Privacy Policy

Effective Date: March 31, 2026 Last Updated: March 31, 2026

ISTA Foundation ("we", "us", or "our"), an NGO based in Durgapur, West Bengal, India, operates the ISTA Vidya app, ISTA Community app, and istafoundation.in (the "Services"). We are committed to protecting your privacy and particularly the privacy of children.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services.

1. Information We Collect

A. Information from Parents, Guardians, and General Users

For users of the ISTA Community app and adults managing accounts, we may collect personal information necessary to provide the Services, facilitate moderation, and community engagement. This includes:

Account Information: Name, email address (via Google Sign-In through Clerk authentication)
Profile Data: Display name, profile picture
Child Management Data: Child names, usernames, and linked account relationships
Device Information: Push notification tokens (Firebase Cloud Messaging)
Usage Data: App interaction patterns, feature usage, and activity timestamps

B. Information from Children (Under 16)

We take children's privacy seriously and comply with the Children's Online Privacy Protection Act (COPPA) and India's Digital Personal Data Protection Act (DPDPA). For users under the age of 16 utilizing the ISTA Vidya app, data collection is strictly limited and managed by the parent or guardian.

Data collected from children:

Account Credentials: Username and password (created by parent/guardian via the ISTA Community app)
First Name or Nickname (provided by parent)
Preferred Language (English, Bengali, or Hindi)
Educational Profile: Class/grade, school board, English proficiency level
Game Progress Data: XP (experience points), game scores, level progression, streak data
Speech Audio: Temporarily processed in-session for speech recognition in pronunciation games. Audio is NOT stored or transmitted to our servers — it is processed locally on-device.

Data NOT collected from children:

We do NOT collect photos, videos, or contact information from children
We do NOT serve advertisements to children
We do NOT share children's personal data with third parties for marketing purposes

All child account creation, password management, and data oversight are handled through the parent-facing ISTA Community app. Parents have full access to view, control, and delete their child's data at any time.

C. Device Permissions and Background Processing (ISTA Vidya)

To fully enable the parental controls provided by the ISTA Community app, the ISTA Vidya (Kids) app requires specific Android device permissions. These are strictly gated by explicit parent configuration:

Background Location: If a parent enables location tracking, the Vidya app requires ACCESS_BACKGROUND_LOCATION. This allows the parent to view the child's current location even when the app is closed or not in use. Location data is only accessible to the linked parent account. For real-time updates, the app may receive silent data pings via Firebase Cloud Messaging (FCM) to trigger high-accuracy location reports.
Battery Optimization: To ensure the reliability of background safety features (such as location tracking and app blocking), the app may request to be exempt from Android's battery optimizations. This allows the app to remain active and responsive to parental commands.
Usage Access: If a parent enables screen time limits or app blocking, the app requires PACKAGE_USAGE_STATS. This allows the app to monitor which apps the child opens and for how long, enforcing the parent's rules.
Installed App Queries: The app uses QUERY_ALL_PACKAGES to enumerate installed apps, allowing the parent to view and manage which apps are available on the child's device.
Display Over Other Apps (Overlay): Used in conjunction with Usage Access, this allows the app to draw a blocking screen over restricted apps when limits are reached.
VPN Service: If a parent enables web filtering, the app utilizes a local VPN service to route DNS requests through family-safe filters (e.g., Cloudflare Family). No browsing traffic is routed to our servers.

Prominent Disclosure: The ISTA Vidya app will explicitly prompt the child user with a full-screen disclosure explaining exactly why a permission is needed before triggering the Android system permission dialog.

D. Automatically Collected Information

We may automatically collect standard device information, IP addresses, log data, and usage patterns to maintain the security, performance, and basic functionality of our Services. This data is used solely for app functionality and is not shared with third parties for advertising or marketing.

2. How We Use Your Information

We use the collected information for the following purposes:

To provide, operate, and maintain our Services
To manage user accounts and parent-child linkages
To track educational progress and provide learning insights to parents
To facilitate community features in a safe, moderated environment
To monitor and enforce safety via AI and Human Agents
To send push notifications for child activity alerts (configurable by parents)
To improve, personalize, and expand our educational and community features

We do NOT use personal information for:

Targeted advertising
Selling data to third parties
Profiling children for commercial purposes

3. Third-Party Services

We utilize the following third-party service providers to facilitate our Services:

Authentication & User Management: Clerk (Google OAuth for parents)
Backend & Database Infrastructure: Convex (real-time database and serverless functions). Location and telemetry data are securely stored here.
Push Notifications: Firebase Cloud Messaging (FCM). Used for both visible alerts and silent data-only pings for real-time location refreshing.
Mapping Services: Google Maps Platform (used exclusively in the Community app for parents).
Payments: Google Play Billing (for subscription management in the Community app)
Speech Recognition: On-device processing only (no third-party speech APIs store audio)

These third parties have access to your personal information only to perform tasks on our behalf and are obligated not to disclose or use it for any unauthorized purpose. We do not share children's data with any third parties for advertising, analytics, or marketing purposes.

4. Parental Controls and Rights

Parents and guardians have the following rights regarding their children's data:

Access: View all data associated with their child's account via the ISTA Community app
Control: Manage app restrictions, blocked apps, and content access through parental controls
Modify: Update their child's name, password, and profile settings
Delete: Request complete deletion of their child's account and all associated data
Consent: Parental consent is obtained through the parent account creation and child linking process. Only authenticated parents can create child accounts.

To exercise any of these rights, parents can manage their child's account directly through the ISTA Community app or contact us at istafoundation.in@gmail.com.

5. Safety, Moderation, and Community

Data related to community interactions is actively monitored. We utilize a combination of AI tools and Human Agents to flag abusive behavior. We may use collected data to issue bans or take other appropriate measures to ensure platform safety. Children's interactions are fully accessible and moderated by the linked parent account via app blockers and supervision tools.

6. Data Retention and Account Deletion

We retain personal information only for as long as is necessary for the purposes set out in this Privacy Policy or as required by law.

Right to Deletion: Users have the right to request the deletion of their accounts and associated personal data. To request account deletion:

Parents can delete child accounts directly from the ISTA Community app
Parents can delete their own accounts by contacting us at istafoundation.in@gmail.com
Upon receiving a valid deletion request, we will securely terminate the account and remove the data within 30 days, subject to any legal obligations

7. Security of Your Information

We use administrative, technical, and physical security measures to protect your personal information, including:

Encrypted password storage for child accounts
Secure session-based authentication
HTTPS encryption for all data transmission
Secure cloud infrastructure (Convex, Firebase)

While we have taken reasonable steps to secure the personal information you provide to us, no security measures are perfectly secure, and we cannot guarantee absolute security.

8. International Data Transfers

Your information may be transferred to, and maintained on, technological infrastructure located outside of India where the data protection laws may differ from those in your jurisdiction. By using our Services, you consent to such transfers.

9. Children's Privacy Compliance

We comply with applicable children's privacy laws including:

COPPA (Children's Online Privacy Protection Act): We obtain verifiable parental consent before collecting personal information from children under 13
India DPDPA (Digital Personal Data Protection Act): We obtain parental consent for processing personal data of children under 18
Google Play Families Policy: Our apps designed for children comply with Google Play's Families Policy requirements

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. For material changes affecting children's data, we will provide prominent notice through the app.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: istafoundation.in@gmail.com
Website: istafoundation.in
Address: ISTA Foundation, Durgapur, West Bengal, India