The short version
- A parent or lawful guardian creates the account and gives consent for their child. Children can't sign up on their own.
- We collect only what learning needs: your email, and your child's first name (or nickname), class, board and learning progress.
- No advertising to children. No selling or sharing data for marketing. No tracking of children across other apps or websites. No chat, public profiles or rankings.
- Your child's data is stored on Google Firebase servers in Mumbai, India.
- You can see, download, correct or delete your child's data any time in Parent Zone → Privacy & Data, or by writing to us.
1. Who we are
Grinkif (the website grinkif.com and the Grinkif learning app) is provided by Grinkif, a sole proprietorship of Somdeb Mandal, based in Kolkata, West Bengal, India ("Grinkif", "we", "us"). For the purposes of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it, we are the Data Fiduciary for the personal data described in this policy.
This policy explains what personal data we collect, why, how long we keep it and the choices you have. It applies to the app and to this website.
2. Children and verifiable parental consent
Grinkif is made for children in Classes 1–5, who are under 18 and so are "children" under the DPDP Act. Under the Act, when the person whose data it is is a child, their parent or lawful guardian is the Data Principal who acts on the child's behalf. So in this policy, "you" means the parent or guardian.
- Only an adult can create an account. The account is created with the parent's own email address (or Google account). Child profiles can only be added from inside the parent's account.
- Consent before processing. When you create your account you confirm that you are at least 18 and the parent or lawful guardian of each child you add, and you give consent for us to process your child's data as described here. When you add a child you tick a box confirming this, and we record the date and the version of this policy you agreed to.
- Verification. We verify that the account holder controls the email address used (by email verification or Google sign-in) before a free trial or paid plan can start.
- No harmful processing. We do not track or monitor children's behaviour for advertising, and we do not show targeted advertising to children. Learning data is used only to teach, adapt practice and report to you.
- Withdrawing consent. You can withdraw consent at any time by deleting your child's data (see Your rights). After that we can no longer provide the service for that child.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Parent account | Email address; your name and profile picture if you sign in with Google; a sign-in identifier. Passwords are handled by Google Firebase Authentication and are never visible to us. | You |
| Child profile | First name or nickname, class, school board (CBSE/ICSE), chosen subjects, interests you pick, where the class has reached in the syllabus, and settings such as daily time limit, Auto Tutor and read-aloud. | You |
| Learning data | Which topics your child has done, their answers, levels, mistakes and reviews, mock test results, time spent learning each day, rewards (Grin Chips and Grin Gems), store items, and optional notes your child types in (for example, a writing answer or a gratitude answer). | Your child's use of the app |
| Parent inputs | Report frequency, check-in answers and deadline, school test dates and, if you choose to upload it, a photo or PDF of your child's school exam timetable. Any real-world rewards you set up. | You |
| Payments | Your plan, payment status, dates and amounts, and reference numbers from Razorpay. We do not receive or store your full card number, CVV, UPI PIN or bank login. | You and Razorpay |
| Referrals | Your invite code, which accounts signed up with it, and whether they qualified for a reward. To prevent abuse we compare account email and payment-method fingerprints supplied by Razorpay. | You, invited families and Razorpay |
| Device and usage | Basic technical data needed to run and secure the service, such as browser type, device type, approximate time of use, error logs, and signals used to spot repeat free-trial sign-ups or shared accounts. | Your device |
| Support and feedback | Messages you send us, and "Report a mistake" reports (which include the question or lesson concerned). | You |
| Website visitors | If you accept analytics cookies: pages visited and ad-campaign information (see Cookies). If you use the contact form: your name, email, message and, optionally, your child's class. | You and your browser |
What we don't ask for: your child's surname, photo, voice recording, date of birth, home address, phone number or precise location. Please don't type such details into free-text boxes.
4. How we use it
We process personal data only for the purposes you consented to, or where the DPDP Act otherwise allows it:
- To provide Grinkif: create and secure your account, show the right class and board content, save progress, and run lessons, practice, mock tests, the weekly plan, the exam planner and Auto Tutor.
- To personalise learning: choose the right level, spot gaps and suggest what to practise next.
- To keep you informed: create progress reports, run the check-in and show notices to you in the app. If we switch on email or WhatsApp reports later, we will update this policy and ask you to opt in first.
- To bill you: manage your trial, subscription, renewals, sibling discounts and referral rewards.
- To support you: answer your messages and fix reported mistakes.
- To keep the service safe and fair: prevent fraud, abuse of free trials and referrals, and misuse such as account sharing.
- To improve Grinkif: understand, using aggregated or de-identified data wherever possible, which lessons and questions work well and which need fixing.
- To meet legal obligations: for example tax and accounting records, and responding to lawful requests.
We do not sell personal data, use children's data for advertising, or build advertising profiles of children.
5. AI helpers
Some hints, explanations, extra practice questions and writing feedback are generated using Google's Gemini models through Google Cloud Vertex AI. When this happens, we send only what is needed: the class, board, topic, the question text, your child's answer where relevant, and interest words (such as "cricket"). We never send your child's name, your email or any other identifier. If you upload an exam timetable, the image or PDF is processed by the same service to read the dates. Right and wrong answers are decided by our own checked content, not by AI.
These AI requests are processed on Google Cloud servers in the United States (region us-central1). Under Google Cloud's terms, this data is not used to train Google's models.
6. Who we share it with
We share personal data only with service providers who process it for us under contract (the DPDP Act calls them "Data Processors"), and only as much as they need:
| Provider | Purpose |
|---|---|
| Google (Firebase and Google Cloud) | Sign-in, database, hosting, server functions and AI helpers |
| Razorpay Software Private Limited | Payments, subscriptions, UPI AutoPay mandates and receipts |
| Google Analytics and Meta (website only) | Website analytics and ad measurement, only if you accept cookies on grinkif.com. Never used inside the children's app. |
| Zoho Corporation (Zoho Mail, India data centre) | Our support mailbox |
We may also disclose data if the law requires it (for example, a valid order from a court or government authority), or to protect the rights and safety of children, users or Grinkif. If Grinkif is ever sold or merged, your data would move only under the same protections, and we would tell you first.
Other people can't see your child's data. There is no chat, no public profile and no leaderboard. Only signed-in guardians of a child can see that child's data.
7. Where it's stored
Account and learning data is stored in Google Cloud Firestore in the Mumbai, India region (asia-south1). Some processing happens outside India: the server functions that run reports and payments, and the AI helpers described above, run on Google Cloud in the United States, and Razorpay and Google may process data in line with their own policies. Where data is transferred outside India, we do so as permitted under the DPDP Act and any rules or restrictions notified by the Government of India.
8. How long we keep it
- While your account is active: we keep your child's learning data so progress, levels and reports carry on.
- When you delete a child's data (Parent Zone → Privacy & Data → Delete): the child's profile, progress, rewards and notes are deleted from our live database straight away. Copies in routine backups are deleted within 30 days.
- When you ask us to delete your whole account: we delete it and all its child profiles within 30 days of your request.
- Inactive accounts: if an account has not been used for 3 years, we will email you, at least 48 hours before deleting it, so you can keep it by simply signing in.
- Payment and tax records: kept for as long as Indian tax and accounting laws require (typically up to 8 years), even after an account is deleted. These don't include learning data.
- Website contact messages: kept for up to 12 months after the conversation ends.
9. Your rights
As the Data Principal (for yourself and on behalf of your child), you have the right to:
- Access a summary of the personal data we hold and how we process it, and the list of those we have shared it with. Parent Zone → Privacy & Data shows what we keep and lets you download a copy (JSON).
- Correct, complete or update data. Most profile details can be edited in Parent Zone.
- Erase data. Use "Delete [child]'s data" in Parent Zone → Privacy & Data, or email us to delete your whole account.
- Withdraw consent at any time, as easily as you gave it. This doesn't affect processing done before you withdrew it.
- Grievance redressal: complain to our Grievance Officer (below). We will respond within 30 days or any shorter period the rules set.
- Nominate another person to exercise these rights if you die or become unable to.
- Complain to the Data Protection Board of India if you aren't satisfied with our response.
To use any of these rights, use Parent Zone or write to support@grinkif.com from your account email. We may need to confirm your identity first.
10. Security
We use reasonable security safeguards: encrypted connections (HTTPS), Google Firebase Authentication, database rules that let only a child's signed-in guardians read that child's data, server-side checks for anything to do with payments and plans, and restricted internal access. No system is perfectly secure. If a personal data breach happens, we will inform the Data Protection Board of India and affected parents as the DPDP Act requires.
11. Cookies and the website
On grinkif.com (this website):
- Always on (necessary): your browser remembers your cookie choice, and a small note of how you arrived (for example, which ad or post) so we can tell which of our posts help parents find us. This note stays on your device and is added to the sign-up link when you click "Start free trial". It does not identify you.
- Only with your OK: Google Analytics (visits and pages) and Meta Pixel (measuring our Facebook and Instagram ads). These load only if you click "Accept analytics" in the cookie banner. You can change your choice any time with "Cookie settings" at the bottom of every page.
In the app: we use the browser storage and cookies that sign-in and the app need to work. There are no advertising cookies or third-party ad trackers in the children's app.
12. Changes to this policy
If we make important changes, we will tell you in the app or by email before they take effect, and ask for fresh consent where the law requires it. The date at the top shows when this policy was last updated.
13. Contact and Grievance Officer
Grievance Officer: Grinkif Grievance Officer
Email: support@grinkif.com (subject: "Grievance")
Location: Kolkata, West Bengal, India
General support: support@grinkif.com
