Privacy & data

• Account: name, email address, username, phone number (if you give it) and your password, which is stored only as a one-way hash.
• Subscription and payments: chosen plan, amount, order reference, the UPI transaction reference (UTR) you submit, dates, and the outcome of our manual verification. We do not receive your UPI PIN, bank login or card details.
• Security records: sign-in failures, payment actions and administrative changes, with the IP address and time, kept in an audit log.
• Session cookie: a secure, HttpOnly cookie that keeps you signed in. It expires after at most 30 days.
• Browser storage: one setting that remembers if you dismissed the “install app” prompt, and an offline cache of public pages used by the app's service worker.

To create and secure your account, give you the access you paid for, verify UPI payments against our bank statement, keep payment and audit records, prevent fraud and misuse, answer your requests, and meet legal obligations. We do not sell your data, and we do not use advertising or analytics trackers.

We use service providers to run the site. They process data on our behalf, and some may store it outside India:

• Vercel: website hosting and request logs.
• Neon: the account and payment database.
• Cloudflare R2: storage of market-data files and charts.
• Resend: password-reset emails.
• YouTube (privacy-enhanced mode): only if you play an embedded video.

Account data is kept while your account exists. Payment, order and audit records are kept for as long as accounting, tax and other legal record-keeping obligations require, even after an account is deleted. Session cookies expire automatically.

You can ask us to access, correct or update your personal data, to withdraw consent, or to delete your account, by writing to gyanapravah.odisha@gmail.com from your registered email address. On deletion we remove or anonymise your account data, except records we must keep by law (section 4). You may also nominate another person to exercise these rights for you.

These rights reflect the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, whose obligations are being brought into force in phases.

Passwords are hashed, sessions are signed and expire, paid content is served only after a server-side entitlement check, and access to administrative tools is restricted. No system is completely secure; if we become aware of a breach affecting you we will inform you as the law requires.

Privacy questions and complaints: Gyana Pravah, gyanapravah.odisha@gmail.com. See contact & grievances.