Privacy Policy
The short version
- You can use every simulation without an account. Then we collect no personal data at all; your progress stays on your own device.
- If you create an account or sign up for updates, we collect only what we need: your name, username, email and password (stored as a secure hash), plus your learning progress and anything you choose to write to us.
- No ads, no selling or renting of data, no profiling for advertising. Our visitor statistics are anonymous and use no cookies.
- Accounts are for people aged 13 and over; under-18s need a parent's or guardian's agreement.
- You can see, correct or delete your data at any time by writing to [email protected].
1. Who we are
Curiosand ("we", "us") is a free educational website offering interactive simulations in physics, chemistry and maths. It is operated by [Operator: full legal name of the owner, or registered business name], [Postal address in India], India. For data protection purposes we are the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) and the controller (under laws such as the EU/UK GDPR) for the personal data described here.
Contact for anything about privacy: [email protected]. Our Grievance Officer is named in the Grievance Redressal Policy.
If you would like this notice in Hindi or in another language listed in the Eighth Schedule to the Constitution of India, write to us and we will provide it.
2. What we collect, and why
| When | What we collect | Why (purpose) |
|---|---|---|
| You just use the site (no account) | Nothing that identifies you. Our server briefly records technical logs (IP address, browser type, page requested, time) for security. Your settings and progress are stored only in your browser (see the Cookie Policy). | Running the site securely; preventing abuse. |
| You create an account | First and last name, username, email address, password (stored only as a one-way BCrypt hash, which we cannot read), your age declaration and the date and version of the Terms you agreed to. | Creating and securing your account; sending login codes and verification emails; keeping evidence of consent. |
| You use the site while logged in | Learning progress (topics explored, quiz scores, XP, badges, streaks), notes you write, and feedback you send. | Syncing your progress between devices; showing your notes; improving the content. |
| You create a teacher account or start the free trial | Everything listed for accounts, plus that it is a teacher account, your confirmation that you are 18 or older, and the start and end dates of your free trial. | Providing teacher features and running the trial. |
| A teacher runs a live quiz | For each student who joins: only the nickname they type, and their answers and scores in that game. Students do not create accounts or give an email, name or any other detail. The teacher's account keeps a report of the game (title, nicknames, answers, scores). | Running the game and giving the teacher the class's results. |
| A teacher asks to keep using teacher tools after the trial | Optionally, the school or organisation, roughly how many students, and a message. We also send one email shortly before a free trial ends. | Replying to you, keeping your account going, and planning paid teacher plans. |
| A teacher writes their own questions | The question sets they save (titles, questions, answers, explanations). | Letting teachers reuse their questions. |
| A student does homework | Only the nickname they type and their answers and score for that homework. No account, email or name. Their device keeps their progress until they hand in. | Marking the homework and showing the teacher the class's results. |
| You join the "Notify me" list | Email address, the subject(s) you are interested in, and optionally your role (student, teacher, parent), class or grade, and a message. | Emailing you when new subjects or topics launch; deciding what to build next. |
| You write to us | Your email address and whatever you include in your message. | Answering you and resolving requests or complaints. |
| Anonymous statistics | Page views, referring site, country, device type and browser, counted by Umami, which we host ourselves. No cookies, no personal identifiers, no cross-site tracking; IP addresses are not stored. If your browser sends "Do Not Track", your visit is not counted. | Understanding which simulations are useful. |
Tip for students and teachers: use a nickname in live quizzes, not a full name.
We do not collect sensitive data such as health, financial, biometric or precise location data, and we do not use your data for automated decisions that affect you.
3. Our legal basis
- Consent: for accounts and the "Notify me" list. You give it by ticking the boxes on the sign-up forms, and you can withdraw it at any time (see section 8). Withdrawing does not affect processing that already happened.
- Legitimate uses permitted by law: keeping the site secure, preventing abuse and complying with legal obligations (for example, responding to lawful requests from authorities).
- For visitors from the EU/UK: consent (Art. 6(1)(a) GDPR), performing our agreement with you (Art. 6(1)(b)) and our legitimate interest in running a secure, useful service (Art. 6(1)(f)).
4. Children
Curiosand is designed for students, so we take extra care. The full details are in our Children's Privacy Notice. In short:
- Under 13: please do not create an account or join the mailing list; use the simulations without an account (nothing personal is collected), or ask a parent or teacher to sign up. If we learn we have collected personal data from a child under 13 without verified parental consent, we delete it.
- 13 to 17: you may create an account or join the list only with your parent's or guardian's agreement. Under Indian law a person under 18 is a child, and we will ask for verifiable consent from the parent or guardian where the law requires it.
- We never show advertising, never track children for advertising and never build profiles of children for anything other than showing them their own learning progress.
5. Who we share data with
We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers. We use a small number of service providers ("data processors") who handle data only on our instructions and only to provide their service to us:
| Provider | What they do | Data involved |
|---|---|---|
| Our cloud hosting provider [DigitalOcean or AWS, as chosen], servers in India | Runs our website and database | All data described above |
| Cloudflare, Inc. | Domain name service, security (protection from attacks) and fast delivery of pages; encrypted backups (Cloudflare R2) | Technical data such as IP addresses; encrypted database backups |
| Brevo (Sendinblue SAS, France) | Sends our emails (verification links, login codes, launch announcements) | Email address and the email's content |
We may also disclose data if required by law, a court order or a lawful request from a government authority, or to protect the rights, safety and property of our users or the public. If Curiosand is ever transferred to a new owner, your data would move only under this policy or with your consent, and we would tell you first.
6. Where data is stored
Our main servers are in India. Some providers (Cloudflare, Brevo) process data in other countries. We only use providers that protect data with appropriate safeguards (such as encryption and contractual commitments), and we do not transfer data to any country restricted by the Government of India.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and progress, notes, feedback | As long as your account is active. Deleted within 30 days of your request. Accounts unused for 3 years are deleted after we email you a warning. |
| "Notify me" sign-ups | Until 12 months after we announce the subject you asked about, or until you unsubscribe, whichever is sooner. |
| Live quiz games in progress | Held only in the server's memory while the game runs; removed after 3 hours without activity. |
| Live quiz reports (nicknames, answers, scores) | 90 days, then deleted automatically. Teachers can delete a report at any time, and reports are deleted with the teacher's account. |
| Homework and its answers | Until 90 days after the deadline, then deleted automatically (sooner if the teacher deletes it, or with the teacher's account). |
| A teacher's request to keep using teacher tools | Until the teacher deletes their account, or 12 months after we last heard from them, whichever is sooner. |
| Teachers' question sets | Until the teacher deletes them or their account. |
| Unverified accounts | Deleted if the email address is not verified within 30 days. |
| Login codes (OTP) and verification links | A few minutes to a few hours, until they expire. |
| Server security logs | 30 days. |
| Backups | A rolling 30 days; deleted data disappears from backups within that time. |
| Messages and complaints | Up to 3 years after resolution, or longer if the law requires. |
8. Your rights
Wherever you live, you can ask us to:
- access your personal data and get a summary of how it is processed and who it was shared with;
- correct, complete or update it;
- delete it (erasure), and withdraw consent, as easily as you gave it (unsubscribe links are in every email);
- nominate another person to exercise your rights if you die or become incapacitated (India);
- complain to us, and if you are not satisfied, to the regulator.
Visitors from the EU/UK also have the rights to data portability, to restrict processing and to object, and can complain to their local data protection authority. US residents of states with privacy laws have similar rights; we do not sell or "share" personal data for targeted advertising as those laws define it.
How: logged-in users can download their data and delete their account themselves on the profile page. You can also email [email protected] from the address linked to your account (so we can verify it is you). We reply within 30 days at most, usually much sooner. A parent or guardian can make these requests for a child.
In India, if your complaint is not resolved, you may approach the Data Protection Board of India after using our grievance process.
9. How we protect data
- All traffic is encrypted with HTTPS; passwords are stored only as BCrypt hashes.
- The database is not reachable from the internet; access is limited to the operator, protected by keys and strong passwords.
- Sign-up and login endpoints are rate-limited to stop abuse; backups are encrypted.
- We keep software up to date and collect as little data as possible in the first place.
No system is perfectly secure. If a personal data breach happens, we will inform affected users and the Data Protection Board of India (and other authorities where required) as the law requires.
10. Our student privacy commitments
Because many of our users are school students, we commit to the following, in line with laws such as COPPA, California's SOPIPA and India's DPDP Act:
- No advertising of any kind, and no targeted advertising based on student data.
- No selling of student data, and no building of profiles except to show students their own progress.
- Student data is used only to provide and improve the learning service.
- Schools or teachers who use Curiosand with a class can ask us to delete their students' data at any time.
11. Changes to this policy
If we change this policy in a way that matters, we will update the version and date above, show a notice on the site, and email account holders before the change takes effect. Where the law requires it, we will ask for your consent again.
12. Contact
[Operator: full legal name of the owner, or registered business name], [Postal address in India]. Email [email protected]. Grievance Officer: see the Grievance Redressal Policy.