Privacy

Who we are

Ado is a daily quiz and puzzle league for players aged 6 to 22. This notice explains what personal data we process, why, for how long, who helps us process it, and the rights you have under India’s Digital Personal Data Protection Act, 2023 and its Rules.

The Data Fiduciary is Reto Interactive Private Limited.

We never sell personal data, show advertising, or use a player’s data to profile or target them.

If you are a parent or guardian

A child under 18 never creates an account. You create it in the app, after a question about your age, by signing in with Google or a code sent to your email; the device then stays signed in until you sign it out. A TV signs in with the code it shows, once you approve it in the app on a device already signed in. You give verifiable consent for each child. Before you agree, pay or delete, the app asks for the device to be handed to you. A child’s own device can be linked with a one-time code. You can change each choice or withdraw consent at any time from your account.

For players under 18 we do no tracking, no behavioural monitoring and no targeted advertising, as section 9(3) of the Act requires. The app on your child’s device carries no analytics, advertising or tracking code.

A family account can also hold players aged 18 to 22, such as an older brother or sister on the family TV. They agree for themselves the first time they play; you still manage the profile and see its reports. When your child turns 18 they keep the profile and agree for themselves before they play again. If they want an account of their own, you can hand the profile over to them.

If you are 18 to 22

You can hold your own account, or play on a family account. On your own account you consent for yourself and nobody else sees it. On a family account you agree for yourself the first time you play; the account holder manages your profile, sees its reports and can withdraw it. Either way your profile plays only against other players aged 18 to 22, never with anyone under 18.

If the age you gave for your own account looks like it may be under 18, we may ask a parent to hold the account; until that is settled the profile is suspended, never deleted.

What you consent to

Each purpose is listed separately, so you can give or refuse each one. Refusing a purpose that is not required changes nothing else.

• Your account (for the account, required). Creating and running your account: your email address and sign-in, the devices signed in to it, the consent records, and the messages we must send you (sign-in codes, erasure notices, changes to this notice).
• Play and ranking (for each profile, required). A player profile and its play: the age band (worked out from the date of birth), the made-up handle, a PIN when the account holds two or more players, the answers given and how fast, the skill rating, XP, leagues, streaks, trophies and the boards that show the handle to other players of the same age band.
• Class board (for each profile, optional). Showing the profile on its class board, with its name when one was added, to the class and its teacher. Off unless you choose it.
• The player’s name (for each profile, optional). Showing the name you add beside the handle, for anyone to see: on the public profile page, share cards, certificates and every board. A child shows a first name only; a player aged 18–22 may add a last name. Never with a school, city, class, grade or age. Off unless you add a name; removing the name, or switching this off, takes it down. Our team reviews every name and removes any that breaks the rules.
• Weekly report by email (for the account, optional). A Monday email about each profile’s week: its handle, band and results. Never a name or a date of birth.
• Notifications on the device (for each profile, optional). Notifications on a linked device when the daily is ready or a league is closing. The text is generic and names no one.
• Weekly report on WhatsApp (for the account, optional). The weekly report on WhatsApp, to a number you have verified. Reply STOP at any time to end it.
• Creative challenges (for each profile, optional). Sending written answers and drawings to creative challenges, and voting on other players’ work. Everything is checked before anyone else sees it; photos are re-encoded and their originals deleted after 90 days.
• School board (for each profile, no longer used). No longer used: there is no school board. A consent that included it is kept as given and can still be withdrawn.

What we keep, why, and for how long

This list is generated from the same inventory our database is checked against. Each entry says why we keep it, for how long, on what basis, what happens when you ask for erasure, and who processes it for us.

About each player profile

What we hold, in short: names and identifiers (handle, the player’s name when added, account ids); date of birth (only to work out the age band); school board and class; country (optional; never anything finer); secrets, stored only as hashes (PIN, device and one-time codes); device identifiers and notification tokens; what a player or account holder writes, draws or answers.

• The player profile: age band, handle, an optional name (a first name; a player 18–22 may add a last name), a PIN when the account holds two or more players, school board and class (under 18), optional country and friend code, and when a player 18–22 on a family account agreed for themself (a family account’s player 6–22, or a self-managed student 18–22). Kept: Until erasure is requested; pseudonymised then so shared league results stay consistent. Basis: your consent. On erasure: the personal fields are removed and the rest stays without them. Processed by: Supabase, Vercel.
• The push token of a linked device, so the app can say the daily is ready or a league is closing. Generic copy only; nothing personal is sent. Kept: Until the device link is revoked or the token is replaced; purged on erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel, Expo.
• Links a device to a player, through the account signed in on it or a one-time code; stores only a hash of the device secret. Kept: Until unlinked or the device is signed out, or 180 days after linking (longer while the device stays signed in). Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Single-use six-digit codes a parent shows to link a device. Kept: 15 minutes of validity; purged with the child on erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• The optional handover: a single-use code a parent issues so a player aged 18–22 can move their profile to their own account and consent for themself. Kept: 14 days of validity; purged with the profile on erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Which class a child is in: the account holder joins them (the join is the approval), and the teacher may remove them. Kept: Until erasure. Leaving, a teacher’s removal and the 18th-birthday handover end a membership but keep its row (with the time it ended), so a profile a teacher removed cannot rejoin with that class’s code. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A child’s place in a week’s cohort and how the week ended for them. The league tier also shows on the profile’s public page (`/u/<handle>`: the handle, and the name the player chose to show). Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A child’s XP for a league week, kept in step with the XP ledger, for boards. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Append-only record of every XP award. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Append-only record of every change to a child’s skill rating. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A child’s skill rating per domain (Glicko-2), which drives stars and rank. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Append-only record of each answer a child gave, how fast, and its effect on rating. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Append-only record of which items a child was served and the server deadline for each. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Append-only nightly snapshot of a child’s rank, used by the Rank Card and share cards. The latest title and rank, and the last 90 days of rank history, also show on the profile’s public page (`/u/<handle>`: the handle, and the name the player chose to show), and the title and rank on the band’s Global board, to the other players in the band. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel, Inngest.
• A child’s run of consecutive days with the daily done, and the week whose one streak freeze was used. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Permanent badges a child has earned (e.g. streak milestones). They also show on the profile’s public page (`/u/<handle>`: the handle, and the name the player chose to show). Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• League crowns, podiums and placements in a child’s Trophy Room. The crown and podium counts also show on the profile’s public page (`/u/<handle>`: the handle, and the name the player chose to show). Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Per-child daily budgets (rated practice, XP, free syllabus practice for a profile without a membership, creative votes) that keep play fair, the friend requests a profile sends today (for the daily request limit). Kept: Until erasure; a row is only meaningful on its day. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Append-only record of a child’s blind votes on other children’s creative work. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A child’s hypothetical answers and art uploads, moderated before anyone sees them. Kept: Until erasure; then the content and the child link are removed and an empty row remains so other children’s votes stay consistent. Photo originals expire after 90 days. Basis: your consent. On erasure: the personal fields are removed and the rest stays without them. Processed by: Supabase, Vercel, Cloudflare R2, Google Gemini API, Google Cloud Vision.
• Reports a child made about other children’s content, with a closed reason list. Kept: Kept for 3 years after erasure as the safety record (24-hour SLA). Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel.
• Append-only record of every moderation decision on a child’s content (no content). Kept: Kept for 3 years after erasure, as the safety record of every moderation decision. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel, Google Gemini API, Google Cloud Vision.
• Children a child has chosen to hide from their own view. Kept: Until unblocked or erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A friendship between two profiles on the same side of 18, asked for by one player and accepted by the other; it ranks the friends board. Kept: Until either profile is erased; the whole row goes, for both sides. A closed link stays as the record of the request until then. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A child’s 60-second sprint: what they answered, how many were right, the XP earned. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Append-only record of each card a child shared (which moment and format), counted for the share metric. The rendered card (handle, the name the player chose to show, standing or today's practice score, avatar) is cached in a private Cloudflare R2 bucket under a key that names no one, and expires there after 2 days. Kept: Until erasure. Cached card images: 2 days (R2 lifecycle rule). Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel, Cloudflare R2.
• Append-only record of the free premium contests a child has used (the first two), kept per profile so relinking a device cannot reset them. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A child’s entry in a premium contest: member or trial, score, answers and time, and final place in the band. Never rated; boards show handles, and the names players chose to show. Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• The Rank Card frame and accent a child has equipped (ownership is computed). Kept: Until erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A player’s result in a settled cup: cup XP, rank and podium place in their band, and the certificate drawn from it (the handle, and the name the player chose to show). Kept: Until erasure; the certificate file is deleted with it. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel, Cloudflare R2.

About the account holder

What we hold, in short: names and identifiers (handle, the player’s name when added, account ids); contact details (email address, a verified WhatsApp number); secrets, stored only as hashes (PIN, device and one-time codes); device identifiers and notification tokens; what a player or account holder writes, draws or answers; amounts paid or refunded (never a card, UPI id or bank detail).

• The account holder: a parent (for players 6–22 on a family account) or a student aged 18–22 for themself — sign-in, verifiable consent and reports. Kept: Until erasure is requested; pseudonymised then. The auth id is nulled once the sign-in identity is deleted (within hours). Basis: your consent. On erasure: the personal fields are removed and the rest stays without them. Processed by: Supabase, Vercel, Resend, Meta (WhatsApp).
• Keeps a device signed in to the account: which device, how it signed in and when; stores only a hash of the device secret. Kept: Until signed out or ended from another device, or 180 days after the device last used it (a year at most); purged on erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Signs a TV in to the account with the code it shows, once approved on a device already signed in; stores only hashes of its codes. Kept: 10 minutes of validity, then deleted within a day; purged on erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• Append-only record of each parental consent granted or withdrawn, with the notice hash. Kept: Kept for 3 years after erasure as proof of consent (DPDP s.6(10)). Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase.
• A parent’s request to erase a child or the whole account, with its 48-hour notice. Kept: Kept for 3 years as the record that erasure was requested and completed. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase.
• Append-only record of every AI verdict and human review of content kids see. Kept: Kept for 3 years: the audit of who approved what children were shown. Holds no personal data beyond the reviewer id. Basis: a legitimate use the law allows. On erasure: kept as a legal record. Processed by: Supabase, Vercel.
• Teacher accounts: a self-serve teacher who signed up on the web (no school), or an older school invite and the sign-in it became. Kept: While the teacher account is live; pseudonymised on erasure. Basis: a legitimate use the law allows. On erasure: the personal fields are removed and the rest stays without them. Processed by: Supabase, Vercel, Resend.
• One row per paying account holder: the random token that ties an App Store or Google Play purchase to the account (StoreKit `appAccountToken`, Play `obfuscatedAccountId`) without telling the store anything about it. Kept: Until erasure. Basis: a legitimate use the law allows. On erasure: deleted. Processed by: Supabase, Vercel, Apple App Store, Google Play.
• An account holder’s membership subscription at Razorpay, the App Store or Google Play: plan, status, billing period and the profile an individual plan covers. Never a card, VPA, bank detail or contact. Kept: Kept for 8 years after erasure as the record behind the payments (tax and accounting law). Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel, Razorpay, Apple App Store, Google Play.
• Append-only ledger of membership charges, refunds and chargebacks: provider ids and the amount in paise. Never a card, VPA, bank detail or contact. Kept: Kept for 8 years after erasure (tax and accounting law). Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel, Razorpay, Apple App Store, Google Play.
• Append-only receipt of each signed billing event from Razorpay, Apple or Google: its id, type, outcome and a hash of the body (never the body), so every delivery applies once. Kept: Kept for 8 years after erasure with the payments it explains. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel, Razorpay, Apple App Store, Google Play.
• A sign-up through a friend code: which account referred which, once, and whether a reward was granted (rewards are off until the owner sets them). Kept: Until either account is erased. Basis: a legitimate use the law allows. On erasure: deleted. Processed by: Supabase, Vercel.
• What an account is entitled to and until when: from a subscription, a referral reward or a manual grant; for one profile or every profile on the account. Kept: Until erasure. Basis: a legitimate use the law allows. On erasure: deleted. Processed by: Supabase, Vercel.
• Each message sent to an account holder (the weekly report, a verification code): template, channel, the profile a report is about, and its delivery status, so a report goes out once a week and STOP and failures are honoured. Never the message body. Kept: Deleted one year after it was sent, or on erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel, Meta (WhatsApp), Resend.
• A one-time code sent on WhatsApp to verify the number an account holder gave for the weekly report. The code is kept only as an HMAC. Kept: Deleted 30 days after the code expires, or on erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel, Meta (WhatsApp).
• A grievance or a data-principal request (access, correction, erasure, nomination, consent, an age concern, a breach), answered within 90 days. Kept: Kept as the record of the request and its answer. The contact email and any requested correction are removed 90 days after it is resolved, and on erasure; on erasure the request and the reply text go too, and the outcome code stays. The record is kept for 3 years after it is resolved. Basis: a legal obligation. On erasure: the personal fields are removed and the rest stays without them. Processed by: Supabase, Vercel, Resend.
• The person an account holder nominates to exercise their rights if they die or cannot act: a name, an email and the relationship. Kept: While live; deleted 30 days after it is revoked, and on erasure. Basis: your consent. On erasure: deleted. Processed by: Supabase, Vercel.
• A review of a self-declared adult age that may be under 18, and its decision (keys only). Kept: Kept for 3 years as the record of the decision. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel.

Records the law asks us to keep

• Every privacy notice ever shown, so each consent points at the exact text agreed to. Kept: Kept for 3 years after the last consent that points at it. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase.
• Append-only audit trail of consent, creation, export and erasure events. Kept: Kept for 3 years; references pseudonymised ids only after erasure. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase.
• Stored files waiting to be deleted after an erasure or an expiry: the bucket and the random object key only. Kept: Until the file is deleted; then kept for 7 days as proof of deletion. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel, Cloudflare R2.
• A re-consent campaign for a new privacy notice: when it was announced and its cut-off, after which profiles without consent to it are suspended (never deleted). Kept: Kept for 3 years as the record of the campaign. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel.
• A personal-data breach or a drill: its clock (detected, aware, contained, the Board told, people told) and step codes. No personal data. Kept: Kept for 3 years as the breach record. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel.
• Append-only record of each retention run and audit: per-table counts and findings, never row contents. Kept: Kept for 3 years as proof that retention ran. Basis: a legal obligation. On erasure: kept as a legal record. Processed by: Supabase, Vercel.

How long we keep data

Most data is kept while the account or profile exists and is removed when you ask for erasure, after a 48-hour notice in which you can cancel.

Some records are deleted sooner, on a fixed timetable, and a few are kept after erasure because the law asks for them.

• Push tokens: deleted 30 days after it expires, ends or is withdrawn.
• Kid sessions: deleted 30 days after it expires, ends or is withdrawn.
• Link codes: deleted a day after it expires, ends or is withdrawn.
• Account sessions: deleted 30 days after it expires, ends or is withdrawn.
• Device sign ins: deleted a day after it expires, ends or is withdrawn.
• Profile handovers: deleted 90 days after it expires, ends or is withdrawn.
• Client errors: deleted 90 days after it expires, ends or is withdrawn.
• Daily quota: deleted 35 days after it expires, ends or is withdrawn.
• Submissions: original key removed when it expires.
• Message deliveries: deleted 365 days after it expires, ends or is withdrawn.
• Phone verifications: deleted 30 days after it expires, ends or is withdrawn.
• Ops alerts: deleted 365 days after it expires, ends or is withdrawn.
• Storage deletions: deleted 7 days after it expires, ends or is withdrawn.
• Grievance tickets: contact email and correction value removed 90 days after it is closed.
• Nominations: deleted 30 days after it expires, ends or is withdrawn.

Kept as a legal record, including after erasure, for the period shown after the account is erased or the record is closed:

• The exact text each consent points at: for 3 years.
• Proof of consent (DPDP s.6(10)): for 3 years.
• The record that erasure was requested and completed: for 3 years.
• The audit trail of consent, export and erasure: for 3 years.
• The audit of who approved what children were shown: for 3 years.
• The safety record of reports and their handling: for 3 years.
• The safety record of every moderation decision: for 3 years.
• Payment records tax and accounting law asks for: for 8 years.
• Billing events, with the payments they explain: for 8 years.
• The record of each re-consent campaign: for 3 years.
• The record of grievances and their answers: for 3 years.
• The breach record the Board may ask for: for 3 years.
• The record of each age-claim decision: for 3 years.
• Proof that the retention rules ran: for 3 years.

Who processes data for us

These service providers process data only on our instructions and only for the purposes above.

• Supabase: database and sign-in (Mumbai).
• Vercel: website and server hosting (Mumbai).
• Resend: email delivery.
• Inngest: scheduling background jobs (ids only).
• Expo: delivering notifications to devices.
• Cloudflare R2: storing uploaded drawings, rendered cards and certificates.
• Google Gemini API: writing and checking quiz questions, and checking and provisionally scoring written answers, sent with no name or account id.
• Google Cloud Vision: checking uploaded drawings for faces, text and unsafe content (the image only).
• Meta (WhatsApp): delivering the weekly report and verification codes on WhatsApp.
• Razorpay: membership payments outside the app stores.
• Apple App Store: membership bought in the iOS app.
• Google Play: membership bought in the Android app.
• PostHog: anonymous visit counts on the website, with no cookies (never the app).
• Sentry: error reports from the website, with no personal data (never the app).

Processing that is not stored in our database

Some data passes through a provider directly, without becoming a record of ours.

• Counting visits to the public website: page paths with ids removed, no query strings, no cookies, no identity. (on the website) Kept: Kept for 12 months (the PostHog project setting). Basis: a legitimate use the law allows. Processed by: PostHog.
• Finding and fixing errors on the website: stack traces and the page path, never a user, cookie, header, query or form body. (on the website) Kept: Kept for 90 days (the Sentry project setting). Basis: a legitimate use the law allows. Processed by: Sentry.
• Paying for a membership outside the app stores: Razorpay’s own checkout collects the payment method and contact details directly; they never reach us. (on the website) Kept: Held by Razorpay under its own terms and payment law. Basis: your consent. Processed by: Razorpay.
• Buying a membership in the iOS app, after a parent confirms on the device: Apple takes the payment with the Apple Account on the device; we receive only the transaction. (in the app) Kept: Held by Apple under its own terms. Basis: your consent. Processed by: Apple App Store.
• Buying a membership in the Android app, after a parent confirms on the device: Google Play takes the payment with the Google account on the device; we receive only the purchase token. (in the app) Kept: Held by Google under its own terms. Basis: your consent. Processed by: Google Play.
• Sending the weekly report and verification codes on WhatsApp: the number, and the message (a profile’s handle, band and week’s results; never a name or date of birth), pass through Meta. (from our servers) Kept: Held by Meta under the WhatsApp Business terms. Basis: your consent. Processed by: Meta (WhatsApp).

Transfers outside India

Our database and servers are in India. These providers may process data outside India, as section 16 of the Act permits unless the Government restricts a country:

• Resend: email delivery.
• Inngest: scheduling background jobs (ids only).
• Expo: delivering notifications to devices.
• Cloudflare R2: storing uploaded drawings, rendered cards and certificates.
• Google Gemini API: writing and checking quiz questions, and checking and provisionally scoring written answers, sent with no name or account id.
• Google Cloud Vision: checking uploaded drawings for faces, text and unsafe content (the image only).
• Meta (WhatsApp): delivering the weekly report and verification codes on WhatsApp.
• Apple App Store: membership bought in the iOS app.
• Google Play: membership bought in the Android app.
• PostHog: anonymous visit counts on the website, with no cookies (never the app).
• Sentry: error reports from the website, with no personal data (never the app).

If the Government restricts transfers to a country, we stop sending data to any provider there.

Your rights

From your account you can, for yourself and for each player you hold:

• see a summary of the personal data we hold and how it is processed, and download a copy;
• correct or complete data that is wrong, such as a date of birth;
• ask us to erase a profile or the whole account (after a 48-hour notice you can cancel);
• withdraw a consent as easily as you gave it, purpose by purpose;
• nominate someone to exercise these rights if you die or cannot act;
• raise a grievance with us, and then with the Data Protection Board of India.

Grievances

Our grievance officer can be reached at hi@getado.app, or from your account.

We acknowledge every grievance and resolve it within 90 days of receiving it.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Changes to this notice

Every version of this notice is kept, and each consent points at the exact text agreed to (its SHA-256 hash).

When the notice changes we tell you and ask you to consent again. A profile whose account holder does not do so by the date we give is suspended, never deleted, until they do.