PRIVACY POLICY.

1. Introduction and scope

This policy explains what personal data IKSHA (goiksha.com) collects, why, where it goes, and the choices you have. It describes what the product actually does today. If that changes, we update this page before the change goes live.

It covers the website, learner accounts, courses, concept pages, the Playground labs, quizzes and account emails.

2. Who runs IKSHA

IKSHA is operated by IJK TEC PRIVATE LIMITED, India ("we", "us"). Privacy questions and requests: privacy@goiksha.com. Everything else: support@goiksha.com.

3. What we collect

You can browse without an account. Courses, concept pages, Explore and the Playground are public. Signed-out visitors get 90 seconds of free lab use before we ask them to sign in. That timer lives only in your browser.

When you create and use an account, we store:

• Account: email address, the name you give us, when you accepted the Terms and Privacy Policy and which version, and your answer to "email updates" (yes, no, or not answered).
• Sign-in: handled by Supabase Auth: your sign-in method, account creation and last sign-in times. Your password is stored by Supabase only as a one-way hash. IKSHA's own tables never contain it, and nobody at IKSHA can read it.
• Google sign-in (optional): if you choose it, Google shares your email address, name and profile picture link. We don't get your Google password, contacts, or anything else.
• Learning profile: the topics you pick as interests, and, if you fill in onboarding, your skill level and learning goals.
• Courses: which courses you enrolled in and when.
• Labs: which Playground labs you enrolled in, when, and when you last opened each one.
• Progress: for each lesson, whether it is not started, in progress or completed, and when, plus the seconds of active reading time counted while the lesson tab was visible and in focus. That time is what unlocks "Mark as complete"; we don't track scrolling, mouse movement or what else you do.
• Quizzes: each attempt's answers, score, pass/fail and time.
• Course completion and certificates: when you finish a course, its completion date and a summary (lessons and quizzes completed, quiz scores, reading time). If the course offers a certificate: the name you choose to print on it, the course title, the issue date and a credential ID. Anyone who has the credential ID or its link can check it on goiksha.com/verify and see only that name, the course, the issue date and the ID; never your email, progress or anything else. Verification pages are not listed in search engines.
• Ratings and testimonials (optional): a star rating, what helped you and any private comment; and, if you write one, a testimonial with the name you want shown and whether you agreed that IKSHA may display it. We only ever show a testimonial publicly if you agreed, and you can edit or delete it.
• Certificate sharing clicks: when you press a share, copy or download button for a certificate, we record which button and when. Not whether you posted anything, and nothing from your social accounts.

Technical data: like every website, our hosting (Cloudflare) and authentication provider (Supabase) receive your IP address, browser and device details, and the pages or actions requested. They keep short-lived operational and security logs.

What we don't collect: payment or card details (IKSHA takes no payments; see section 9), your contacts, your location beyond what an IP address implies, or anything from other websites you visit. Code you run in examples and labs runs in your browser and is not sent to us.

4. How we use it

• To create your account, sign you in and keep your session secure.
• To give you the courses you enroll in and save your progress and quiz results so you can continue.
• To suggest courses: we match the topics you picked against each course's topic. It is a simple, fixed rule. There is no AI profiling and no automated decision with legal or similar effect.
• To send account emails you ask for: sign-in codes, email verification and password resets.
• To prevent abuse: bot checks (Turnstile) on sign-in forms, the lab time limit, and security logs.
• With your permission only: to count visits and page speed with Cloudflare Web Analytics (section 8).

5. Emails and marketing

We only send the account emails described above. We don't send newsletters or promotional emails today. Your account has an "Email updates" setting. If we ever start sending updates, we will email only people who chose "Yes". You can change it any time in your account settings.

6. Service providers

We don't sell or rent personal data, and we don't share it with advertisers. These providers process data on our behalf, only to run the service:

Each provider handles data under its own policy, linked above. We don't control their practices. We may also disclose data where the law requires it, or to protect the service and its users from fraud or abuse.

7. Where data is stored

Your account and learning data are stored with Supabase in South Korea (Seoul). Account emails are sent through Resend, via Amazon SES in Japan (Tokyo). Cloudflare serves the site from its global network. Google processes Google sign-in and font requests on its own infrastructure. So your data is processed outside India. By using IKSHA you understand it is processed in these places.

8. Cookies, storage and analytics

We use cookies and browser storage that the site needs: your sign-in session, Google sign-in security, the lab time limit, your theme and your privacy choices. Two things are optional and off until you allow them: Cloudflare Web Analytics, which sets no cookies, and a "recently viewed concepts" list kept in your browser. We use no advertising or cross-site tracking cookies. Every item is listed in the Cookie Policy, and you can change your choice in Cookie settings.

9. Payments

IKSHA does not take payments today. Every course is free to enroll in. Some course pages show a list price, which is currently waived. We don't collect or store card, UPI or bank details. If we add payments, the payment provider will handle those details. We will name it and update this policy before any payment feature goes live.

10. How we protect it

• Database rules (row-level security) let each learner read and change only their own records.
• All traffic is encrypted in transit (HTTPS, with HSTS so browsers always use it).
• Passwords are hashed by Supabase. New passwords are checked against known data breaches (only a 5-character hash prefix is sent).
• Privileged keys stay on the server and are never sent to your browser.
• Bot checks on sign-in and code requests, and a strict Content-Security-Policy that limits which outside sites the pages can talk to.

11. How long we keep it

We keep your account and learning data while your account exists, because it is your record of progress. When you delete your account, it is removed from our live database right away (section 12).

Copies can outlast that for a limited time: our providers' operational and security logs are kept for their own retention periods, and occasional manual database backups we make before maintenance still contain data until those backups are deleted. We don't use those copies for anything except restoring the service after a failure.

12. Your choices and rights

In Privacy & data (in your account) you can:

• See and download everything tied to your account as a file.
• Correct your name and interests yourself. For anything else, such as your email address, email us.
• Delete your account. This immediately deletes your account, profile, interests, course and lab enrollments, progress, quiz attempts, course completions, certificates (their verification links stop working), ratings and testimonials from our database. It can't be undone.
• Withdraw optional consent: turn off analytics or functional storage in Cookie settings, or set email updates to "No".

Accepting the Privacy Policy is needed to have an account, because we can't run your account without processing this data. To withdraw that consent, delete your account. For any other request, or if something doesn't work, write to privacy@goiksha.com from the email address on your account, so we can confirm the request is yours.

13. Children

IKSHA is a general technical-learning service and is not designed to collect more information from children than from anyone else. We ask only for an email address and a name. If you are a minor under applicable law, use IKSHA with a parent or guardian's involvement, as the Terms describe. A parent or guardian who believes a child gave us data without that involvement can ask us to delete it at privacy@goiksha.com.

14. Legal framework

We process personal data on the basis of the consent you give when you create an account, and to provide the service you ask for. We aim to follow Indian data-protection law, including the Digital Personal Data Protection Act, 2023 and its rules as they come into force. Parts of that framework start on different dates, and we will update our practices and this policy as they apply.

15. Other websites

Course material and concept pages sometimes link to other websites, such as official documentation. Those sites have their own privacy policies, and we don't control what they collect.

16. Questions and grievances

Write to privacy@goiksha.com with any privacy question, request or complaint. See Grievances for how we handle them.

17. Changes to this policy

When we change what we collect or how we use it, we update this page and its date before the change goes live. Where a change needs your consent again, we will ask for it.