Privacy Policy
Last updated: 17 August 2026
Brainheaters is a study platform for engineering students. To run it we have to know a few things about you: who you are, what you are studying, and what you have been reading. This page sets out exactly what we collect, what we do with it, who else gets to see it, and how you can get it back or get rid of it.
It covers our website and our iOS and Android apps, which we refer to together as the Service. It applies to everyone who uses the Service, whether you pay us or not.
If something here is unclear, or you think we have got something wrong, write to support@brainheaters.in and a person will answer you.
1. Who we are
Brainheaters operates this Service and decides how the data described below is used. In data protection terms that makes us the data controller. We are based in India, and questions about anything on this page should go to support@brainheaters.in.
2. What we collect
There are three ways data reaches us. You give it to us when you sign up and fill in your profile. It gets created as you use the Service, for example when you open a material or finish a chapter. And a small amount arrives automatically from your browser or phone, the way it does on any website.
Account details
Your name and email address. If you sign up with a password, we store a salted hash of it rather than the password itself, so nobody at Brainheaters can read it. If you sign in with Google or Apple instead, we receive your name, email address and profile picture from them, and no password ever reaches us.
Academic profile
Your university, college, department, academic year and current semester. This is what decides which subjects and materials appear on your dashboard. Without it we would have to show you everything for every course, which would make the Service close to useless.
Learning activity
Which materials you have opened, what you have bookmarked, how far through a subject you are, how long you have spent studying, and your streak history. Also the things you post: forum questions and answers, chat messages, ratings, reviews, and any requests you send us.
Purchase records
If you buy a plan, we keep a record of which plan, how much, when, and a reference number from the payment provider. That is the whole of it.
We never see your card number, your UPI ID, your CVV or your bank details. Those go straight from you to Razorpay on the web, or to Apple and Google for purchases made inside our apps. Those companies are certified to handle payment credentials; we are not, and we have deliberately built it so that we never have to be.
Technical and device data
Your IP address, browser and device type, operating system, the approximate region your IP resolves to, session identifiers, and error logs when something breaks. This is ordinary server telemetry. We use it to keep the Service running, to work out why a bug happened, and to spot abuse such as one account being used by twenty people at once.
Push notification tokens
If you allow notifications, your browser or phone issues a token that lets us send you one. We store that token and nothing else. Revoking the permission in your device settings makes the token useless.
What we do not want. We do not ask for health information, government ID numbers, bank account details, biometric data, caste, religion or political affiliation, and we would rather you did not send them to us. If you do, in a forum post or a support email, we will delete it.
3. What we use it for
Every use we make of your data falls into one of these buckets:
- Running your account. Creating it, signing you in, keeping your session alive across devices, and letting you reset a password.
- Showing you the right material. Your academic profile filters what appears in the library, in search and on your dashboard.
- Tracking your progress. Bookmarks, completion state, study time, streaks and the charts on your dashboard all come from your own activity data.
- Processing purchases. Confirming a payment succeeded, unlocking what you bought, and making sure it stays unlocked for as long as you have paid for.
- Running the AI features. Only when you choose to use them. Section 5 explains this in detail.
- Sending you messages. One-time passwords, receipts, and security alerts get sent because they are part of the Service. Product updates and offers get sent only if you asked for them, and every one of those has an unsubscribe link.
- Stopping abuse. Detecting shared accounts, bulk scraping, payment fraud and attempts to redistribute paid material, and enforcing our Terms of Use.
- Improving the Service. Working out which features get used, which pages are slow, and where people get stuck. This is done in aggregate, not by reading individual accounts.
- Meeting legal obligations. Mainly tax and accounting rules that require us to keep transaction records.
We do not use your data to build a profile of you for anyone else, and we do not sell it. Section 8 covers who does get to see it.
4. Why we are allowed to use it
Depending on what we are doing, one of four things gives us the right to do it:
- Performing our contract with you. We cannot run your account or deliver material you have paid for without processing your data.
- Your consent. For push notifications, marketing emails, optional AI features and non-essential cookies. You can withdraw consent at any time, and withdrawing it does not affect anything we did while it was still given.
- Our legitimate interests. Keeping the Service secure, preventing fraud, and understanding usage so we can improve it. We only rely on this where our interest does not override your rights.
- Legal obligation. Retaining financial records, and responding to lawful requests from authorities.
5. The AI features
Some parts of the Service use AI models to answer questions, explain a concept or summarise a passage. These features only run when you trigger them. Nothing is sent to an AI provider in the background.
When you do trigger one, the text you typed goes to a third-party AI provider, along with the material context needed to make the answer relevant. Your name, email address and payment history are not sent. We send the minimum needed to produce the answer.
Two things worth being blunt about. First, do not paste personal or confidential information into these features, because it leaves our systems. Second, the answers are generated by a model and can be wrong, out of date, or confidently incorrect. Treat them as a study aid and check anything important against your syllabus, your textbook or your faculty.
7. Advertising
Parts of the Service may be supported by advertising, including formats where watching an ad gives you temporary access to a material. Where ads are shown, third-party vendors including Google use cookies, web beacons, device identifiers and IP addresses to serve those ads and measure whether they worked.
The disclosures we are required to make, plainly:
- Third parties, including Google, may place and read cookies on your browser, or use web beacons or your IP address to collect information, as a result of ad serving on this site.
- Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
- You can turn off personalised advertising from Google in Google Ads Settings.
- You can opt out of a longer list of third-party vendors at aboutads.info/choices.
- Google’s own explanation of what it does with data from sites like ours is at How Google uses information from sites or apps that use our services.
We do not run advertising targeted at sensitive categories such as health, finances, religion or sexual orientation, we do not use interest-based advertising to target anyone under 13, and we do not pass personally identifiable information to advertising vendors.
9. Data leaving India
Several of the providers above run infrastructure outside India, so your data may be stored or processed abroad. Where that happens we rely on contractual terms with those providers that require them to protect your data to a standard consistent with this policy, and to process it only on our instructions.
10. How long we keep it
Your account and learning data stays with us for as long as your account is open. Nothing here is kept indefinitely just in case.
- If you delete your account: we delete or irreversibly anonymise your personal data in the live system straight away, and encrypted backups are purged on their normal rotation cycle within 30 days.
- Transaction records: retained for the period Indian tax and accounting law requires, because we do not have a choice about that.
- Server and security logs: kept for a short window and then deleted automatically.
- Aggregate analytics: kept indefinitely, but they contain no identifiers and cannot be traced back to you.
11. How we protect it
Traffic between you and us is encrypted with TLS. Passwords are stored as salted hashes, never in readable form. Access to production data is limited to the people who need it to do their job. Payment credentials never touch our servers at all, which removes the single largest category of risk.
None of that makes any system perfect, and we would rather say so than pretend otherwise. Use a strong password you have not used elsewhere, do not share one-time passwords with anyone who asks for them, and tell us at support@brainheaters.in the moment you suspect someone else is in your account. If a breach ever occurs that puts your data at real risk, we will tell you and the relevant authority without delay.
12. Your rights
You can ask us to do any of the following:
- send you a copy of the personal data we hold about you;
- correct anything that is wrong or out of date;
- delete your account and the data attached to it;
- stop sending you marketing messages or push notifications;
- withdraw a consent you gave us earlier;
- restrict or object to a particular use of your data.
Most of this you can do yourself from your profile settings without asking anyone. For the rest, the practical instructions are on Your Data & Account Deletion, or you can email support@brainheaters.in. We reply within 30 days and we do not charge for it. We may ask you to confirm your identity first, which is there to stop somebody else requesting your data.
If you are not happy with how we handled a request, tell us and we will escalate it internally. You also have the right to complain to your data protection authority.
13. Children
The Service is built for university students and is not directed at children under 13. We do not knowingly collect personal data from anyone under 13, and we do not use interest-based advertising to target children or to target activity on any part of the Service aimed at children. If you are a parent or guardian and you believe a child has given us data, email support@brainheaters.in and we will delete the account and its data.
14. Changes to this policy
The Service changes, and this policy will change with it. The revision date at the top always tells you which version you are reading. Minor edits, such as clarifying wording, go up without notice. If a change materially affects your rights or how we use your data, we will tell you in the app or by email before it takes effect, so you have time to decide what you want to do.
15. Contact us
Questions, requests and complaints about privacy all go to the same place: support@brainheaters.in. Put the topic in the subject line and we will get it to the right person.
Related pages: Terms of Use and Your Data & Account Deletion.