Privacy Policy
Last updated 4 October 2026. This notice explains what ClarUp collects, why, where it lives, and your rights. We follow data minimisation — we collect only what the product needs to work.
Who this is for
ClarUp’s study material is for learners of any age. An account, however, is held by an adult: you confirm you are 18 or over when you sign in, and if the student is under 18 a parent or legal guardian holds the account and studies alongside them.
That means the personal data we hold — name, email, and study activity — is the account holder’s. We do not knowingly create accounts for, or collect personal data from, anyone under 18. If you believe a child has created an account without a guardian, email us at hello@clarup.com and we will close it and delete the data.
What we collect
- Account: your name and email address, received from Google when you sign in. We never see or store your Google password.
- Learning activity: the questions you attempt, your answers and scores, mock-test results, section-wise mastery, and any bookmarks or question reports you create.
- Feedback and contributions (only what you choose to send): the feedback you write about a lesson, guide, mock or page; the exams you join a waitlist for; and any paper, answer key or notice you upload or link for review. Uploaded files are kept in a private store that only you and our reviewers can open, are used only to check and improve our content, and are deleted with your account. Please don’t include personal details in a note or a file.
- Payments: a mirror of your purchases (order ID, amount, status). Card and UPI details are handled entirely by Razorpay — we never receive or store them.
- How you found us: the first time you visit, your browser notes the campaign tags on the link you arrived by (
utm_source,utm_mediumandutm_campaign), if it had any, and the domain of the website that sent you — the domain only, never the address of the page. It is kept in your browser, and if you create an account it is copied to your account once, so we can tell which channels bring people to ClarUp. It holds nothing that identifies you, it is never shared, and it is kept for as long as your account exists and deleted with it. - Page-view counts: Cloudflare, which serves this site, adds its Web Analytics counter to every page. It reports the page address, the referring site, your browser type and how quickly the page loaded, so we can see which pages are visited and whether they are slow. It sets no cookies and stores nothing on your device, and it runs for every visitor because the hosting platform adds it — it is not one of the optional analytics below.
- Analytics (optional, off unless you say yes): if you allow it, Google Analytics records aggregate, directional usage events (for example: signed up, answered a free question, reached a paywall, started checkout, completed a purchase, completed a mock, reported a question), and Microsoft Clarity records how pages are used — clicks, scrolling and pointer movement — as session recordings and heatmaps, so we can see where the product is confusing. Neither is ever used for advertising. See “Analytics is optional” below.
Where your data lives
This list is meant to be complete. If we add a processor, it appears here before it starts processing anything.
- Supabase — our database and authentication (account, learning activity, feedback and contributed files, purchase mirror, and the “how you found us” record). Hosted in Mumbai, India (ap-south-1).
- Razorpay — payment processing (India).
- Google — sign-in (Google OAuth) and, only with your consent, Google Analytics for directional usage measurement.
- Microsoft — only with your consent, Microsoft Clarity for session recordings and heatmaps of how pages are used.
- Cloudflare — hosting and delivery of this website, and the Cloudflare Web Analytics page-view counter described above. Every page you load is served through Cloudflare’s global network, so it necessarily processes your IP address and request metadata.
Transfers outside India
Your account and learning data are stored in India. Three of the processors above are global services and may process data outside India in the course of delivering it: Cloudflare serves this site from whichever of its data centres is nearest to you, Google operates sign-in and analytics on its worldwide infrastructure, and Microsoft operates Clarity on its own. We do not transfer your data to any country that the Government of India has restricted under the DPDP Act.
Why we collect it
To run your account and save progress, to process payments and unlock what you have bought, to understand — in aggregate — how the product is used so we can improve it, and to learn which channels bring people to ClarUp.
Analytics is optional, and you can change your mind
Google Analytics and Microsoft Clarity run on consent rather than on necessity, and neither loads until you say yes. If you are not signed in, a banner asks you first: Accept and Decline are equal choices, nothing is pre-selected, and your answer is kept in your browser. You can change it at any time from Analytics choices at the foot of every page.
If you have an account, the setting is Account → Preferences and privacy → Usage analytics. If you accepted the banner on this device before creating your account, that same yes is carried over to your account — it is the same purpose, and you should not have to answer twice; if you declined or did not answer, analytics starts off. Either way, turning it off takes effect immediately; we do not ask why, and it never affects your access, your progress or your purchases.
Everything else we collect is what the product needs in order to work — your account so you can sign in, your attempts so your progress is saved, your order mirror so your purchase unlocks — and it stops when you delete your account.
Retention and deletion — how long we keep it
Your account and learning data are kept for as long as your account exists. You can delete your account at any time from inside the app (Account → Delete my account); deletion removes your profile, attempts, mastery, mock-test data, bookmarks and reports, and revokes your entitlements. A refund revokes access but does not by itself delete your learning history.
There is one deliberate exception, and it is the only data that outlives your account: billing records — orders and payment webhook logs. Indian tax and accounting law requires a seller to keep books of account, so these are retained for up to eight years from the end of the financial year of the transaction, and they are de-linked from your identity when you delete your account, leaving a financial record with no person attached to it.
Your rights
You can access, correct or delete your data, withdraw a consent you have given, and nominate someone to exercise these rights on your behalf. Account deletion is self-service in the app, and analytics consent is a setting in Account (or Analytics choices if you are not signed in); for anything else, contact us.
If we do not resolve it
If you have raised a grievance with us and are not satisfied with how we handled it, you may complain to the Data Protection Board of India, the authority established under the Digital Personal Data Protection Act 2023. Please give us the chance first — our commitments are below and on our Contact page.
Grievance contact
Email hello@clarup.com. We acknowledge every message within 48 hours and aim to resolve it within 30 days. Our business details and full grievance-redressal process are on our Contact page.