Privacy Policy
Effective date: 5 October 2026 · Version 2026-10-05.2
This Privacy Policy explains what information MangoMindz collects, why, who processes it, how long we keep it and the choices and rights you have. It covers our website (mangomindz.com) and our free learning app for Classes 1–5. It is written for parents: you create the account, and your child uses the app under your supervision. It is our notice under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025.
1. Who we are
MangoMindz is the "Data Fiduciary" for the personal data described here: we decide why and how it is used.
MangoMindz is an independent product and is not affiliated with, endorsed by or connected to NCERT or any school board.
Contact for privacy questions and complaints: support@mangomindz.com (details of our Grievance Officer are in section 13).
2. Children's data: our promises
MangoMindz is made for children aged about 6 to 11. The DPDP Act sets extra rules for children's data, and we follow them:
- Parental consent first: only an adult (18 or older) who is the parent or legal guardian can create an account. We record the date, the policy version and your confirmation, and we do not process a child's data until that consent is stored.
- No tracking of children: when a child profile is in use, or any parent is signed in, we send no analytics and no session recordings to any third party. Inside the app we only keep your child's own progress and activity in our own database so you can see it.
- No advertising: MangoMindz shows no ads, contains no advertising software and builds no advertising profiles. Children's data is never used for targeted advertising. To see whether our own ads on Facebook and Instagram bring parents to our website, we use the Meta Pixel on our public web pages only, only for visitors who are not signed in and who allow "Ad measurement" in the cookie notice (section 7). It never runs inside the app.
- Minimum data: a child profile is a first name or nickname and a class. We do not ask for a surname, date of birth, school, address or phone number.
- No AI training: we do not use your family's data to train AI models, and we use AI providers that process requests to answer them.
- Your family only: database rules ensure that in the app only you can see and change your family's data. Our service providers (section 5) process it only to run MangoMindz for you.
3. What we collect, why, and for how long
| Information | Why we use it | How long we keep it |
|---|---|---|
| Parent email address and name (from Google Sign-In) | Sign-in, your account, account emails and replies to support requests. | While your account exists. |
| Consent record (date, policy version, "18 or older" confirmation) | Proof that a parent agreed, as the DPDP Act requires. | While your account exists. |
| Parent PIN (stored only as a one-way hash) | A child-proofing lock on the parent area: it is checked on your device and is not a password for your account. | While your account exists. |
| Child first name or nickname, and class (1–5) | Shows the right lessons and greets your child. | Until you remove the child or delete the account. |
| Optional avatar: a picture from our set, or a photo you upload | Profile picture in the app. | Until you change it, remove the child or delete the account. |
| Learning progress: lessons opened and where your child stopped, points, streaks, daily minutes, topic accuracy, missions | Lessons, revision, the parent dashboard and the time limit. | Until you remove the child or delete the account. |
| Quiz answers (question, answer chosen, correct or not) | Progress by topic and avoiding repeated questions. | Until you remove the child or delete the account. |
| Parental controls (time limit, bedtime lock, daily learning time, the optional 7-day maths challenge and its start date) | Applying the limits you set and building the weekly plan on the parent dashboard. | Until you remove the child or delete the account. |
| Activity events in our own database (screens opened, lesson and quiz started or finished, sign-in and sign-out), linked to your account and child profile | Understanding which features work so we can improve them. Never sent to analytics companies. | 90 days, then deleted automatically. |
| Today's plan for each child | The personalised "Today's plan" card. | 3 days. |
| Daily usage counters (tutor questions and homework checks used today) | Daily fair-use limits. | 3 days. |
| AI usage records (date, feature, subject, class, account id, model, size of the request) | Managing daily limits and costs. | 90 days. |
| Tutor answer reports (the reply, the question before it, subject) | Checking and fixing wrong or unsuitable answers your child reported. | 90 days. |
| Questions typed to Mango, the in-app tutor | Sent to our AI provider to get an answer. | Not stored on our servers. Kept on your device for today and yesterday only (section 7). |
| Voice questions, only when your child taps the microphone in Mango Tutor | Your phone's own speech service turns the spoken question into text; the text is then handled like a typed question. | We never receive or store the audio, only the text. |
| Homework photos your child chooses to send to the homework checker | Sent to our AI provider to read the question and give feedback. | Not stored by us. |
Please make sure homework photos do not show your child's face, full name or school. The app reminds your child of this next to the camera button.
4. How we use information
- Create and manage your family account and child profiles.
- Show lessons and quizzes for your child's class and remember what they have practised.
- Answer your child's tutor questions and check homework photos.
- Show you, the parent, progress and accuracy by topic on the parent dashboard.
- Apply the time limit, bedtime lock and reminders you set.
- Send account emails (for example a welcome email) and reply to your support requests.
- Keep the service safe and working: fix errors, prevent misuse and understand which features are used.
- Count visits to our public web pages (only with your permission, see section 7).
- Measure whether our Facebook and Instagram ads bring visitors to our public web pages (only with your permission, see section 7).
- Count how many new accounts come from each of our tagged ad links, as an anonymous daily number per campaign that is not linked to any account.
We do not sell personal data, and we do not use your family's data for advertising or profiling.
5. Who processes your data
We use the following service providers ("Data Processors") to run MangoMindz. Each receives only what it needs for its job and may use it only to provide its service to us:
| Provider | Purpose | Data involved |
|---|---|---|
| Google Firebase (Google LLC): Authentication, Firestore database, Storage, Cloud Messaging | Sign-in, storing family accounts, child profiles, progress and optional avatar photos; delivering reminders. | Parent email and name, child profile, learning data, avatar photos. |
| Meta Pixel (Meta Platforms Ireland Ltd / Meta Platforms, Inc.) | Measuring visits from our Facebook and Instagram ads on our public web pages, only for visitors who are not signed in and who allow "Ad measurement" in the cookie notice. Never used inside the app or for children. | Pages viewed, the ad that brought the visitor, device and browser type and the IP address, sent by the Pixel to Meta, which processes it under its own terms. We send no name, email, account or child data and do not use advanced matching. |
| Google Analytics 4 (Google LLC) | Counting visits to our public web pages, only for visitors who are not signed in and who press Accept in the cookie notice. Never used inside the app or for children. | Pages viewed, device and browser type, approximate location from the IP address. No account or child identifiers. Google signals and ad personalisation are switched off. |
| OpenRouter, and the AI model providers it routes requests to (currently DeepSeek and Qwen models) | Generating lessons, quizzes and today's plan; answering tutor questions; reading homework photos. | The learning request (class, subject, unit), the question typed and recent chat turns (with your child's name removed), names of topics to revise, homework photos. Never your email or account identifier. |
| OpenAI | Backup for the AI features above and a backup read-aloud voice, used only if we switch the backup on. | Same as the row above, or the text being read aloud. |
| Microsoft Edge read-aloud voice service | Read-aloud voice for lessons and tutor replies. | The lesson or reply text being read. No personal data. |
| Your browser's speech service (Google on Android phones and Chrome; Apple on iPhone, iPad and Safari) | Turning a voice question into text when your child taps the microphone in Mango Tutor. It is part of the phone or browser, under its maker's own privacy terms. | The spoken question (audio). MangoMindz receives only the resulting text. Your child can always type instead. |
| Resend | Sending account emails such as the welcome email. | Parent email address and name. |
| Sentry | Error reports so we can fix crashes. No session recordings. | Technical error details, browser and page address. No name, email or account identifier. |
| Render | Hosting the app server. | Standard server logs (IP address, request time, page). |
| Cloudflare (including the cdnjs service for emoji pictures) and Google Fonts | Delivering the website, emoji pictures and fonts. | IP address and browser details, as for any web request. |
Where data is processed: our app server runs in Singapore (Render). Sign-in, the database and file storage run on Google Cloud (Firebase). Our AI, error-reporting, email, analytics and ad-measurement (Meta) providers process data mainly in the United States and, for Meta, also in Ireland. Some providers may process data in other countries. Transfers outside India follow section 16 of the DPDP Act, and we will stop any transfer to a country the Government of India restricts.
We may also disclose information if the law requires it, for example to comply with a valid order of a court or government authority.
6. How lessons are prepared, and child safety
- How lessons are prepared: our team writes every unit plan to NCERT learning outcomes. MangoMindz then uses AI tools to help turn those plans into lessons, quizzes, daily plans and Mango’s replies, and automatic checks review each lesson before your child sees it. Like any learning resource, an answer may occasionally be wrong; if you notice one, use "Report this answer" or write to us and we will correct it.
- Tutor safeguards: Mango is instructed never to ask for personal details, replies are filtered for unsuitable content, and there are daily limits. The tutor screen tells your child that Mango is an AI helper that can make mistakes.
- Report an answer: each tutor reply has a "Report this answer" button. A report stores that reply and the question before it so we can review and fix it (kept 90 days). You can also email us.
- Homework checker: photos go to our AI provider only to read the question and are not stored by us.
8. Security and breach notification
We protect your data with reasonable security safeguards, including database rules that limit every parent to their own family's data, encrypted connections (HTTPS with HSTS), a strict content security policy and access to production data only for the people who run MangoMindz. The parent PIN keeps children out of the parent area on a shared device; it is not an account password, and your Google account is what protects your data.
If a personal data breach happens, we will inform each affected parent without delay, explaining what happened, the likely impact and what we are doing about it, and we will report it to the Data Protection Board of India as the DPDP Act and Rules require.
9. How long we keep data
- Account, child profiles and progress: while your account exists. If an account is not used for a long time we may ask whether you still want it before deleting it.
- Activity events, AI usage records and tutor answer reports: 90 days. Today's plans and usage counters: 3 days.
- Error reports (Sentry): up to 90 days. Website visit statistics (Google Analytics, public pages only): event-level data for 2 months.
- Server logs: kept by our hosting provider for a short period.
- After you delete a child or your account: removed from our live database straight away, and from any backup copy within 30 days.
10. Download or delete your data in the app
You can do these yourself, without emailing us:
- Download my data: Parents › Security & Account › Download my data. You get a JSON file with your account and consent record, each child profile, progress, lesson bookmarks, mastery, quiz answers, missions, parental controls, activity events, today's plans, usage counters, AI usage records and tutor answer reports. Tutor conversations and homework photos are not included because we do not store them.
- Remove one child: open that child's settings on the parent dashboard and choose Remove. The profile, progress, quiz answers, missions, activity events, reports and photo are deleted straight away.
- Delete account: Parents › Security & Account › Delete account. This removes your parent account, every child profile, all progress, quiz answers, activity events, AI usage records, reports and uploaded photos, and clears MangoMindz data stored on that device.
If you cannot sign in, email support@mangomindz.com from your account's email address and we will do it for you.
11. Your rights under the DPDP Act, 2023
As the parent (the "Data Principal", acting for your child), you have the right to:
- Access: a summary of the personal data we hold and how it is used, and the list of processors in section 5 (use "Download my data").
- Correction and completion: change a child's name or class in the app, or ask us to correct anything else.
- Erasure: remove a child or delete the account as described in section 10.
- Withdraw consent: at any time. You can turn off reminders or remove a child in the parent dashboard, replace an uploaded photo with a picture from our set on the child's profile screen (the photo is then deleted), or withdraw all consent by deleting your account. Withdrawing consent does not affect processing that happened before it.
- Grievance redressal: complain to our Grievance Officer (section 13). We acknowledge within 24 hours and resolve within 15 days.
- Nominate: name someone to exercise these rights if you die or become unable to. Email support@mangomindz.com from your account's email address with the nominee's name and email address.
- Complain to the Board: if our answer does not resolve your complaint, you may complain to the Data Protection Board of India through its online portal.
12. Changes to this policy
When we change this policy we update the effective date and version at the top. If a change matters for how we use your data, the app will ask you to read and agree again before you can continue.
13. Operator and Grievance Officer
For any complaint about MangoMindz, your data or content on the service, write to our Grievance Officer:
- Grievance email: support@mangomindz.com
We acknowledge every complaint within 24 hours and resolve it within 15 days of receipt, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023, through its official online portal.
14. Contact us
Questions about this Privacy Policy, or want to exercise your rights? Write to us:
Email: support@mangomindz.com