exclusively by Stripe, a PCI-DSS compliant provider
• Authentication tokens are securely stored on your device

6. Third-Party Services

Shishya integrates with the following third-party services:

6.1 Supabase

We use Supabase for database hosting and user authentication. Supabase processes your account information and stores your data securely.

Privacy Policy: https://supabase.com/privacy

6.2 Stripe

We use Stripe to process subscription payments. When you subscribe, Stripe collects and processes your payment information. We do not store your full credit card details on our servers.

Privacy Policy: https://stripe.com/privacy

6.3 Expo

We use Expo's notification service to deliver push notifications. Expo processes your device token to route notifications to your device.

Privacy Policy: https://expo.dev/privacy

6.4 Google Sign-In

If you choose to sign in with Google, Google provides us with your email address and basic profile information according to their privacy practices.

Privacy Policy: https://policies.google.com/privacy

6.5 Apple Sign-In

If you choose to sign in with Apple, Apple provides us with your email address (or a private relay email if you choose to hide your email).

Privacy Policy: https://www.apple.com/legal/privacy/

7. Device Permissions

Shishya may request the following permissions:

Permission	Purpose	Required
Push Notifications	To send you learning reminders and progress updates	Optional
Camera	For future profile photo features	Optional
Photo Library	For future profile photo features	Optional
Internet Access	Required for app functionality	Required

You can manage these permissions in your device settings at any time.

8. Your Rights and Choices

8.1 Access and Control

• Notification Preferences: Enable or disable push notifications at any time in the App settings
• Subscription Management: View and manage your subscription through the Stripe Customer Portal
• Cancel Subscription: Cancel your subscription at any time; you retain access until the end of your billing period

8.2 Data Deletion

To request deletion of your account and associated data, please contact us at the email provided in Section 12. Upon verification, we will delete your personal data within 30 days, except where retention is required by law.

8.3 Data Portability

You may request a copy of your personal data in a structured, machine-readable format by contacting us.

9. Data Retention

• Account Data: Retained while your account is active
• Subscription Data: Retained for billing and legal compliance purposes
• Learning Progress: Retained unless you request deletion
• Cached Data: Automatically deleted after 24 hours (content) or 5 minutes (feed metadata)
• Trial Period: 7 days from account creation

10. Children's Privacy

Shishya is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy in the App
• Updating the "Last Updated" date at the top of this policy
• Sending a push notification for significant changes (if notifications are enabled)

We encourage you to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of personal information collected about you
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information
• Non-Discrimination: We will not discriminate against you for exercising your rights

14. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Lawful Basis: We process your data based on your consent and contractual necessity
• Right of Access: Request access to your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Request limitation of processing
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain processing activities

To exercise these rights, please contact us using the information in Section 12.