Privacy Policy

Unwrong (https://app.unwrong.in) is a study aid for NEET-PG, FMGE and INI-CET aspirants. You log MCQ mistakes by voice, text or screenshot, and Unwrong helps you revise them. It is run by Cellsphere (Udyam-registered micro enterprise), Mayiladuthurai, Tamil Nadu, India (“we”). We follow India's Digital Personal Data Protection Act, 2023. This page says what we collect, why, who else sees it, and what you can do.

What we collect, and why

• Account: your email address and password (stored only as a scrambled hash), or the name and email from your Google account if you use Google sign-in. To let you sign in and to contact you about your account.
• Your name (what you tell us to call you), your reminder time and time zone. To greet you and to work out when your day starts.
• Your mistake log: the notes you type, the voice notes you record, and the screenshots you attach, with the subject, mistake type and test type you choose. This is the core of the service.
• What the AI writes from it: text of your voice note, the text read from screenshots, a one-line fact and recall cue, a numeric “meaning fingerprint” used to spot repeats, revision questions, and your revision history (which cards you got right or wrong, and when).
• Usage records: which AI calls were made for your account and their size (so we can control cost and enforce daily limits); your agreement to these terms (date and version); your acknowledgement of the voice and screenshot notice; any “This looks wrong” flags you send, and the bug reports and feedback you write to us from Settings. A bug report also includes the page you were on, the app version and your device and browser type, so we can find the problem.
• Technical data: sign-in attempt counters, kept as scrambled codes, not your email or address, and deleted after a day. Our hosting providers also keep ordinary server logs (such as IP address and time).

We do not use advertising or analytics trackers, and we do not sell your data. The cookies we set keep you signed in and complete sign-in steps. Your phone also stores a copy of unsent entries and your last-used subject so the app works offline.

Who else receives your data

• Supabase: our database, sign-in service and file storage. Your data is stored in its Mumbai (India) region.
• Vercel: hosts the website and runs our server code (set to Mumbai); requests pass through its network.
• OpenAI: receives your typed notes, voice recordings, screenshots, the one-line fact, and the subject name, to turn voice into text, read screenshots, write the fact and recall cue, make revision questions and compare repeated mistakes. Text inside a screenshot is treated as information, not as instructions. OpenAI's handling of this data is governed by OpenAI's privacy policy and terms.
• Google: only if you choose “Continue with Google”.
• Resend: used to send account emails (sign-up confirmation and password reset). It receives your email address and the content of those emails.
• Telegram: when you send a bug report or feedback from Settings, a copy of your message (with a short account code and, for bug reports, the page, app version and device type) is sent to our private Telegram chat so we can see it quickly. Your email address and name are not included.
• Have I Been Pwned: when you choose a password, the first 5 characters of a scrambled version of it are checked against a list of breached passwords. Your password and email are never sent.

These providers process data for us and may handle it outside India. We share data otherwise only if the law requires it.

Consent

We ask you to agree to the Terms and this Policy when you sign up, and to acknowledge, before your first voice note or screenshot, that audio and images are sent to an AI service and kept in your account. You can withdraw consent at any time by deleting your account.

How long we keep it

Until you delete it. Your log is kept so you can revise it. When you delete your account (Settings, “Delete my account”) we permanently remove your account, entries, corrections, revision history, usage records, bug reports and feedback you sent, and all your voice notes and screenshots. Bug reports and feedback are kept until then. After you delete your account, our hosting providers may keep backups and logs for a limited period before they are removed.

Your rights

• Access and a copy: Settings, “Download my data” (JSON file and a spreadsheet of your entries; up to 3 a day).
• Correction: you can correct the AI's reading and any voice transcript in the app. Corrections are added next to the original, which is kept as part of your record. For anything else (such as your name or email), write to us.
• Erasure: Settings, “Delete my account”. It is permanent.
• Grievances: write to support@unwrong.in. We reply within 7 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Children

Unwrong is for people aged 18 and over. It is not meant for children, and we do not knowingly collect their data. If you think a child has signed up, tell us and we will delete the account.

Security

Files are in private storage, and each person can only see their own data. We limit sign-in attempts and use HTTPS. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Changes

If we change this Policy in a way that matters, we will update the date above and ask you to agree again.