ToolsPrivacy notice
Privacy notice
What the Hovarns account and the four tools collect, why, how long we keep it, and how to export or delete it. Written for the Digital Personal Data Protection Act, 2023.
Draft — needs legal review. This text has not yet been checked by a lawyer and may change. Parts in [brackets] are still to be filled in. Until a grievance e-mail address and officer are named, contact us by phone on +91 99437 08347.
Who we are
The tools at hovarns.sbsngl.org — Hovarn Meet, Hovarn Chat, Hovarn Classic and Hovarn Examy, and the Hovarns account you use to sign in to them — are run by Hovarns [legal name of the entity, registered address]. For these services we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
This notice explains what personal data we process, why, for how long, who else is involved and how you can use your rights. It covers the tools and the account only, not the websites of coaching centres or other organisations that use Hovarns software for their own students.
The short version
- You sign in with Google. We keep your name, e-mail address, Google account id and a small copy of your profile photo.
- We keep what you create in the tools: messages, files, tests and answers, and room names.
- We use one essential sign-in cookie. No advertising, no analytics cookies, no selling or sharing of data for marketing.
- We do not store your IP address. Abuse limits use a one-way keyed hash of it that cannot be turned back into the address.
- You can download your data or delete your account from your account page at any time.
- Under 18? You need a parent’s or guardian’s consent.
What we collect and why
| Data | Why | Kept for |
|---|---|---|
| From Google when you sign in: name, e-mail address (verified by Google), Google account id (“sub”), profile photo (we keep a small 96 px copy) | To create your account, recognise you next time, and show your name and photo to people you interact with in the tools | Until you delete your account |
| Your answers at sign-up: age group (18+ or under 18 with guardian consent), the date you accepted these terms and this notice | To meet the DPDP Act’s rules for children and to record your consent | Until you delete your account |
| Session: a random sign-in cookie (stored on our side only as a hash), when the session started and was last used | To keep you signed in across the tools | At most 30 days; ends when you sign out |
| Which tools you opened and when (last use only), your preference to continue to your last app | To list your apps with the most recent first | Until you delete your account |
| Security records: a keyed hash of your network address with a request count; an audit log of sign-ins, exports and deletions that identifies the account only by a keyed hash | To stop abuse (rate limits) and to investigate security incidents | Rate counters: minutes to hours. Audit log: 180 days |
| Tool content (see below) | To provide the tool you use | Until you delete it or your account |
We do not ask for, and you should not upload, sensitive information you do not need to share (for example health or financial details).
Hovarn Meet
We store the room’s name and code, the account that created it, and when it was created and last used. Your display name in a call comes from your account.
The audio, video, screen sharing and in-call chat are handled by Jitsi, operated by 8x8, on meet.jit.si (or, if switched on later, Jitsi as a Service by 8x8). They pass through 8x8’s servers, not Hovarns, and 8x8’s own privacy policy applies to them. Jitsi may ask the first person in a room to sign in with a third-party account; that sign-in is between you and Jitsi.
Recordings are made by your own browser and saved on your own device. Hovarns never receives them. If you record, you must tell everyone in the call first.
Hovarn Chat
We store your messages, edits, attachments (images and PDF files up to 5 MB), the chats and groups you are in, invite links, when each message was delivered and read, the people you block and the reports you make. “Typing…” signals are kept for a few seconds only.
Chat is not end-to-end encrypted: messages are protected in transit (HTTPS) and stored on our server, where they could be accessed by Hovarns staff only to investigate a report or a legal request. Attachments are stored outside the public website and can only be downloaded by members of that chat.
When you delete a message, its text and attachment are removed. When you delete your account, your messages are removed from every chat and show as “deleted” to the others.
Hovarn Classic
We store the files you create or upload, their names, types, sizes and when they changed, up to 200 MB per account. Files are checked by type, stored outside the public website, and can only be opened by your account. The editors run in your browser and load code libraries from public CDNs (see “Who else is involved”).
Hovarn Examy
For test creators we store the tests, questions, answer keys, settings and share links. For test takers we store your answers, timings, score and, only when the creator turned proctoring on, a log of events such as “left full screen”, “switched tab” or “tried to copy”, with times.
The creator of a test sees the name and e-mail address of each person who took it, their answers, scores and the event log. You see your own result.
Camera and screen share stay on your device. If a test asks for them, they are shown to you as a self-view only. No images, video or screenshots are sent to Hovarns or to the test’s creator. Every proctoring option is shown to you before you start, and you can choose not to take the test.
Questions taken from the public question bank are openly licensed or from official past papers; their source is credited with each question.
Our legal basis
We process your personal data on the basis of your consent (section 6 of the DPDP Act), which you give when you create your account, and for the legitimate uses the Act allows, such as keeping the service secure and complying with the law. You can withdraw consent at any time by deleting your account; this does not affect processing that already happened.
Children (under 18)
Hovarn Chat and Hovarn Examy may be used by students under 18. The DPDP Act requires verifiable consent of a parent or lawful guardian before we process a child’s personal data.
- When an account is created we ask for an age declaration. Someone under 18 must confirm that a parent or guardian has read this notice and agrees.
- [Method for verifiable guardian consent to be decided with legal review — for example a guardian confirming by phone or by their own signed-in account.]
- We do not track children’s behaviour, profile them or show them targeted advertising. Proctoring for children works the same way as for adults: camera and screen stay on the device.
- A parent or guardian can ask us to export or delete a child’s data by calling +91 99437 08347.
Who else is involved
- Google — sign-in (“Sign in with Google”). Google’s privacy policy applies to your Google account.
- Hostinger — hosts our server and database [data centre region]. Hostinger’s network passes your IP address to our server, which uses it only as described above.
- 8x8 (Jitsi) — audio and video for Hovarn Meet.
- jsDelivr and cdnjs — content delivery networks that serve code libraries (for example the maths renderer and the office editors). Your browser downloads them directly, so these networks see your IP address and browser details, as any website you visit does.
We do not sell personal data or share it for advertising. We disclose data to authorities only when the law requires it. [Confirm whether any data is transferred outside India and to which countries, as permitted under section 16.]
How long we keep data
- Account and tool content: until you delete it or delete your account.
- Sessions: at most 30 days; a session unused for 14 days ends sooner.
- Deletion: when you delete your account, your data is removed from the live database immediately. Backups are kept for up to [N] days and then overwritten.
- Inactive accounts: [policy to be decided, for example deletion after N years of inactivity with notice].
Your rights
Under the DPDP Act you have the right to:
- Access a summary of your data — use “Export my data” on your account page to download everything we hold as a file.
- Correct or update it — your name and photo come from your Google profile and update the next time you sign in; tool content can be edited in each tool.
- Erase it — use “Delete my account” on your account page, or delete individual messages, files and tests.
- Withdraw consent — by deleting your account.
- Grievance redressal — contact us (below). We aim to respond within [N] days.
- Nominate someone to use these rights for you if you die or become unable to — [process to be set up; contact us by phone meanwhile].
If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
How we protect data
- HTTPS everywhere, with strict security headers and content security policy.
- Sessions in Secure, HttpOnly, host-only cookies, renewed at every sign-in; protection against cross-site request forgery on every change.
- Every request checks that the signed-in account may see the item asked for.
- Uploaded files are checked by size, name and actual content type, given random names and kept outside the public website, where they can never run as code.
- Rate limits against abuse; no raw IP addresses or e-mail addresses in logs.
No system is perfectly secure. If we learn of a personal data breach that affects you, we will inform you and the Data Protection Board as the DPDP Act requires.
Contact and grievances
Phone: +91 99437 08347
Grievance officer: [name] · E-mail: [grievance e-mail address — to be added before launch; the DPDP Act expects an easily accessible grievance channel]
Postal address: [address]
Changes to this notice
If we change this notice in a way that matters, we will show the new version when you next sign in and ask for your consent again where the law requires it.