AIm-PG — Privacy Policy

Effective Date: September 1, 2026

Last Updated: September 24, 2026

NYX KNIGHT, sole proprietor (“we”, “us”, “our”) operates the AIm-PG mobile application (the “App”). This Privacy Policy governs how we collect, use, share, secure, and delete personal data, including under India’s Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, the GDPR (EU/UK), and CCPA/CPRA (California). Contact: aim.pg.app.support@gmail.com. Address: Hyderabad, Telangana, India.

We minimize data and do not sell personal data. AIm-PG is an exam-preparation app for INI-CET and NEET-PG: adaptive Synapse planning, previous-year questions (PYQs), practice sets, mock tests, progress statistics, and local study reminders. It is not an official product of NBE, NMC, or any exam body.

In-app subscription purchases are processed by the Apple App Store and Google Play Billing. Subscription status is managed through RevenueCat. We do not display third-party advertisements.

1. Information We Collect

We collect only what is needed to provide the service. We do not collect biometrics, health records, or payment card data.

- Authentication (required): email, name, and profile image from Google or Apple sign-in (via Supabase Auth).

- Account fields you may add: display name, contact email, phone number, college, target specialty.

- Onboarding and planner inputs: exam type (INI-CET or NEET-PG), exam date, professional status (for example intern or working doctor), timezone, rest days, study-time sectors, subject confidence order, and related Synapse schedule preferences.

- Study activity: question attempts (selected answers, correctness, timing), mock attempts and scores, saved questions, Synapse session outcomes and events, study-plan status.

- Question reports you submit: reason, short description, and question identifiers, used to fix catalog issues.

- Device and session data: device name, type (phone or tablet), a stable installation fingerprint used to enforce one active device at a time, and last-seen time.

- Entitlement and subscription metadata on our servers: plan tier (Free, Synapse, Pro, or Pro+), billing cycle (one month, six months, twelve months, or a non-renewing thirty-day exam extension), status (including active, cancelled, expired, grace period, or billing retry), expiry, original purchase store (App Store or Play Store), product identifier, RevenueCat customer ID bound to your account identifier, and whether a thirty-day exam extension has been used on the current annual term. Apple and Google process card and wallet payments. We never receive full card numbers.

- Device and app data: device model, OS version, app version, and IP address as processed by our backend (Supabase) for security and delivery.

- Notifications: reminder preferences and scheduled local alerts stay on the device. We do not collect push tokens or store notification preferences in our database.

- Question content: PYQ, practice, and mock bodies and images are delivered from private storage. They are educational content, not your personal data. Delivery sessions may use on-device encryption keys so content is protected in transit and at rest on the device.

- Diagnostics: minimal crash or error context and request metadata needed to operate the service. We do not use a third-party analytics or advertising SDK.

We do not collect contacts, messages, photo-library contents, precise GPS, browsing history, or camera or microphone input.

2. How We Use Data

- Authenticate you and sync study progress across the allowed device.

- Generate and reconcile your Synapse schedule on the device; persist outcomes and plans in the cloud.

- Deliver entitled educational content and score mocks according to your plan.

- Process and verify in-app purchases: match store receipts to your account, unlock the purchased tier, renewals, cancellations, billing retry or grace period, restore purchases, and where eligible a one-time thirty-day exam extension on an annual plan.

- Enforce the single-active-device rule to protect progress and prevent subscription sharing.

- Improve catalog quality using de-identified question reports.

- Maintain security, prevent abuse, and debug issues.

- Respond to support and privacy-rights requests.

- Comply with legal obligations, including tax and dispute-defense retention of limited payment identifiers.

We do not use data for targeted advertising or selling.

3. Legal Bases

- DPDP: consent for optional fields (phone, college, specialty) and notifications; legitimate use for service delivery, subscription fulfillment, fraud prevention, and legal compliance.

- GDPR: contract necessity (account, study service, and paid entitlements); legitimate interests (security, single-device integrity, catalog quality); consent where required (optional contact details, local notifications); legal obligations (tax, chargebacks, statutory records).

- CCPA/CPRA: service-provider use only; no “sale” or “sharing” for cross-context behavioral ads.

4. Sharing and Processors

We do not sell personal data. Limited sharing under contracts:

- Supabase (processor): authentication, Postgres, Edge Functions, and private Storage (account, study data, entitlements, content delivery, account deletion).

- Google and Apple: OAuth identity (email, name, avatar) when you sign in.

- App stores (Google Play and Apple App Store): distribution and in-app purchase billing. Receipts, payment methods, and store invoices are handled by the respective store.

- RevenueCat (processor): subscription management and entitlement delivery. After you sign in, the App identifies you to RevenueCat using your account identifier, not your study answers. RevenueCat receives purchase receipts from Apple or Google and sends events to our backend so we can update your plan. RevenueCat does not receive question content, clinical study answers, or health records. RevenueCat’s own privacy policy applies to its processing.

- Legal compliance: disclosures only when required by law or court order.

We do not use advertising SDKs or third-party analytics SDKs in the App.

5. Storage, Security, Transfers

Preferences, notification schedules, and some caches stay on the device. Cloud data is stored with Supabase in regions they operate (typically EU or US). Catalog files sit in a private storage bucket; clients receive them through authenticated delivery, not public URLs. Subscription status also exists in RevenueCat and in the app stores’ billing systems.

Security: TLS in transit; encryption at rest via platform and processor services; least-privilege access; content-delivery session keys on device. Report issues to aim.pg.app.support@gmail.com.

When data is processed outside your region, we rely on Standard Contractual Clauses (GDPR) and DPDP-equivalent safeguards plus encryption.

6. Retention and Deletion

Data is kept while your account exists and is needed to provide the service, including while a paid entitlement is active or in a cancelled-but-unexpired period.

To delete: Profile → Account → Delete account while signed in, or a verified email request. Authentication deletion removes profiles, study plans, sessions, question attempts, device data, and the live entitlements row. Residual copies in backups or processor systems are cleared within thirty days. Deletion cannot be undone once completed. The Account & Data Deletion Process describes the same steps in full.

Deleting the AIm-PG account does not cancel Apple or Google auto-renewing subscriptions. You must cancel in App Store or Google Play settings to stop future charges. See Terms of Service, Section 5.

For users with purchase history, tax rules (including GST or sales tax) and dispute defense (including DPDP Section 12, GDPR Article 17(3)(b) and (e), and CCPA/CPRA) require retaining an immutable snapshot of transaction identifiers and billing email in a restricted audit ledger for the statutory period. Free accounts with no payment transactions have no audit records created.

Apple, Google, and RevenueCat may retain their own billing records under their policies after our account row is deleted.

Question reports may remain after the user identifier is removed, for catalog quality. Local notification artifacts are removed when you delete the account in the App or uninstall the App.

7. Your Rights

You may request access, correction, deletion, restriction or objection (where applicable), portability, consent withdrawal, and nominee rights (DPDP). We respond within thirty days (extensions for complex cases). No fee unless requests are excessive.

Submit in the App (Profile → Account → Delete account) or email aim.pg.app.support@gmail.com with subject “Privacy Rights Request - AIm-PG,” including the account email and verification details.

You can edit name, contact email, and phone in Profile → Account. You can view plan status, restore purchases, and open store subscription management in Profile → Subscription.

8. Children and Age

The service is intended for adults 18 years of age or older (medical postgraduate exam candidates). Users under 18 require verifiable parental or guardian consent. We do not knowingly collect data from children under 13; if discovered, we delete it.

9. Changes to this Policy

Material changes (including new data uses, new processors, or advertising) will be notified at least thirty days in advance by in-app notice or email where we have a usable address. Continued use after the effective date is acceptance. Historical versions are available on request.

10. Contact and Grievance

Email: aim.pg.app.support@gmail.com

Address: Hyderabad, Telangana, India

Escalation: DPDP Board (India), the relevant EU or UK authority, or CPPA (California), as applicable.

The Terms of Service and the Account & Data Deletion Process form part of the same set of terms that apply to the App.

© 2026 NYX KNIGHT