Privacy Policy

Saral Pathshala ("we", "us", "our") operates the website at exam.saralpathshala.com and a companion Android app, providing MCQ-based entrance exam preparation (IOE, CEE, B.Sc. CSIT, BCA, CMAT, B.A. LLB, and Loksewa), structured video lectures, mock tests, and result analytics for students in Nepal. This policy applies to both the website and the app.

By creating an account or using our services, you agree to the collection and use of information as described here. If you do not agree, please do not use Saral Pathshala.

1. Information We Collect

Account information

When you register, we collect:

• Your full name and email address (required to create an account).
• Your Nepali phone number (required — it is verified by SMS OTP before your account can be used to log in, and is also how we send password-reset codes).
• Your current academic level (e.g. +2, Bachelors, Masters) and the course you're interested in (e.g. IOE Entrance, B.Sc. CSIT), which you provide at registration to personalize which courses and mock tests are shown to you.
• Your previous institute, if you choose to share it.

Your password is never stored in plain text. We use Django's standard password hashing (PBKDF2), so even our own staff cannot see your actual password — only a one-way hash.

Phone verification (OTP)

To confirm you own the phone number you register with, we send a 6-digit one-time code by SMS through our SMS service provider. We keep a short-lived record of the OTP, how many times it was attempted, and the IP address the request came from, purely to prevent abuse (e.g. someone repeatedly guessing codes or spamming OTP requests to a number). Old OTP and email-verification records are purged automatically on a rolling basis (records older than about 24 hours are cleared out by a scheduled cleanup job) — they are not kept indefinitely.

Device and session information

Every time you log in — on the website or the Android app — we record a "device" entry tied to your account: a device name derived from your browser/app user-agent, your IP address, and login/last-seen timestamps. This is what powers the "your devices" panel on your dashboard, where you can see and log out your own active sessions. Student accounts are capped at 2 concurrently active devices/sessions at a time; logging in on a third device signs the oldest one out automatically. We only keep your most recent 5 device/session records for this history panel.

Exam and lecture activity

• Which mock tests you attempt, your selected answers per question, your score, correct/wrong/unattempted counts, and start/completion timestamps.
• Which video lectures you've watched and your progress through them.
• Enrollment requests you submit for a course (name, phone, email, and any message you add).

Usage analytics

We use Google Analytics on the website to understand how visitors use Saral Pathshala (pages viewed, general traffic patterns, device/browser type). Google Analytics may set cookies and collect information such as your IP address and browsing behavior on our site, subject to Google's own privacy policy.

2. How We Use Your Information

• To create and secure your account — verifying your phone number, authenticating your logins, and preventing unauthorized access.
• To deliver the service you signed up for — showing you the right courses, letting you attempt mock tests, scoring them, and showing you leaderboards and result analytics.
• To communicate with you — OTP codes, password-reset codes, and account/service-related emails or SMS (e.g. confirming an enrollment request).
• To protect exam integrity — detecting and reviewing suspected cheating in mock tests (see below).
• To protect the platform — rate-limiting login attempts, blocking spam registrations (via reCAPTCHA and honeypot checks), and investigating abuse.
• To follow up on enrollment requests — when you request enrollment in a paid course, our staff use your name/phone/email to contact you and process the enrollment manually.

We do not sell your personal information to third parties.

3. Exam Integrity & Anti-Cheat Monitoring

Because mock test results feed into leaderboards and are used by students to gauge their real readiness for competitive entrance exams, we run automated integrity checks on every attempt. You should know, in plain terms, what we monitor:

• Tab-switching / focus-loss / blocked-shortcut events reported by your browser or the app while an exam is in progress are counted as "violations" against that attempt.
• Answer-sync heartbeats — the exam periodically syncs your progress to our server while you're taking it (roughly every 60 seconds). An attempt that was never synced even once, combined with an implausibly fast completion time relative to the number of questions answered, is automatically flagged for review, since it's a strong signal the answers were submitted programmatically rather than filled in through the real exam interface.
• An attempt accumulating enough violations (or matching the pattern above) is marked internally as flagged. Flagged attempts are visible to our staff for manual review and, for confirmed cheating, we reserve the right to withhold, adjust, or exclude the result from leaderboards.
• For select exams, our staff can also apply a manual leaderboard placement (for example, to merge in results from a physical/offline sitting of the same exam, or to correct a placement after a review) — this is a manual admin action, not automatic.

We do not record your screen, camera, or microphone during exams. What we monitor is limited to the browser/app-level signals described above.

4. Video Lecture Access

Lecture videos are not publicly downloadable and the underlying video source is never exposed in any page or API response you can inspect. Instead, playback is granted through a short-lived, single-use access token issued only to your logged-in, enrolled account, valid for about a minute and tied specifically to you and that lecture. This protects our instructors' content from redistribution and also means we can tell, at a technical level, which account requested playback of which lecture.

5. Third Parties We Use

We share the minimum data necessary with a small number of service providers that help us run Saral Pathshala:

• Google reCAPTCHA — used on login, registration, and password-reset forms to block automated bots and spam. Google processes some technical/browser data to compute a risk score; see Google's privacy policy.
• Our SMS service provider — used to deliver OTP verification codes and password-reset codes to your Nepali phone number. Your phone number and the message content (the OTP) pass through this provider solely to deliver the SMS.
• Email provider (Gmail/Google Workspace SMTP) — used to send account-related emails (e.g. email verification links, notifications).
• Google Analytics — used for aggregate website usage statistics, as described above.

We do not use a third-party payment processor: as described in our Terms of Service, course enrollment currently runs through a request/manual-approval process handled directly by our staff, not an automated online payment gateway.

6. How We Secure Your Data

• Passwords are hashed (never stored in plain text) using Django's standard PBKDF2 hashing.
• The website and app communicate over HTTPS.
• API/app authentication uses JWT access and refresh tokens; refresh tokens rotate on use and old ones are blacklisted, so a stolen refresh token can't be replayed indefinitely.
• Student accounts are capped at 2 concurrent devices, and you can review and revoke your own active sessions from your dashboard at any time.
• Video lecture playback uses short-lived, single-use signed tokens rather than exposing a permanent video link, and the app applies screenshot/screen-recording protection while playing lectures or taking exams where the device supports it.
• Exam scoring and correct answers are computed and stored server-side only — they are never sent to your browser or app in a way that could be read before you submit.

No system is 100% immune to compromise, but we take reasonable, industry-standard measures to protect your account and data.

7. Data Retention & Deletion

We keep your account and exam-history data for as long as your account is active, since results, progress, and leaderboard history are part of the service itself. Short-lived verification records (OTPs, email tokens, password-reset tokens) are automatically cleared on a rolling ~24-hour basis once used or expired.

8. Your Rights

You can:

• Access the personal data we hold about you (contact us).
• Correct inaccurate account information (name, email, phone, course interest, etc.) — contact us, or update it directly from your dashboard where supported.
• Request deletion of your account and associated personal data via our Account Deletion page, subject to any records we're required to keep for legal or anti-fraud reasons.
• Ask questions about how your data is used.

Deletion requests are processed manually by our team within 24 hours; access/correction requests go through our support team.

9. Children & Students Under 18

Saral Pathshala is built for students preparing for entrance exams such as IOE, CEE, B.Sc. CSIT/BCA, CMAT, and B.A. LLB, as well as +2/board-level preparation. Most of our users are 16 and older, but we recognize some students preparing for board-level exams may be minors. We do not knowingly collect more information from a minor than is needed to provide the service (name, email, phone for OTP verification, and academic level/interest), and we encourage parents/guardians of minors to be involved in their child's account. If you believe a minor has provided us data beyond what's necessary or without appropriate oversight, contact us and we will address it.

10. Changes to This Policy

We may update this Privacy Policy from time to time as our features change (for example, if we add a new analytics tool or a new SMS/email provider). We'll update the "Last updated" date at the top of this page when we do. Continuing to use Saral Pathshala after a change means you accept the revised policy.

11. Contact Us

If you have questions about this Privacy Policy, or want to access, correct, or delete your data, reach us at:

• info.saralpathshala@gmail.com
• 9761499683
• Kathmandu, Nepal

You can also reach us through our Contact page.