Privacy Policy

Who we are

SkillStar is operated by Dhil Tech ITS, Jannah, Eyyamadakkal, Thzohuvanoor PO, Valanchery, Malappuram, Kerala - 676552. We are the Data Fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023.

Our approach to children's data

SkillStar is built for children, so we collect as little about them as we possibly can. Three commitments shape everything below:

• A parent or guardian creates and controls the account. Children do not sign up themselves, and we require parental consent before any child profile is created.
• We do not show targeted or behavioural advertising to children, we do not track children for advertising, and we do not use any third-party advertising or analytics SDKs that profile them. The only sponsor mention a child can see is a plain “Supported by” credit on an exam card — a name and logo, with no link and no offer.
• We never ask for a child's gender, photograph, location, contact details, school name or any government identifier.

What we collect

From you, the parent

• Your name, email address and (optionally) mobile number.
• If you sign in with Google or Apple: the name and email address they share with us and an account identifier they give us. With Sign in with Apple you can hide your email, and we then receive an Apple relay address instead. We never see your Google or Apple password.
• Your profile picture, if you choose to upload one.
• Your record of consent to this policy, and of your email choices: whether you asked for our newsletter or the weekly progress email, when, where you chose it, and the exact words you were shown.
• When you sign up with an email address, a 6-digit code we email you to confirm the address is yours. We keep only a scrambled version of the code, and only until you use it.
• Whether email to your address can be delivered: if it bounces or is marked as spam, our email provider tells us, and we stop sending you newsletters and progress emails.
• If you allow reminders in the SkillStar app: your phone's notification address (a code from Apple or Google that lets us send it reminders) and its time zone, so a reminder arrives at the hour you chose. We do not store your phone's model, number or location.
• What you tell us you are preparing for: the exam, class and exam date, for your family and for each child.
• Payment records: what you bought, when, how much, and the gateway's reference numbers. We never receive or store your card number, CVV, UPI PIN or bank credentials — those go directly to Razorpay.
• If you buy credits in the SkillStar app: what Apple or Google tells us about the purchase (which pack, the transaction reference, the price and currency, whether it was a test purchase, and later whether it was refunded). We never see your Apple or Google payment details. With each purchase the app sends Apple or Google an account code made from your SkillStar account number, so we can tell the purchase belongs to your account; it contains no name, email or anything about your children.
• Support tickets you raise, and any files you attach to them.
• Reports you send about a mock test question you think is wrong: the reason, any words you add and the answer that was given, so our team can check and fix it.
• If you choose to verify your mobile number: the number and a scrambled version of the code we send. The code goes to you as a WhatsApp message from SkillStar's business number, so Meta (which runs WhatsApp) receives your number and that message.
• If you join with another family's invite code, or a family joins with yours: which account invited which, so both can get their reward. We only ever show you how many families joined with your code, never who they are.
• If you answer our short feedback survey: your score and any notes. Our staff read the answers without your name.
• Your credit history: rewards paid to you, codes you redeemed and any Exam Pass you bought, with dates.

About your child

• First name (or nickname — it does not have to be their real name).
• Date of birth, used to suit activities to their stage and to add a small birthday treat to your family's wallet on their birthday.
• Class or grade.
• An avatar and a theme they pick, such as space or ocean.
• Their learning activity: XP, levels, streaks, badges, milestones, which activities they finished, their mock test scores and their answers to the Daily 5 questions.
• If you register them for the SkillStar Talent Search Exam: their answers, the time they took, and when the exam screen was left (see below).
• If they use Baba, our AI tutor: the messages they write to Baba, Baba's replies, and their quick-check results.

We deliberately do not collect a child's gender. Themes and content are matched using age, class and the world a child chooses — never a sensitive attribute.

Why we use it

• To run the service: show the right content, track progress, award XP and badges, and keep the family wallet accurate.
• To process payments and issue tax invoices, as Indian tax law requires.
• To send you service messages: sign-in codes, milestone notifications, purchase receipts, refund updates and support replies.
• To send you a weekly progress email about your family's practice. It is on by default and every one has a one-click unsubscribe link; you can also switch it off in your email settings.
• To send you our newsletter (news, exam tips and offers), only if you ticked the box asking for it. Every newsletter has a one-click unsubscribe link.
• To send practice reminders and exam countdowns to your phone, only if you allowed reminders in the app. You can change the time or switch them off in the app's settings, or in your phone's settings.
• To keep the service secure and to investigate misuse.

We do not sell personal data. We do not share it for anyone else's marketing. We do not build advertising profiles of you or your children.

Usage statistics and sponsors

To show sponsors and advertisers how many families use SkillStar, we produce aggregate statistics only: for example how many families were active this month, how many children are in each class or age band, which exam families are popular, and which Indian states our families are in.

• We record which days an account was active and how often it signed in. This stays inside SkillStar and is only ever reported as totals.
• We also note whether that day's use was on our website, Android app or iPhone app, so we can report how many families use each. We never record your device's model or any device identifier.
• Google Play and the App Store give us download totals, star ratings and the reviews people post about our app. We copy the totals, and the review text without the reviewer's name, so our team can read them in one place.
• Location is the state or country our content-delivery network infers for each request. We never store your IP address, precise location or city.
• Page visits are counted without cookies. Each visitor is represented by a one-way code that changes every day, so a visitor can't be recognised again the next day or identified at all.
• Any group smaller than 50 is combined with others or withheld before statistics are shared, so a small group of children can't be singled out.
• Sponsored messages appear only on parent-facing pages, are always labelled “Sponsored”, and are the same for everyone. We count how many times a sponsor was shown and clicked in total — not who saw or clicked it.

Baba, our AI tutor

Baba is an AI tutor that teaches one syllabus topic at a time and checks understanding with short quizzes. It runs on Amazon Bedrock, a service of Amazon Web Services.

• To teach well, Baba is told your child's first name, age and class, the exam and topic being studied, and their progress on SkillStar. Baba is never told your email, phone number, date of birth or anything else about your family.
• Your child's messages are processed by Amazon Bedrock in Australia (Sydney and Melbourne) to generate Baba's replies. Amazon does not use them to train AI models and does not share them with the model's developer.
• Every message and reply passes through a safety filter that blocks harmful content and masks personal details such as phone numbers and email addresses before they reach the AI.
• You can read every chat your family has had with Baba from the “Baba chats” page, and delete any chat there at any time.
• When you talk to Baba about your children, Baba is given a summary of each child's SkillStar progress (first name, age, class, lessons, quick-check and mock test scores, syllabus ticks, streaks and badges) so it can report on their learning. Mock test questions and answers are never shared with it.
• Baba is an AI and can make mistakes. It isn't a replacement for a teacher or a parent, and it's told to send a child who seems upset or unsafe to a trusted adult.
• Baba can't draw. When your child asks for a picture, Baba shows a button that opens Google Images, with SafeSearch on, searching for the topic and a few words of what they asked for (letters only, never numbers). Nothing goes to Google unless the button is tapped, and Google's own privacy policy applies there.
• After a mock test, your child can tap “Ask Baba why” on an answer. Baba is then given only that question, its options, the correct answer and which option was chosen: never your child's name, class details or anything they typed. The explanation is saved with the question and shown to anyone who gives the same answer, so it contains nothing about your child.
• Anyone in your family can report a Baba reply that seems wrong, unkind or upsetting, right under the reply. You can add a few words about what was wrong. Our staff review reported replies to improve Baba's safety filter and to follow up with you if needed. They see the reply, the part of the chat around it (which can include your child's first name, because Baba greets them by it), the topic, the words you added, and which account reported it: the account holder's name and email, and for a child's lesson only the child's age and class. Deleting the chat deletes the report too.
• We keep a record of how much the tutor was used (counts of words processed and its cost to us) with no chat text in it, to run and price the service.

Marking written answers

Some mock test questions ask your child to type an answer. How each one is marked is set by us when the question is written.

• Many written answers are checked by simply comparing them with the accepted answers. Nothing leaves SkillStar for those.
• Longer answers can be marked by an AI model on Amazon Bedrock in Australia (Sydney and Melbourne). Only the question, the model answer, any marking notes and the text your child typed are sent. Your child's name, age, class, email and the rest of their profile are not.
• The AI marker never gets a name or any other detail about your family, and it is told to treat what your child typed as an answer to mark, never as instructions. It returns marks and one short comment, and the marks are capped by the question's marks.
• Amazon does not use this text to train AI models. We keep your child's typed answer and the marks with their mock test result, the same as their other answers, and it is removed when you delete the child's profile or your account.
• We keep a record of how often the marker was used (counts of words processed and its cost to us), with no answer text in it.

Our staff's AI assistant

Our admin team can use an AI assistant to help run SkillStar: adding exam papers and practice tests, updating syllabi, and understanding how the service is doing.

• It only works for our own staff, inside our admin panel. Families and children never talk to it.
• It never receives your name, email, phone number or address, nothing about your children beyond overall counts, and no text your family wrote to us (support messages, refund reasons). Where it looks at payments or refunds, accounts appear only as an internal code.
• Depending on the AI model our staff choose, this work is processed by Amazon Bedrock in Australia or by another AI provider (such as Anthropic or OpenAI), which may be outside India and Australia. We only use providers whose business terms say they process it for us and don't use it to train their models.

Our marketing tool and Google (YouTube)

We run our own social media accounts with an internal marketing tool, SkillStar Studio. It is used only by our own staff, never by families or children, and it holds no family or child data.

Our website and app link to these accounts (Instagram, Facebook, YouTube and WhatsApp) with ordinary links, shown to parents only. Nothing from those services loads on our pages, so they learn nothing about you unless you open a link; what happens there is covered by that service's own privacy policy.

• To post videos on SkillStar's own YouTube channel, SkillStar Studio connects to that one channel through Google's YouTube Data API with a single permission: uploading videos (youtube.upload). It cannot read, change or delete anything else on the channel, and it never connects to anyone else's Google or YouTube account.
• It uploads only videos our staff have made and approved in the tool. It reads no Google user data beyond what the upload needs, shares nothing with anyone else, and uses nothing for advertising.
• The sign-in token Google gives us is stored encrypted in SkillStar Studio and used only to upload our videos. We can disconnect it at any time in the tool, and it can also be removed in the Google account's security settings (Third-party apps with account access).
• SkillStar Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Classes, grand tests, the Talent Exam, certificates and challenges

• Classes: only if you join your child to a class with a teacher's or tuition centre's code, and agree to it on screen. The teacher and the families in that class then see your child's first name and last initial, and how many days they practised and how many Daily 5s they did each week. Never their scores or answers. You can take your child out of a class at any time; deleting the child does it too.
• Grand tests: when your child takes part in a scheduled grand test, their first name and last initial and their score are used to rank the entries. After it closes, families who took part see the top places (first name, last initial and score) and their own child's result. We never show a low place: outside the top quarter a child is shown as having taken part.
• SkillStar Talent Search Exam: when you register your child (or yourself), we keep the name you confirm for the certificate, the class paper, the slot and the credits paid. During the exam we record the answers and when they were given, and each time the exam screen is left: what happened (for example switching tabs or windows, leaving full screen, or in the app going to the background or taking a screenshot) and when. We use these records only to review that the exam was fair, and our team reviews any attempt they flag before results come out. We never use a camera or microphone.
• Talent Exam results: a learner sees their own score and a breakdown by subject and skill. The public toppers list shows the top three in each class by first name and last initial only, and only if you ticked that option when registering. Parents who take part are never ranked.
• If our team finds cheating after review, the attempt is disqualified and the family account may be closed permanently. We tell you why and how to appeal. To stop the same email address signing up again, we keep a one-way code made from it (not the address itself); if a closure was a mistake, reopening the account removes it.
• Certificates come from the Talent Exam. They show the name you confirmed at registration, the exam, the class, a merit rank for the top three, and a certificate number with a QR code. Anyone who has the number can check it on our website, which shows only the first name and last initial. Score cards are pictures we make when you ask, with your child's first name only. Certificates and score cards are shared only if you choose to share them.
• Social challenges take place on Instagram, Facebook, YouTube or WhatsApp under those platforms' own terms. To pick and contact winners we note an entrant's public handle and a link to their entry. We never link a social media account to a SkillStar account, and we delete these notes 90 days after the challenge closes. Winners receive a code to enter on our website.
• App installs: the first time the Android app opens, it tells us which of our links led to the install (for example a SkillStar Instagram post), so we can count installs per campaign. We store only the count per campaign and day: no device identifier, account or IP address.
• Our newsletter archive on the website shows newsletters we've sent. They contain no information about any family.

Who else sees it

• Razorpay, our payment gateway, processes payments and refunds. They receive your name, email, phone and the amount — never anything about your children.
• Apple and Google process purchases made in the SkillStar app, under their own privacy policies. They tell us that a purchase or refund happened; we tell them nothing about you or your children beyond the account code above.
• Amazon Web Services hosts our email delivery and, through Amazon Bedrock, runs Baba, our AI tutor, and marks longer written mock test answers (see above).
• Meta, which runs WhatsApp, receives your mobile number and the code message if you choose to verify your number. Meta's own privacy policy applies to WhatsApp.
• Expo, which delivers the app's reminders to Apple's and Google's notification services, receives your phone's notification address and the reminder text (which can include a child's first name). Apple and Google then deliver it to your phone.
• The AI provider our staff choose for their admin assistant receives only the data described under "Our staff's AI assistant" above.
• Sponsors and advertisers receive only the aggregate statistics described above — never a name, contact detail or anything that identifies a family or child.
• Our own staff, only where needed to provide support, review a reported Baba reply, or investigate a problem.
• Government or law enforcement bodies, where we are legally required to disclose.

How long we keep it

We keep account and learning data for as long as your account is open. If you delete a child's profile, their learning data, including their chats with Baba, is removed with it. You can also delete any Baba chat on its own.

When you delete your account, we immediately delete your profile, your children's profiles and all their learning data (progress, test results, badges, syllabus ticks and chats with Baba), your notifications and support tickets, and your profile picture. Copies in our encrypted backups expire within 30 days. We keep payment and tax records (orders, invoices, refunds and the credit history) for up to eight years because Indian law requires it; they hold amounts and an account number, never your children's details. We also keep a one-way code made from your email address (not the address itself), only so that the same address can't claim the welcome credits twice, and, for an account closed for cheating in the Talent Exam, so that it can't sign up again.

Your rights

Under the DPDP Act, you may:

• Ask what personal data we hold about you and your children.
• Have inaccurate data corrected — most of it you can edit yourself in the app.
• Ask us to erase data that we no longer need.
• Withdraw your consent, which means deleting the account. You can do this yourself at any time in the app or at skillstar.in/account/delete.
• Nominate someone to exercise these rights on your behalf if you are unable to.

To exercise any of these, email support@skillstar.in from your registered address. We respond within 30 days.

Security

• Passwords are stored hashed, never in readable form.
• Traffic between your device and our servers is encrypted in transit.
• Card details never touch our servers — payment happens on the gateway's own hosted checkout.
• Access to production data is limited to the people who need it.

No system is perfectly secure. If we ever suffer a personal data breach, we will notify you and the Data Protection Board of India as the DPDP Act requires.

Cookies and similar technology

We use browser storage to keep you signed in and to remember which child profile is active. Visits are counted without any cookie or stored identifier. We do not use advertising cookies, cross-site trackers or third-party analytics that profile users.

Changes to this policy

If we change this policy in a way that materially affects you, we will tell you by email before it takes effect. The date at the top of this page always shows the current version.

Grievances

For any privacy concern, contact our Grievance Officer, Rameez Hassan, at support@skillstar.in. We acknowledge within 48 hours and aim to resolve within one month. If you remain dissatisfied, you may complain to the Data Protection Board of India.