homeworkWhat we collect, and what we never ask for.
Last updated 23 October 2026 · Service status: staging (pre-launch)
Who runs Homework
Homework (homeworkai.in) is operated by Rudraayaan AI Technologies Private Limited, India (“we”). For anything in this notice, including requests about your data, write to grievance@aisandy.tech. That address also reaches our Grievance Officer under India’s Digital Personal Data Protection Act, 2023.
What we never ask for
- No parent accounts, and no parent names, email addresses, phone numbers, home addresses or profiles. We have no field that accepts them, and our server rejects them if they are sent.
- No pupil records. This release does not collect any information about pupils.
- No advertising, analytics or tracking scripts, and no third-party fonts.
If you just try a lesson
Sample lessons run in your browser. Your answers stay in page memory and disappear when you reload. We do not create an account or profile for you. If you switch between the blue and classic colours, that choice is saved in your browser’s local storage on your device only.
Like every website, our server and hosting provider receive technical connection data: your IP address, browser type, the page requested and the time. These are written to standard web-server logs that are rotated automatically. We use them only to run and secure the service, never to build a profile.
If you open a class QR code
A class teacher can share a QR code with the parents of their class. It opens a read-only page with that class’s homework. There is no sign-in, and we store nothing about you or your child from it: no name, phone number, device or IP address is saved against the visit. We only count how many times the link was opened, so the teacher knows it works. The link’s secret part sits after the “#” in the address, which browsers never send to our server. The teacher can replace or stop the code at any time, and it expires after 3, 6 or 12 months.
If you represent a school
| What | Why |
|---|---|
| Your mobile number | To sign you in with a one-time SMS code and identify you as a member of school staff. Other staff are added by a school administrator using their mobile number. |
| School details you enter: legal name, campus, district, State/UT, management category, class levels, UDISE+ code, the school office email, your role (for example “Principal”), recognition order details, board and affiliation details, NOC status | To check whether the institution is recognised, which board it is affiliated to, and whether you can act for it. |
| Documents you upload (recognition or establishment order, affiliation letter, NOC, authority letter) | The same verification. Each file is scanned for malware before a reviewer can open it. |
| Sign-in sessions, and an audit record of actions (who, what, when, from which IP address and browser) | Security, preventing misuse, and being able to show who approved or changed what. |
| Assistant access tokens (if you create one) | To let a connected assistant (for example Codex or ChatGPT) read your school’s status on your behalf. Stored only as a one-way hash. |
A school office email is an institutional contact, not a personal one. Please don’t enter a personal address.
Who else processes this data
- Hosting: our application and database run on a virtual private server rented from Hostinger.
- SMS delivery: sign-in codes are sent through Dove Soft Ltd. using a DLT-registered template, so they receive your mobile number and the code. The SMS is sent from the sender ID and template we already use for our other products, so the text may name “Team CARD9”, which is also run by Rudraayaan AI Technologies Private Limited
- Payments: school plans are paid through Razorpay Software Private Limited. Razorpay handles your card, UPI or bank details; we never see or store them. We keep only the payment ID, amount, GST, plan, number of classes and dates, as tax and accounting records.
- Document storage: files that pass the malware scan are stored in a private Supabase storage bucket. They are never publicly linked, and they are only served through our server after an access check.
We do not sell personal data or share it for advertising.
Who can see school applications
Only the person who filed the application, and our reviewers. Reviewers must use a second sign-in factor. After a school is verified, its staff see a minimal school summary. Teachers cannot see the application or its documents. Staff of other schools can see none of it, and our database enforces that boundary as well as our application code.
How long we keep it
We have not yet set fixed retention periods for this pre-launch service. Until we publish them here, we keep application records and documents while the school’s application or verification is active, plus any period the law requires. Audit records are kept so that decisions can be traced. You can ask us to delete your data at any time, and we will tell you if a legal duty requires us to keep something.
Your rights
Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Write to grievance@aisandy.tech. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Security, honestly
We use HTTPS, one-time SMS codes, a second factor for reviewers, malware scanning of uploads, database-level separation between schools, and an append-only audit log. No system is perfectly secure, and we make no certification or compliance claims for this pre-launch service.
Changes
We will update this page and the date above when anything changes.