Privacy policy.
Your data, your rules.
Here's what we do — and don't do — with your information. The 60-second version. Full details below.
- Your name, age, grade, and country — to personalise what you see.
- Your mobile number — to sign you in securely.
- What you do in pathways — choices, reflections, badges — so you can come back to it.
- Chats with Sage, your AI companion — so it remembers what you've talked about.
- We don't sell your data. To anyone. Ever.
- We don't show you ads.
- We don't share what you wrote with your parent or school — unless you choose to share it yourself.
- We don't track you across other apps or websites.
- Ask us for a copy of everything we have about you.
- Ask us to delete your account and data, any time.
- Choose what — if anything — you share.
- A parent or guardian needs to approve your use — we capture this at signup.
- Explorers under 13 use a parent-held account, with a parent alongside.
- A parent can contact us any time to review or delete your data.
- Nothing you write is sent to your parent automatically — only if you choose to share it.
1 · Who we are
Careers Ahoy! is operated by Garima Aggarwal, based in India at A2/27 Safdarjang Enclave, First Floor, New Delhi 110029. We are a Data Fiduciary under India's Digital Personal Data Protection Act 2023. Contact: connect@educai8.org.
2 · Who this policy is for
This policy applies to everyone who visits or uses Careers Ahoy — our website, our app, our pathways, Sage (our AI companion), and any supporting service we run. If you are under 18, a parent or guardian should read this with you.
3 · What we collect, and why
Only what we actually need. Here's every field, why it exists, and how long we keep it.
| Data | Why | Retention |
|---|---|---|
| Preferred name | Personalisation | Life of account |
| Age, grade, country | Suggesting relevant pathways and content | Life of account |
| Mobile number | OTP login security; consent audit trail | Life of account |
| Email (optional) | Updates and account recovery | Life of account |
| "Parent on this number?" Yes/No | Determining valid parental consent for minors | Life of account |
| Pathway progress & choices | Save points, recommendations, Sage context | Life of account |
| Reflections & notes | Re-readable in your Logbook, Sage context | Life of account · private to you |
| Decision (Yes/Maybe/No) per pathway | Your Logbook, recommendation tuning | Life of account |
| Sage chat messages | Chat memory; future model training (anonymised, with consent) | Life of account · separately deletable |
| Aggregate analytics | Improving the product | ~14 months pseudonymous, then aggregated |
| Technical diagnostics (errors) | Fixing bugs and crashes | 90 days |
We do not collect: precise location, contacts list, photos from your phone, browsing history on other sites, biometric data, political views, religious beliefs, financial information, or any special-category personal data.
4 · Children's data — extra care
Under India's DPDP Act 2023, anyone under 18 in India is treated as a child and their data can only be processed with verifiable parental consent. We apply equivalent protection internationally (COPPA in US, GDPR Art. 8 in EU/UK).
We capture parental approval at signup:
- Shared-phone path — when the mobile number at signup is the parent's (common in India), the sign-in code goes to the parent, who physically receives it. This is a recorded consent event.
- Parent-held account — for explorers under 13, a parent or guardian creates and holds the account and explores alongside the child.
We continue to strengthen our parental-consent verification as the platform grows.
For all minors, we additionally commit to:
- No behavioural advertising, ever
- No profiling for marketing
- No sharing of the child's content with parents unless the child initiates
- No location tracking beyond country (self-reported)
- Age-appropriate language in this policy itself
- Account deletion available to the child directly — not gated by parent permission
5 · How we use what we collect
- To run the service — sign you in, save your progress, render your shelf.
- To personalise — recommend pathways based on what you've explored.
- To support Sage — the chat reads your pathway data so it can reference your specific choices.
- To improve the product — aggregate analytics on what works.
- To keep you safe — detecting abuse, preventing misuse of Sage.
- To respond to a parent's request, with your consent.
6 · Who we share data with
We do not sell your personal information. We do not participate in data-broker markets. We do not integrate with advertising networks. We do not show you ads.
We do share data with a small number of processors who help us operate the platform, each under DPDP-compliant agreements:
- Google / Firebase — hosting, authentication, database, aggregate analytics
- Anthropic (Claude API) — Sage's AI responses
- Gupshup — delivery of one-time sign-in codes (OTP)
We disclose data only when required by valid Indian legal process, or to protect lives or prevent serious harm.
7 · Your rights
You can exercise any of these by emailing us at connect@educai8.org.
- Access — ask for a copy of everything we have about you.
- Correction — edit your profile fields, or ask us to correct stored data.
- Erasure — ask us to delete your account, with a recoverable grace period before permanent removal.
- Withdrawal of consent — opt out of Sage, or revoke parental consent.
- Nomination — under the DPDP Act, you can nominate someone to exercise your rights.
- Grievance — escalate to our Grievance Officer (below). If unresolved within 30 days, escalate to the Data Protection Board of India.
8 · Security & breach notice
Data is stored in Firebase (Google Cloud) with encryption in transit and at rest. Access is limited to a small named team under least-privilege controls. Mobile OTPs are handled by Firebase Auth; we do not store OTP codes ourselves.
In the event of a personal data breach likely to cause harm, we will notify affected users and the Data Protection Board of India within 72 hours, as required by the DPDP Act. For children, parents will be notified.
9 · Retention & deletion
Retention periods per data type are in section 3.
Account deletion runs on this schedule:
- You request deletion (email us, or use in-app controls as they become available) → we confirm with a clear delete-list.
- A 14-day recoverable grace window — contact us to recover.
- After grace: database records deleted within 7 days, analytics IDs severed, Sage chat logs anonymised or fully deleted per your choice.
- A final deletion confirmation is sent with a reference ID.
A parent can also request deletion on a minor's behalf. Parent deletion is additional, never a precondition — a minor can always delete their own account.
10 · Changes to this policy
When we change the policy in a way that materially affects your rights, we'll notify you in the app and (if you've given email) by email. We keep a version history.
11 · Contact & grievance officer
Grievance Officer: Garima Aggarwal · Grievance Officer
Email: connect@educai8.org
Address: A2/27 Safdarjang Enclave, First Floor, New Delhi 110029
Response time: 7 calendar days for acknowledgement, up to 30 days for resolution.
For general questions, email connect@educai8.org or educai8.org@gmail.com.
If your complaint isn't resolved by the Grievance Officer within 30 calendar days, you may escalate to the Data Protection Board of India under Section 13 of the DPDP Act.
Delete my account
To delete your account and data, email us at connect@educai8.org. There's a 14-day recoverable grace period, after which removal is permanent. (In-app deletion controls are coming.)