Privacy and children's data

A Siddhi account belongs to a parent or guardian. Only an adult can create one, and only an adult can make a payment.

Children get a login under that account. A child account has a username chosen by the parent, not an email address, and cannot make payments, change plans or see billing information.

From the parent: name, email address and a hashed password. Payment details are entered inside Razorpay's own window and are never sent to or stored on our servers.

From the child: the first name and username the parent chose, a hashed password, and their progress through the lessons — which lessons were opened, which were completed and quiz scores.

Automatically: the IP address and browser user-agent attached to each sign-in, kept so we can spot account misuse.

We do not show advertising to children, and we do not sell or share personal data with advertisers.

We do not ask children for an email address, a phone number, a photograph or a home address.

We do not build behavioural profiles for anything other than showing a child their own progress and showing their parent the same.

Passwords are never stored in a readable form. Each one is hashed with scrypt using a per-user random salt, so the stored value cannot be reversed into the original password.

Sessions are stored server-side. The cookie in the browser holds a random token; only a SHA-256 hash of that token is stored in our database.

Account and progress data is kept while the account is open. If a parent asks us to close the account, we delete the parent record and every child record under it, along with their progress.

Payment records are kept for as long as tax and accounting rules require, even after an account closes. These contain the amount, date and Razorpay reference — never card details.

Sign-in and security audit entries are kept for 12 months.

A parent can ask for a copy of everything held about their family, ask for corrections, or ask for the whole family record to be deleted. Write to the support address and we will act within 30 days.

Deleting the account removes the children's records too — a child's data is never kept once the parent's account has gone.