Privacy Policy

• Your study material is used to answer your questions. We don’t sell it, and we don’t show ads.
• You can download everything we hold, or delete your account and its data, yourself, from Settings. No email to support needed.
• You can sign out of every device at once, and turn on two-factor sign-in.
• Some of your content is processed by Google’s AI to produce answers. The details are below, so you can decide what to upload.

Account: your name, email address and sign-in method (password or Google). We never see or store your Google password; for email accounts only a one-way hash is kept, by Firebase Authentication.

Your study profile: the exam, class and subjects you chose, your exam date, reminder time, streaks, scores, weak topics, and short notes the AI keeps to personalise help (“AI memory”, which you can view and clear in Settings).

Your work: the text we extract from material you upload or paste, the quizzes, guides and flashcards generated from it, your answers, chats, saved answers, and any message or photo you send to support or to ask a teacher.

Notifications: if you turn on reminders, a token that identifies your browser or phone to the push service. It is removed when you turn reminders off or sign out of all devices.

Usage and device: pages viewed and key actions (for example “finished a quiz”) through Google Analytics for Firebase, and your approximate country (from your connection) to show the right currency. We don’t build advertising profiles.

Payments: handled by Razorpay. We receive the plan, amount, status and Razorpay’s reference ids. We never receive your card, UPI or bank details.

To generate answers, quizzes and guides, the text (and any images) of what you upload or type is sent to Google’s Gemini API, which is a third-party AI service. We send only what is needed for the request in front of you. Please don’t upload anything you wouldn’t want processed that way: other people’s personal details, government ID numbers, or medical or financial records.

If you add your own Gemini API key in Settings, requests are made with your key and are governed by your own agreement with Google. We store that key encrypted and never show it back to you or include it in your data download.

Answers are produced by AI and can be wrong. They are study aids, not professional advice.

We use these services to run SCOREX. Each receives only what its job needs:

• Google Firebase (Authentication, Firestore database, Cloud Messaging, Analytics, App Check): accounts and stored data.
• Google Gemini API: generates AI responses from your content, as described above.
• Vercel: hosts the website and our server code.
• Razorpay: processes payments.
• Cloudflare Turnstile and Google reCAPTCHA: tell people from bots on sign-up and on actions that scripts like to abuse.

These providers may process data on servers outside India. We don’t sell personal data, and we share it with no one else except where the law requires.

Access to the production database is limited to the operator of SCOREX, used to run the service, answer support requests and fix faults.

All of these are in Settings once you’re signed in:

• Download my data: one file with your profile and everything you’ve created.
• Delete my account: permanently erases your profile, uploads, study material, quiz history, progress, chats and challenge links, then removes your sign-in. You’ll be asked to confirm your password (or Google) first, so a borrowed device can’t do it. If you have a recurring subscription, ask support to cancel it first so you are not charged again.
• Sign out of all devices if you lose a phone or used a shared computer.
• AI memory: see, remove or clear what the AI remembers about you.
• Reminders: turn push notifications off at any time.
• Two-factor sign-in: add a phone-code step to your login.
• Correction: edit your name, class and exam details in Settings.

Anything you can’t do yourself, write to avoliro.ind+legal@gmail.com.

Your data stays until you delete it or delete your account. Deleted data is removed from our live database straight away; any copies held in our providers’ own backups can take longer to age out.

Payment records (Razorpay order and subscription references, amounts, dates) are kept after deletion because tax and accounting rules require it. They hold no study content.

Abuse-protection counters and cached AI answers are not tied to your name and expire on their own.

• All traffic is encrypted (HTTPS, with HSTS).
• Database rules mean your personal records can be read only through your own signed-in account; sensitive operations run on our servers, which check who is asking.
• Email accounts must verify their address. Passwords must be at least 8 characters. You can reset a forgotten password by email.
• Optional API keys are encrypted at rest.
• Deleting an account, downloading data and signing out of all devices all require a current, valid session, and deletion also needs a fresh password or Google confirmation.

No online service is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

SCOREX is built for school and exam students. You must be at least 13 to use it, and if you are under 18 your parent or guardian should have agreed to this policy and the Terms for you. We don’t knowingly collect data from children under 13, we don’t advertise to students, and we don’t track them for advertising. A parent or guardian can write to us to see, correct or delete a child’s data.

If we change this policy in a way that matters, we’ll update the date above and tell signed-in users in the app.

Questions or requests: avoliro.ind+legal@gmail.com.