Privacy Policy

Effective September 13, 2026

This Privacy Policy describes how Tarcy (“we”, “us”) collects, uses, and shares information when you use our mobile app and website. We aim to collect only what we need to run the product and keep your account secure.

1. Information we collect

Account information — when you sign in with Google, we receive your name, email address, and profile picture. If you sign in as a guest we do not create an account and do not associate your solves with a profile.

Content you submit — the math problems you type, paste, or photograph and the follow-up questions you tap to drill deeper. Photos are sent to our servers only long enough to generate a lesson and are not retained after processing.

Usage data — problem counts, feature usage, streaks, and device metadata (OS version, device model, app version). We use this to operate the free-tier limit, show you your notebook and streak, and improve the product.

Payment data — when you subscribe, our payment processor (Razorpay) collects card and billing details. We never see your full card number. We only store the subscription id and current status.

Feedback — thumbs up / down and optional comments you leave on a solution. We use these to identify which problem types the model gets wrong and to improve our prompts.

2. How we use it

To generate solutions and drill-down mini-lessons for you.
To keep your notebook, streak, and subscription state in sync across devices.
To enforce free-tier limits and prevent abuse of our API.
To improve the quality of our AI teaching (aggregate feedback, never per-user).
To communicate about your subscription (receipts, renewal reminders).

3. Third-party services

We rely on the following third parties. Each has its own privacy policy.

Google (Sign-In) — authenticates you and returns your email, name, and picture.
Google (Gemini API) — we send your problem text or photo to Gemini to generate the lesson. Google's API terms apply. We do not train models on your data.
MongoDB Atlas — stores your account, problems, drills, and feedback.
Razorpay — processes payments for the Pro subscription.

4. What we don't do

We do not sell your data.
We do not use your solutions to train third-party AI models.
We do not show advertising in the app.
We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will remove it.

5. Data retention

We keep your account and its problems / drills for as long as your account is active. You can delete your account at any time (see “Your rights” below) and we will remove your data within 30 days, except where we're required to keep records for tax or fraud-prevention purposes.

6. Your rights

You can:

Access and export the data associated with your account.
Correct information (e.g. name) via the profile screen.
Delete your account by emailing hello@tarcy.in from the address associated with your account.
Withdraw consent to marketing communications.

If you're in India, these rights are governed by the Digital Personal Data Protection Act, 2023. If you're in the EU/UK, they are governed by the GDPR/UK GDPR. If you're in California, by the CCPA/CPRA. In all cases we honour access, correction, deletion and portability requests within 30 days.

7. Security

Traffic between the app and our servers is encrypted (HTTPS/TLS). Passwords are never stored — Google Sign-In is the only sign-in method for end users. We rotate access credentials and follow reasonable industry practices, but no online service is 100% secure and we cannot guarantee absolute security.

8. Changes to this policy

We'll update the Effective date above and, for material changes, notify you in the app before the change takes effect.

9. Contact

Questions or requests: hello@tarcy.in.

This is a template based on Tarcy's actual data practices. Before launch, have it reviewed by a lawyer in your primary market to make sure it fits your specific obligations.