Privacy Policy

Syllox ("we", "us", "our") operates https://syllox.in and the Syllox study-tracking application (the "Service"). Syllox is built and operated from India for students preparing for competitive exams such as NEET, JEE, and UPSC.

By using the Service you agree to the collection and use of information described in this Privacy Policy. If you do not agree, please do not use the Service.

Account information: your email (from Google sign-in OR from an email/password account you create), your display name, username, optional profile picture, optional bio, and optional exam track preference (e.g. NEET, JEE, UPSC). If you sign up with a password, we store only a one-way bcrypt hash of it — never the plaintext.

Syllabus & study activity: subjects and chapters you create, chapter completion status, your To-Do list items (which now persist until you manually reset them), and stopwatch sessions (duration, date, and the optional subject tag).

Streaks: a daily-consecutive-days counter derived purely from your study session activity; visible on your dashboard and public profile.

Mock test analytics & score prediction: mock test entries you log (test name, exam type, date, subject-wise scores, and total marks), and predicted scores computed from your performance trends. This data is private to you and is never shared with other users.

Reports: automatically computed summaries of your study time, chapters completed, mock test progression, and streak progress. Generated server-side from your own activity data.

Study Calendar (premium): a GitHub-style monthly heatmap derived from your existing study sessions with per-day totals, subjects touched, session counts, current & longest streak, and a weekly recap. No new data is captured — this is a read-only view over the study activity above.

AI doubt-solver content (Syllox AI): the text and any image you submit to Syllox AI, along with the AI's responses, stored only to maintain your conversation history. Trial and paid premium users receive identical AI access.

Achievements & badges: a permanent record of the badges you have unlocked across four categories (study hours, streak length, chapters completed, mock tests logged). 24 badges in total. We store the badge ID and the timestamp at which you earned it.

Leaderboards: your aggregated rank against other Syllox users on Weekly (Sunday → today, IST), Monthly (1st → today, IST), and All-Time windows. Ranking uses your total study time, current streak, and achievement count — all of which are already collected as part of your study activity above. You can opt out of being listed publicly from Settings; you will still see your own My Rank card.

Community feed (premium): public text posts, comments, and likes you create within the platform.

Friends system: friend requests sent or received, accepted friendships, and your visible friend count.

Private messaging (premium): 1-on-1 messages between you and an accepted friend. Stored to maintain chat history; visible only to you and the other participant.

Public profile: when other users view your profile (via @username), they see your name, username, avatar, bio, exam track, streak days, total study time, achievement count, friend count, and current leaderboard rank. They do not see your email or mock test data.

Premium & trial state: whether you are in the 30-day welcome trial, whether you received a Founder's Reward extension, whether you have a paid premium subscription, and the expiry date of either.

Payment information: handled entirely by Razorpay. We store only the Razorpay order ID, payment status, plan kind (monthly/yearly), and your premium expiry date — never your card number, UPI ID, or banking credentials.

Technical metadata: IP address (used solely for auth rate-limiting and abuse prevention), browser type, device type, and basic page/event analytics (see Section 5).

Authentication tokens: a JWT issued at login, stored in an HttpOnly Secure cookie AND mirrored in your browser's localStorage so the Service works correctly on iOS Safari and Android Chrome where third-party cookies are blocked.

Provide the core Service: create your account, save subjects/chapters/sessions/targets/mock tests, render dashboards, compute analytics, generate reports, surface achievement badges, rank you on weekly/monthly/all-time leaderboards, and deliver streak reminders and weekly recap emails.

Authenticate you: verify Google ID tokens, issue session JWTs, and protect against brute-force or replay attacks.

Run premium features for you: Syllox AI doubt-solver, community feed posting, 1-on-1 messaging, mock test analytics, score prediction, achievement progress tracking, full leaderboard visibility, daily targets, and custom themes.

Operate the 30-day welcome trial: automatically grant trial access to new accounts and downgrade trial access when the window expires.

Send transactional communications: streak reminders, unread message digests, weekly recap emails, and payment receipts. These are tied directly to product use and are not marketing.

Safety & abuse prevention: rate-limit auth attempts per IP, detect spam, log authentication failures for forensic review (anonymised), enforce community guidelines, and respond to violations.

Aggregate product analytics: understand which features help aspirants the most. Individually-identifying study data is never sold or shared with third parties.

You can sign in to Syllox in two ways: Google Sign-In OR Email + Password. Both are equally supported; you can also link both to the same account. Phone-number + OTP authentication was retired in Feb 2026 and is no longer available to new users.

Google Sign-In: We exchange Google's authorization code server-side, verify the ID token, and create or merge your account by email. We never receive or store your Google password. Google receives the standard OAuth scopes (profile + email).

Email + Password: When you sign up with a password, we validate it (minimum 8 characters), then hash it using bcrypt (an industry-standard slow, one-way hashing algorithm) before storing. We never see, log, or store your plaintext password. If a Google-linked account and a password-based signup share the same email, they are automatically linked to the same account — you can then sign in either way.

Password reset: If you forget your password, you can request a reset link at /forgot-password. We email a single-use, cryptographically-strong token to your registered address that expires in 30 minutes. The endpoint always returns the same generic success message (whether or not the email is registered) so an attacker cannot use it to discover which addresses have accounts. Reset requests are rate-limited per IP address to prevent abuse of our email quota.

Temporary account lockout (anti-brute-force): We track failed password attempts per (IP address + email) tuple. After 5 failed attempts within a 15-minute window the account is temporarily locked for that IP for 15 minutes and further attempts return an HTTP 429 error — even if the correct password is submitted. Successful login or a completed password reset immediately clears the counter. This protects you from credential-stuffing and dictionary attacks.

Session JWTs are issued on login and stored both in an HttpOnly Secure cookie (SameSite=None) AND in your browser's localStorage. The localStorage copy exists because some mobile browsers (iOS Safari, Android Chrome) block cross-site cookies, and without the Bearer-token fallback the Service would silently log you out. Both paths use the same signed JWT — your token never reaches third-party code.

Authorized Syllox staff/admin access: A small number of authorized administrators (identified by an is_admin flag on their user record) may access user records, payment history, community reports, and abuse logs strictly for the following purposes: providing user support, investigating community abuse reports, reconciling stuck payments, and complying with legal requests. Admins never receive your password (they can only see the bcrypt hash, which is not reversible) and cannot impersonate you into the app.

Deleting your account immediately invalidates every active JWT for that account, on every device, with no waiting period.

We share data only with the following processors, strictly to deliver the Service:

• Google OAuth — verifies your Google account on every login (Google receives the standard OAuth scopes: profile + email).

• Razorpay — processes premium subscription payments (your name, email, plan kind, and order amount).

• Resend — delivers transactional emails such as password-reset links, streak reminders, and weekly recaps (your email address and name only).

• MongoDB Atlas — stores all application data on managed cloud infrastructure located in India.

• Emergent LLM service (powering Syllox AI) — receives the doubt text and any image you submit, with only an anonymous session identifier. Your name or email are never sent.

• Google Analytics (GA4) — receives anonymous page-view and event metrics (e.g. "subject_added", "premium_purchased", "badge_unlocked") to help us understand product usage. Individual study content, mock test scores, AI prompts, messages, and achievement history are NEVER sent to GA4.

We do NOT sell your personal data. We do NOT share your study performance, mock test scores, predicted scores, AI conversations, messages, or achievement details with coaching institutes, parents, advertisers, or any other third party.

Syllox AI: When you submit a doubt, the text (and any image) is sent to our LLM provider via a server-side proxy. We don't include your real name, email, or phone in the request — only an anonymous session ID. Your conversation history is stored to your account so you can revisit it later.

Syllox AI is an educational aid. It can make mistakes, hallucinate facts, or give outdated answers. Always cross-verify important information with NCERT or your teacher.

Mock test analytics: When you log a mock test, we compute subject-wise performance, percentile-style insights, and trend lines. Calculations run on our servers and are visible only to you.

Score prediction: Predicted scores are derived from your own performance trend. They are estimates, not guarantees of any future exam outcome.

Friend requests: When you send or receive a friend request, both parties see the other's username, display name, avatar, and tier badge (Free, Trial, or Premium). Either party may cancel, decline, or unfriend at any time from Settings.

Private messaging: Once two users are friends, they can exchange direct messages. Messages are stored on our servers so chat history syncs across devices. Read receipts are computed server-side. Messages are visible only to the two participants and to Syllox staff in the event of a documented abuse investigation.

Community feed: Posts and comments are text-only and visible to all premium users (trial users included). Likes are counted publicly. Do not share personal contact details, paid coaching material, or private mock test answer keys.

Moderation: We may review, moderate, and remove any user-generated post or comment on the community feed when we believe it violates our Terms, community guidelines, or applicable law, or when we receive credible abuse reports. Authorized Syllox administrators can delete offending posts and comments directly from the feed, with or without prior notice, and may suspend accounts for repeated violations. Report concerns to contact@syllox.in.

30-day welcome trial: Every new account automatically receives 30 days of full premium access. The trial begins on signup and expires automatically — no card or payment is required. Once it expires, you continue using the free tier with the option to upgrade.

Founder's Reward: Accounts created before the campaign cutoff received an additional +20 days of premium access, applied automatically on top of the welcome trial. This was a one-time grant and is reflected in your premium expiry date.

Premium subscription: Paid monthly (₹49) or yearly (₹299) via Razorpay in Indian Rupees. Your subscription begins immediately on successful payment. We store the Razorpay order ID, payment status, plan kind, and expiry date — never your card or UPI details.

Premium does not auto-renew. When your paid period ends, your account reverts to the free tier with no further charges.

Premium feature scope may evolve. We may add, remove, or rebundle paid features and will announce material changes at least 14 days in advance.

Account data is retained as long as your account is active. You can permanently delete your account at any time from Settings → Danger Zone. Deletion is immediate, irreversible, and removes ALL of the following: your user profile; subjects, chapters, study sessions, targets, and mock tests; achievements and badge history; community posts and comments; friend requests, friendships, and messages (in both directions); AI conversations and usage counters; profile picture; trial and premium state.

Once deleted, your account cannot log in again and your username/handle does not appear in search results, the community feed, friends lists, leaderboards, or anywhere else.

Admin-initiated account deletion: In addition to self-serve deletion, authorized Syllox administrators may permanently delete an account from the Admin Panel when we believe you have violated our Terms, community guidelines, or applicable law, or when we receive credible abuse reports. Admin-initiated deletion runs the exact same cascade as self-serve deletion — every collection listed above is wiped for that user, and no other user's account or data is affected. Admin accounts themselves are protected and cannot be deleted from the Admin Panel.

A small audit record (your former user ID, masked email, plan history, and deletion timestamp) is retained for compliance review for a limited period. No personal content is preserved.

Payment records are retained on our transaction ledger only until you delete your account, at which point Razorpay order and payment references are removed. Razorpay itself retains its own transaction records under Indian tax and accounting law (typically 7 years) — those are outside our control.

Authentication failure logs (no token contents, only metadata) are auto-expired after 1 hour for security debugging. Password-reset tokens are auto-expired 30 minutes after issue and permanently invalidated once used.

You can: (a) view and update your profile from the Settings page, (b) export a copy of your study data on request, (c) permanently delete your account from Settings → Danger Zone, (d) opt out of streak-reminder, recap, and unread-message emails from Settings, (e) request that we restrict or correct any personal data we hold.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), Indian users have additional rights including the right to grievance redressal. Email contact@syllox.in from your registered address and we will respond within 24 hours.

All data is transmitted over HTTPS (TLS 1.2+). Session JWTs are signed with HS256 and validated on every request. Google OAuth tokens are exchanged server-side; we never receive or store your Google password. Passwords for email-based accounts are stored only as one-way bcrypt hashes — we cannot recover them and cannot see what you originally typed. Study session saves are protected by a client-generated idempotency key so a duplicate submission cannot inflate leaderboard time, streak, badges, or reports. Razorpay payment activations are protected by a server-to-server webhook with HMAC-SHA256 signature verification so successful payments are honoured even if the browser closes mid-checkout.

Database credentials, third-party API keys, JWT secrets, and admin credentials live in restricted environment variables, never in our codebase or in any user-visible surface.

Despite our best efforts, no system is 100% secure. If you become aware of a vulnerability or suspect that your account has been compromised, please email contact@syllox.in immediately.

Syllox is intended for users aged 13 and above. If you are under 18, you must have a parent's or guardian's permission to use the Service and to make any premium purchases.

We do not require a government ID, a school ID, or proof of age. We do not collect your address.

The community feed and 1-on-1 messaging are user-generated and lightly moderated. Harassment, doxxing, spam, sexual content, and sharing of paid coaching material are prohibited and will result in account suspension.

We may update this Privacy Policy from time to time as the Service evolves. Material changes will be announced via in-app notification or email at least 7 days before they take effect. The "Last updated" date at the top of this page reflects the most recent version.

Questions, deletion requests, data-export requests, or grievances? Email contact@syllox.in. We respond within 24 hours.