Privacy policy

Last updated 13 November 2026

Draft, pending review by our lawyer. It already describes how Prepzo works today; wording may change after review.

1. Who we are

Prepzo is an exam preparation app for NEET (UG) and JEE Main, run by Onus Ant, [to fill: Registered address] ("we", "us"). This policy covers the Prepzo Android app (com.flys.prepzo) and this website, prepzo.live. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the data fiduciary for the personal data described here.

2. Students and parents

Most people preparing for these exams are school students. We expect a student's Prepzo account to be opened and run with their parent or guardian, who accepts our Terms of use and this policy for the student and decides on any payment. A parent or guardian can use every right in section 9 for the student by writing to the grievance officer.

We don't show ads, don't track students for advertising, and don't build profiles of students for advertising or sell their data.

3. What we collect and why

Before you sign in, the app keeps your onboarding answers on the phone. If you never sign in, the only thing we store is the list of questions in your first DPP, deleted after 7 days.

We rely on your consent, given by signing up and using the app, and on legitimate uses allowed by the DPDP Act, such as keeping tax records the law requires. You can withdraw consent at any time by deleting your account (section 9); this doesn't affect what was done before.

4. What we don't collect

• No location, contacts, photos, files, microphone or camera access. The QR scanner for quiz rooms and institute codes is Google Play services' scanner; the app receives only the code it reads.
• No advertising ID, no ads, and no third-party analytics or advertising tools in the app.
• No age or date of birth.
• This website sets no cookies and runs no analytics.

5. Who else sees your data

• Quiz rooms. Players in a room see each other's names and scores. The host sees each player's answers and scores; a teacher host can download them as a spreadsheet.
• Institutes. If you ask to join an institute, its admin sees your name and a partly hidden phone number (like +91 98•••••21), or "Google sign-in". Once accepted, the institute's admins and teachers see your name, your classes, and your results and ranks in their class tests. You can hide your name from classmates; teachers still see it. Your own practice, DPPs and Prepzo mocks are not shown to the institute.
• Live mock ranks. Rank lists show ranks and scores, not phone numbers.
• Our team. Support staff can look up an account to answer a request. Phone numbers are partly hidden on their screens, each lookup needs a reason and is logged, and only admins can change an account.
• The law. We disclose data when Indian law requires it, for example to a court or tax authority.

We don't sell personal data or share it with anyone for their own marketing.

6. Companies that process data for us

These companies process data only to provide their service to us, under contract:

Some of these companies may process data outside India, as the DPDP Act allows. We don't send students' personal data to AI services. Our team uses an AI model to help draft questions, and those drafts contain no student data.

7. Notifications and email

• Push notifications about security (a new device signed in) and payments are always on. Study reminders can each be turned off in the app. Announcements are off unless you turned them on, for example by asking to be told when an exam opens.
• Push notifications never contain marks, ranks, names or phone numbers, because they show on the lock screen.
• No reminders between 22:00 and 07:00, and at most 3 reminders or announcements a day.
• We email you only a purchase receipt and a refund receipt, with the invoice or credit note. No marketing email, WhatsApp or SMS.

8. How long we keep it

Deleting your account. Write to us as described on Delete account. Once we've confirmed the account is yours, you are signed out on every device at once. 30 days later your name, phone number, Google ID, email and device names are erased. Your past answers and results stay only under an anonymous account number, so question statistics and other students' ranks stay correct; they can no longer be linked to you.

9. Your rights

Under the DPDP Act you can ask us to:

• give you a summary of your personal data we hold and what we do with it, and the companies we share it with;
• correct, complete or update it (your name and sign-in methods can also be changed in the app);
• erase it, by deleting your account;
• nominate another person to use these rights for you if you die or can't act yourself;
• resolve a complaint about how we handle your data.

Write to the grievance officer below from the email on your account, or include your phone number's last 4 digits so we can find the account. A parent or guardian can ask for the student. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.

10. Security

Data travels encrypted (HTTPS) and is stored encrypted. Sign-in codes are stored only as hashes and expire in 5 minutes. Sessions can be signed out from the app at any time, and a stolen sign-in token ends the whole session. Our team signs in with Google and a passkey, and every lookup or change of a student's account is logged. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

11. Grievance officer

We acknowledge every request within 48 hours and resolve it within 30 days.

12. Changes to this policy

When we change this policy, we update the date at the top, and the app shows a one-time notice with a link to the new version.