Privacy Policy

1. About this policy

Pen Policy is a judicial-service examination preparation and legal reference application for the UP, MP, Chhattisgarh, Bihar, Rajasthan and Delhi Civil Judge examinations. This policy explains how Pen Policy collects, uses, stores, shares and deletes personal information when you use our application, website and related services.

This policy is provided in plain and simple language in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its Rules. Where this policy uses terms defined in the DPDP Act (such as Data Fiduciary, Data Principal, consent or personal data), those terms carry the same meaning.

Pen Policy is operated by:

Developer / legal entity: Apex Group

Contact email: support@penpolicy.com (primary) or admin@penpolicy.com (secondary)

2. Information we collect

Pen Policy is local-first. Most of your study data never leaves your device unless you choose to synchronise it. We have described below exactly what stays on the device and what is transmitted.

Account information

You sign in with a Google account or with a one-time code sent to your WhatsApp number. With Google, we receive and process the information your Google account makes available at sign-in — your verified email address, your name, your profile picture and a Google account identifier. With WhatsApp, we process your mobile number in international format and the time it was verified; we do not receive an email address from WhatsApp. We also store an account identifier of our own, your account role, and the time of your last sign-in. A Google email is accepted only after Google verifies it. An account created with WhatsApp has no email address until you link Google; both methods identify the same account, and linking one to the other requires you to be signed in.

Signing in is there to identify you for sync and for any future paid plans. If you do not want an account, you can still find and read the legal content and take practice tests without signing in; content you create while signed out stays on your device.

Study information and user content

When you use study features, we process the information you enter or generate, including study preferences (state, weekly target hours, theme), study plans and tasks, revision schedules, bookmarks, highlights, notes, mock-test attempts and answers, quiz and practice results, error-bank entries, reading history and progress.

This information is stored on your device in an on-device database (IndexedDB) and in your browser cache. It is transmitted to our servers only when you tap “Sync now” in Settings → Storage & sync, at which point your study records are copied to our cloud database (see section 4 and 6). The rest of the time it remains offline on your device.

Artificial-intelligence feature information

AI features (exam and mock-question generation) are included with the paid plans and work straight away, with nothing for you to configure. They run on an AI provider that we operate and pay for, and we choose the model. When you use an AI feature we send your prompt and the legal text you selected for it to that provider, and receive the model’s response back; the prompt and response are processed on our server and are not stored in your browser.

Our own provider credentials are held by us, are never exposed to you, and are not stored in your browser, in IndexedDB or in logs. We never ask you for, or hold, an AI provider API key, and Settings → Parikshak AI shows only whether the feature is available. If it shows as unavailable, Parikshak AI has been switched off at our end and no AI processing occurs; your other study features are unaffected, and the allowance in your plan is not consumed while it is off.

Payment information

Paid subscriptions are processed by our payment provider, Razorpay, which receives your payment method details directly and does not make them available to us. We store only the plan you are on, subscription status, and the payment, invoice and subscription references needed to run your account and to resolve billing or refund queries — including the plan, amount, status and any discount or offer applied. We do not store your card or UPI credentials.

Technical and diagnostic information

Our host, Cloudflare, maintains standard edge and server logs (such as IP address, user agent, request time and response codes) to operate, secure and troubleshoot the service. This information is used for security, reliability and diagnostics only. We do not operate advertising, analytics or crash-reporting trackers and do not build behavioural profiles of users.

Notifications

If you turn on notifications and grant permission, we store the push subscription endpoint and the keys that let us deliver messages to that device, together with a record of which daily digest has already been sent. We use this only to send the notifications you asked for, and we remove a subscription when the push service reports it is no longer valid. Turning notifications off in Settings stops further messages.

Free trial and referral records

To stop a trial being claimed more than once, we record that an email address or a verified mobile number has used a trial. If you use a referral link, we record the referral — who invited you, and the fact that a discount was applied — so the inviter’s free cycle is granted only once and the referral limit is enforced. Referral records are tied to your account and are deleted with it; the trial-use ledger is retained as described in section 8.

Lifecycle emails

When your account has an email address, we send you a small number of emails about the account itself: a few before your free trial ends, and one if you have not used the app for a while. These are service messages tied to your account, not marketing. We send them to the linked email address and keep a record of which were sent. A phone-only account receives no lifecycle email until an email is linked. Every one of these emails carries a one-click unsubscribe link, and unsubscribing stops the lifecycle emails only — it does not delete your account or affect your access. You can also unsubscribe at any time by writing to support@penpolicy.com (primary) or admin@penpolicy.com (secondary).

Support communications

When you contact support@penpolicy.com (primary) or admin@penpolicy.com (secondary), we receive your email address, your message and any attachments or other information you provide, and we use that to respond and resolve your request. Please avoid sharing confidential case files or other people’s personal information unless it is necessary for your request.

3. How we use information

We use the information described above only for the following purposes:

• To provide and maintain the application, including offline access.
• To sign you in with Google and manage your account.
• To save your study preferences and user-created content, either on your device or, when you choose to sync, on our servers.
• To display your study progress, practice results and revision schedules.
• To synchronise your study records across devices where you enable sync.
• To run AI features when you use a feature, using our default AI provider or the one you connected.
• To diagnose errors and maintain security.
• To respond to support and privacy-regard requests.
• To send the account lifecycle emails described in section 2, and to honour your unsubscribe request.
• To meet applicable legal obligations.

We do not use personal data for advertising or marketing, and we do not process it contrary to the purposes for which it was collected (purpose limitation).

4. Information sharing and service providers

We share information only as described in this policy. We never sell, rent or otherwise trade personal information.

Service providers

Providers process information under their applicable terms, our arrangements with them and the purposes described in this policy. Where a provider is a Data Fiduciary in its own right for the data it processes, its own privacy policy applies to that processing.

Legal requirements

We may disclose information where required by applicable law or a valid legal request, or where necessary to protect users, investigate fraud or address security incidents, and we will disclose only what is reasonably necessary.

Business transfers

If ownership of Pen Policy changes through a merger, acquisition or transfer of assets, personal information may be transferred as part of that transaction. Where required, we will obtain fresh consent or give notice before such transfer.

Advertising and sale of information

Pen Policy does not display third-party advertisements, does not sell or rent personal information, and does not share information for advertising or cross-app tracking.

5. Device permissions

Pen Policy runs as a browser-based and installable application and requests no special device permissions for core use. Features that need permission are used only with your choice — for example, an in-app notification reminder would ask for notification permission at the time it is enabled. You can manage permissions through your device or browser settings; disabling a permission may prevent the related feature from working.

6. Local storage and offline features

Pen Policy uses an on-device database (IndexedDB) and a service-worker cache to store your study records, preferences and saved legal content, to support offline access and to remember your settings. API calls that carry personal data are never cached by the service worker.

You can clear the local data yourself: in Settings → Data, use “Reset local data” to delete notes, bookmarks, revision queue, attempts, AI sessions and preferences (previously saved legal content stays), or clear the app site data through your browser settings.

Removing local data or uninstalling the application does not automatically delete information stored in a cloud account. Cloud-account deletion is explained in section 10.

7. Data retention

We keep information for no longer than is necessary for the purposes for which it was collected (storage limitation):

• Account information: for as long as your account is active, and for a short period afterwards where we need records for billing, audit or legal purposes.
• Email addresses or verified phone numbers of deleted accounts (trial-abuse prevention): retained as long as we run a free-trial offer, and only for that purpose.
• Lifecycle email records: a log of which emails were sent and when, retained while your account is active and for a short period afterwards for support and abuse prevention.
• Unsubscribe records: retained while we run the lifecycle email service, so that we keep honouring your request. An unsubscribe record outlives account deletion, because the instruction to stop emailing an address is the personal data here.
• Study information and user content: until you delete it, until you delete your account, or until you ask us to remove it.
• Synced and diagnostic records: only while reasonably needed to operate and secure the service; logs follow the hosting provider’s retention practices.
• AI provider credentials: held by us for as long as the service is offered, encrypted at rest, and rotated when the provider is changed. We hold no AI provider credentials on your behalf, and none are linked to your account.
• Support communications: for the period needed to resolve the request and for reasonable record-keeping.
• Backup copies: until the corresponding backups expire under the hosting provider’s backup lifecycle.

We may retain limited information for longer where necessary to comply with law, resolve disputes or protect against fraud and abuse; in that case we restrict its use to the relevant purpose.

8. Your choices and rights

Under the DPDP Act, 2023 and other applicable law, you may have the right to:

• Request access to your personal information.
• Correct inaccurate or incomplete information.
• Request deletion or erasure of your information.
• Request a copy of your information (use Settings → Data → Export JSON for your device data).
• Object to or restrict certain processing.
• Withdraw consent at any time where processing relies on consent; withdrawing consent does not affect the lawfulness of processing before the withdrawal.
• Stop the lifecycle emails at any time using the unsubscribe link in any of them, or by writing to us. This does not affect your account or your access to the app.
• Nominate, in the event of your death or incapacity, an individual who may exercise your rights on your behalf — write to us and we will record your nomination.
• Raise a grievance with us, and afterwards with the Data Protection Board of India if you are not satisfied.

To exercise any of these rights, email support@penpolicy.com (primary) or admin@penpolicy.com (secondary) with “Privacy request” in the subject line. We may ask for information reasonably necessary to verify that the request concerns your account. We will acknowledge your grievance within 24 hours and respond within the period required by applicable law (7 days under the DPDP Rules), and we will make reasonable efforts to act promptly.

9. Account and data deletion

You can delete your account from within the application: Settings → Account → Delete account. Alternatively, email support@penpolicy.com (primary) or admin@penpolicy.com (secondary) with “Account deletion request” in the subject line. After we verify that the request concerns your account, we delete your account record, your cloud-synced study records and your registered devices, and we clear your session — normally immediately for the in-app option and within 15 days for requests sent by email.

When you delete your account we retain the identifier that could claim a new trial — your email address if there is one, otherwise each verified phone number — with the date it was recorded. This is purpose-limited: to make sure the free-trial offer is not re-issued if the same email or number signs up again. It is used only to prevent abuse of the free trial, is not used for marketing, and contains no other personal information.

Deletion covers account records, cloud-synced study records, registered devices and AI usage counters tied to your account. Data that we are required to keep for legal, audit or fraud-prevention reasons is restricted to that purpose and retained only as long as required — after which it is deleted. Backup copies are deleted when the corresponding backups expire under the hosting provider’s lifecycle.

Before deleting, you can export your data with Settings → Data → Export JSON. Uninstalling Pen Policy does not itself delete your account or server-stored information; use the in-app Delete account option or request deletion as described above. Local data can be removed at any time with “Reset local data” or your browser’s site-data controls.

10. Security

We take reasonable security safeguards appropriate to the nature and volume of the data. In particular, traffic to and from the service is encrypted in transit (TLS); sessions are carried in HttpOnly cookies signed with a server key; device sync uses a per-device secret stored only on the device and kept server-side as a one-way hash; API credentials are encrypted at rest with AES-256-GCM; and our authentication and sync endpoints are protected by access controls.

No method of electronic storage or transmission is completely secure. Please protect your device and your Google account credentials, and contact us if you suspect unauthorised access to your account. In the event of a personal data breach that is likely to cause harm to you, we will notify you and the Data Protection Board of India as required by the DPDP Act, 2023.

11. International processing

The service is hosted by Cloudflare on its global edge and cloud infrastructure. Because of the way such infrastructure operates, your data may be stored in, and transferred to, datacentres and regions that Cloudflare operates, which may be outside India. Where personal data is transferred across borders, we rely on the safeguards required by applicable law, including contractual protections with our service providers and Cloudflare’s data-protection commitments.

Your data in our own database (D1) is stored in a location managed by Cloudflare for the environment you use; we do not transfer or store it elsewhere.

12. Children’s privacy

Pen Policy is intended for adults preparing for judicial-service examinations and is not designed for, or directed at, individuals below 18 years of age, and we do not knowingly collect personal information from anyone below 18. If you are below 18, please do not create an account or send us any personal information.

If you believe a child has provided personal information in contravention of this policy, contact support@penpolicy.com (primary) or admin@penpolicy.com (secondary) so we can investigate and remove it.

13. External links

Pen Policy may contain links to judgments, legislation, official examination websites, government portals and other external resources. Those websites operate independently and have their own privacy practices; this policy does not apply once you leave our application. Please review their policies before providing them personal information.

14. Changes to this policy

We may update this Privacy Policy as the application or its data practices change. The updated version will be published at penpolicy.com/privacy with a revised “Last updated” date, and the effective date above will change. Where a change requires your consent under applicable law, we will obtain it before the change applies.

15. Contact us

For support, privacy questions, grievances or personal-information requests:

Pen Policy, powered by Apex Group

Email: support@penpolicy.com (primary) or admin@penpolicy.com (secondary)

We acknowledge grievances within 24 hours and respond within 7 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.