Privacy

Sprinto is a personal project, not a company. It was written by one parent — Krishna Kammaje — for his own child's SOF Olympiad preparation, and then shared with two friends' children and anyone else who finds it useful. It is free, it sells nothing, and it has no investors, advertisers or data partners to answer to.

It is not affiliated with the Science Olympiad Foundation. Nothing you do here is reported to SOF, to a school, or to anyone else.

Because it is one person's project rather than an organisation, there is no privacy department to write to: questions come to kkammaje@gmail.com and are answered by the person who wrote the code.

A parent or guardian holds the account. Signing in is done with Google, and there is no password for us to store or lose. The app can be set to admit only named email addresses or to admit anyone with a Google account; today it admits anyone who signs in, and that setting can be tightened at any time without notice.

A child does not have an account. She has no email address, no password and nothing to remember — she taps her own face on a profile picker on the parent's device. She cannot sign herself in, and she cannot create a profile; only the account holder can.

This is the point of the design rather than a detail of it. If you are under 18, do not create an account here — ask a parent to, and use their profile picker.

All of it arrives from Google when you sign in, or is created by the act of signing in:

• Your name, as it appears on your Google account.
• Your email address, and whether Google has verified it. This is also the identity the access list is checked against, on sign-in and on every later request.
• The web address of your Google profile picture, so the dashboard can show it.
• Your Google account identifier and the sign-in tokens Google issues, which are what keep you signed in. The sign-in asks Google for your basic profile and email only: it gives us no access to Gmail, Drive, Calendar, contacts or anything else in your account.
• For each active session: a session token, when it expires, the IP address it was created from and your browser's user-agent string. These are what let you close the tab and come back tomorrow, and what would show a sign-in you did not make.

We do not ask for, and have nowhere to put, your phone number, your address, your date of birth, your payment details (there is nothing to pay) or your child's school.

Three things, all typed or tapped by the parent:

• A first name — or a nickname, or an initial. Nothing checks it, and a name only she and you would recognise works exactly as well.
• Her class, 1 to 7. It decides which exam papers she is shown.
• The avatar she picked from a fixed set of drawn faces.

There is no photograph, no date of birth, no school, no location, no contact detail, no voice or camera use, and nowhere for her to type free text that another person could read. Sprinto has no chat, no comments, no profile page and no way for one child to see another child — including the other children on the same account.

This is the part that makes the app work: an app that adapts to a child has to remember how she did. For every question she answers we store which question it was, which chapter and exam it came from, which option she chose, whether it was right, how long she took, and when. Built out of those attempts, we also keep:

• A rating per chapter, and dated snapshots of it, which is what decides how hard the next question is.
• A card per mistake on a spaced-repetition schedule, so a wrong answer comes back days, then a week, then a month later.
• Mock tests she has sat, with their answers and marks.
• Papers printed at home, so the answers you type off the OMR sheet can be matched to the right paper.
• Points, her daily streak, and which of the badges she has earned.

Her points, streak and badges are shown to her. Her rating is not — it sits on the parent dashboard, on purpose.

Five services, each doing one job. None of them is an advertiser and none is paid in data.

• Google — sign-in only. Google knows you signed in to this app, as it does for any app you use Google to sign in to. It receives nothing about your child.
• Neon — the hosted Postgres database that holds everything described on this page.
• Fly.io — the hosting the app runs on, on a single machine in Singapore. Its ordinary server logs see the IP addresses and requests any web host sees.
• Anthropic — the weekly written summary on the parent dashboard, and nothing else in the app. It runs only when a parent opens that dashboard.
• Mixpanel — usage counting: how many people visit, sign up and come back, and from which country. Section 7 lists every field it receives. It receives nothing about the child.

Because the summary is the only time anything about your child leaves our own servers, here is exactly what it sends: your child's first name, the exam name, how many questions she answered and got right that week, how many days she practised, her streak, the chapter titles she worked on with counts and a word for how she is doing in each (not the rating), and the titles of the five question types she got wrong most. That is the whole list. No question text, no answer she chose, no email address, no name of yours, and nothing at all from the child's own screens. Anthropic does not train models on it.

No language model ever writes, chooses or marks a question. Every question comes from a template in the app's own code and every answer is marked by comparing it to a key held on the server. The weekly paragraph is the single exception in the whole app, it is optional, and the real numbers sit next to it on the same page.

We do not sell, rent or trade anything to anyone. We would disclose data if a court in India required it, and we would tell you unless prevented from doing so.

There is no advertising network, no tracking pixel, no A/B testing tool and no social media button on any page of this app. There is one analytics service, Mixpanel, and this section is the whole of what it is told. You can check it against your browser's network tab, which is a more convincing check than this sentence.

Mixpanel receives:

• That a page was opened, and which one — by path, such as /home or /mock. Not what was on it.
• The web address you arrived from, if your browser sends one, and any campaign tag on the link you clicked. This is how we tell whether a post about the app brought anyone to it.
• After a parent signs in, the account's internal identifier — a random string, not your name and not your email address — so that a parent who comes back is counted once rather than once per visit. The same identifier is what marks a first sign-in as a sign-up.
• That a question was answered, with the mode (practice, warm-up, fix-it or mock) and the subject. Not the chapter, not the question, not the answer she chose, not whether it was right and not how long she took.
• Your browser and device type, and your approximate location — the country and region Mixpanel works out from the request's IP address, which it does not store.

That is the whole list. Nothing about the child travels: not her name, not her class, not her scores, and nothing from her own screens. Mixpanel does not record sessions or screens, and we have that switched off in the code rather than relying on a default. Its own policy is at mixpanel.com/legal/privacy-policy, and its data is held in the United States.

What is stored on the device is short:

• A session cookie, which is what keeps the parent signed in. It is not used for anything else.
• Which face was last tapped, in the browser's local storage, so the iPad opens on her map rather than the front door.
• Mixpanel's identifier for this browser, also in local storage and not in a cookie, so that two visits from one browser are one visitor.
• The app's own files, cached by the browser so it opens without a connection.

There is no advertising identifier and no cross-site tracking, so there is also no cookie banner: the only cookie is the one that signs you in.

Practice history is kept while the account exists, because the whole value of it is the comparison with three months ago. Sessions expire on their own. Nothing is archived anywhere else.

Write to kkammaje@gmail.com from the address you signed in with and ask, and we will:

• delete the account, every child profile on it and every attempt, rating, mock test, paper and badge — deletion cascades in the database, so this is one action and it is permanent — and ask Mixpanel to delete the usage record held under your account's identifier; or
• delete one child rather than the whole account; or
• send you a copy of everything held about you and your children; or
• correct anything that is wrong.

A reply should take a few days — this is one person, not a support desk. Deletion is real deletion, not a flag on a row.

Everything travels over HTTPS. Answer keys are held on the server and never sent to the browser, so a paper cannot be marked by reading the page source. The access list is re-checked on every single request, not only at sign-in, so removing an address takes effect immediately. Database credentials live in the server's environment and are not in the app's source code.

Being honest about the size of this: it is one small machine and one database, run carefully by one person, not a company with a security team. Nothing sensitive is stored here — no payment details, no documents, no photographs, no messages — and that is itself part of the design.

If this policy changes in substance, the date at the top of the page changes with it, and a change that would affect what we do with data already collected will be emailed to account holders before it takes effect.

Questions, corrections, or a deletion request: kkammaje@gmail.com.