Privacy Policy

This explains what Sandtable collects about you, why, who else sees it, and what you can do about it. It is written to be read rather than to be survived. The service is operated by Nav Shikhar Ventures.

What we collect

Your identity. You sign in through our authentication provider Clerk, either with Google or with your email address and a password. Either way we receive your email address, and your name if you give it or Google shares it. Clerk confirms the address is yours by sending it a code. If you choose a password, Clerk stores it in hashed form; we never see it, and we never see your Google password either.

Your date of birth. Asked once, when you set up your account. We ask because the law treats people under 18 differently from adults, and we would rather know than guess.

What you do when you practise. Which questions you were shown, what you chose, whether it was right, how long each question had your attention, which hints you opened, and which questions you flagged or saved. This is the substance of the product: it is what your accuracy, your topic breakdown and your suggested practice are made of.

What you write to us. If you report a wrong answer or raise a problem with the app, we keep what you wrote so somebody can act on it.

Payments. If you buy Plus, the payment is handled by Razorpay. Your card details go to them and never reach our servers. We keep a record of the transaction — an order and payment reference, the amount, and whether it succeeded — because that is what a receipt and any later refund are built on.

If you practised before signing in. The app can hold a small amount of work against an identifier for your device. When you sign in, that work is moved into your account so you do not lose it.

Server logs. Our servers record requests — an address, a browser description, a time and a path — for a short period, to keep the service running and to notice abuse.

Our support staff can see your account's email address and your practice record when you write to us or when we need to check your account.

What we do not do

We do not sell your data. We do not share it for anyone else's advertising. We do not run advertising networks or behavioural trackers on this service, and we do not build profiles for advertising — this matters especially because many of our users are children in the eyes of the law.

Who else handles it

We use a small number of providers, each for one job:

• Clerk — sign-in and account security.
• Google — only if you choose to sign in with Google.
• Razorpay — payments, and only payments.
• Amazon Web Services — hosting. Our servers and database are in the Mumbai region, in India.
• Resend — sending the emails we owe you: welcome messages, receipts, refunds and replies to your messages. These emails are processed outside India.

They act on our instructions for these purposes. We may also disclose information where the law requires it.

How long we keep it

We keep your account and your practice record for as long as your account exists. Payment records are kept longer, because tax and accounting rules require it.

Deleting your account

You can delete your account from your settings, and it is a real deletion rather than a flag. Your account, your practice history and your saved questions go.

Two things survive, and we would rather say so than let you find out:

• A problem you reported about a question stays in the editors' queue, with your name removed from it. A wrong answer is a fact about the question, and losing the report would leave it wrong for everyone else.
• Payment records are kept as long as the law requires.

Children

Much of our audience is under 18, and we have written this policy on that assumption rather than pretending otherwise.

If you are under 18, use the service with a parent's or guardian's consent. A parent or guardian may write to us to ask what we hold about their child, to have it corrected, or to have the account deleted, and we will act on that request.

Your rights

You may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Most of it you can see and change yourself in the app; for the rest, write to us and we will answer.

Cookies

We use cookies that are necessary for the service to work — keeping you signed in, and remembering settings such as your choice of light or dark theme. We do not use advertising or cross-site tracking cookies.

Changes

We may update this policy. The current version is always on this page, with the date it was last changed. If a change is significant we will say so in the app.

Contact

Write to support@navshikhar.com with anything about your data, including a request to see or delete it. Our full details are on the contact page.