1. Introduction

Welcome to Civora, a Kerala PSC exam preparation platform operated by Civora Technologies (“we”, “us”, or “our”). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Civora mobile application and website (civoratechnology.in).

By creating an account or using Civora, you agree to the practices described in this policy. If you do not agree, please discontinue use of the app.

2. Information We Collect

We collect information you provide directly and information generated through your use of the app.

2.1 Information You Provide

• Account details: Email address, full name, and gender (collected during onboarding).
• Payment information: When you subscribe to a Pro plan, payment is processed by Razorpay. We receive only your subscription status and masked payment metadata; we never store your full card or bank details.

2.2 Information We Collect Automatically

• Exam and performance data: Questions attempted, answers submitted, scores, time taken, and leaderboard rankings.
• Daily task activity: Tasks completed, streaks, and engagement patterns.
• Device information: Device model, operating system version, and a device session identifier used to enforce single-device login security.
• Push notification token: A Firebase Cloud Messaging (FCM) token so we can send you relevant notifications. You can withdraw consent at any time through your device settings.
• Usage analytics: App screens visited and feature interactions, used in aggregate to improve the app.

3. How We Use Your Information

• Deliver the service: Authenticate you, serve exam questions, track your progress, and display leaderboard rankings.
• Subscription management: Process Pro plan purchases, AutoPay renewals, and cancellations via Razorpay.
• Notifications: Send exam reminders, daily task alerts, and important account updates via push notifications and email.
• Security: Detect abuse, enforce single-device sessions, and protect user accounts.
• Legal compliance: Maintain records of your acceptance of our legal documents as required by applicable law.
• Product improvement: Analyse aggregated, anonymised usage patterns to improve features and content.

We do not use your data for advertising profiling or sell it to third parties.

4. Third-Party Services

We share data with the following processors only to the extent necessary to operate the service:

• Razorpay — Payment processing for Pro subscriptions and AutoPay. Razorpay's privacy policy applies to payment data: razorpay.com/privacy.
• Google Firebase (FCM) — Push notification delivery. Google's privacy policy: policies.google.com/privacy.
• Email service provider — Transactional emails (OTP codes, account alerts). Only your email address is shared.

All third-party processors are contractually bound to handle your data only as instructed and in accordance with applicable data protection laws.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may disclose data only:

• To third-party processors listed above, under data processing agreements.
• When required by law, court order, or governmental authority.
• To protect the rights, property, or safety of Civora, our users, or the public.
• In connection with a merger or acquisition, provided the successor entity honours this policy.

6. Your Rights

6.1 Rights Under GDPR (EEA / UK Users)

If you are located in the European Economic Area or United Kingdom, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”), subject to legal retention obligations.
• Portability — receive your data in a structured, machine-readable format.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where processing is based on consent (e.g., push notifications).

6.2 Rights Under CCPA (California Users)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and share.
• Delete personal information we hold about you (subject to certain exceptions).
• Opt-out of the sale of your personal information — we do not sell your data.
• Non-discrimination — we will not discriminate against you for exercising your rights.

6.3 How to Exercise Your Rights

Contact us at civorakpsc@gmail.com with subject line “Privacy Request”. We will respond within 30 days. We may need to verify your identity before processing your request.

7. Data Retention

• Active accounts: Data retained for as long as your account is active and for a reasonable period afterward for backup and audit purposes.
• Deleted accounts: Personal data is purged within 30 days of account deletion, except where retention is required by law (e.g., financial records related to subscriptions).
• Aggregated analytics: Anonymised data may be retained indefinitely.

8. Data Security

We implement industry-standard safeguards:

• All data transmitted between the app and our servers is encrypted using TLS.
• Passwords and OTP codes are never stored in plain text; OTPs are hashed and expire after a short window.
• Authentication uses short-lived JWT tokens; refresh tokens are stored securely on device.
• A single-device session policy prevents unauthorised concurrent logins.
• We conduct periodic security audits including static analysis and dependency vulnerability scanning.

No system is 100% secure. If you suspect a security issue, please report it promptly to civorakpsc@gmail.com.

9. Children’s Privacy

Civora is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it promptly.

10. Content Standards

Civora is committed to providing a safe, respectful, and lawful platform. Our app and all content within it comply with Google Play Developer Program Policies, including:

• No harmful content: We do not host or promote violence, hate speech, harassment, or discriminatory content.
• No illegal content: We do not facilitate gambling, controlled substances, or any other unlawful activity.
• Intellectual property: All exam content, images, and materials are either original, licensed, or in the public domain. We respect third-party intellectual property rights.
• Accurate representation: The app's functionality and data practices are accurately described in this policy and our app store listing.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you at least 30 days in advance via an in-app notification. Continued use of Civora after the effective date constitutes acceptance of the updated policy.

You can always find the current version of this policy at civoratechnology.in/legal/privacy/.

12. Contact Us

For privacy questions, requests, or concerns:

• Email: civorakpsc@gmail.com
• Website: civoratechnology.in

We aim to respond to all enquiries within 5 business days.