Digital Personal Data Protection Act 2023
Privacy notice
The short version: everything here works without an account. We do run Google Analytics on every page — this notice says exactly what that means, including the part that does not flatter us.
Every lesson, calculator and reference page works with no account. If you choose to create an account so your progress is saved, we store your name, your age band, your email and what you have completed — and nothing else. We run Google Analytics on every page, which means Google receives a record that a browser like yours opened a page like this one; your account details are never sent to it. We run no advertising, no retargeting and no session recording. We do not sell or share your data. You can delete your account and everything in it at any time.
Who is responsible
MoneyLingo is the Data Fiduciary — the law's name for the organisation responsible for your data — for everything described here. Questions about how your data is handled go to privacy@moneylingo.in. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
If you are under 18
Under Indian law, anyone under 18 is a child. That is different from Europe or the UK, where the line is 13 or 16, and it means the strictest rules apply to most of the people this site is built for.
What that means in practice:
- You do not need an account to use anything here. All the learning material and all the calculators are open.
- If you want an account so your progress is saved, we have to ask a parent or guardian first and verify that they really are one. Until they confirm, we do not store any progress — not hidden, not saved for later. We simply do not write it.
- We do not advertise to you, retarget you, or build a profile to predict what you will do next — and a parent cannot agree to those on your behalf either.
- The honest part: the law says a site should not do behavioural monitoring of anyone under 18 at all, and that a parent cannot consent to it on your behalf. Google Analytics is a form of it, and we run it anyway. That is a decision the site's owner made deliberately, and you are entitled to know it rather than read a promise we are not keeping. If you would rather not be counted, browser settings or an ad blocker will stop it, and nothing on this site will stop working.
- The minimum age for an account is 13.
What we collect
Without an account: nothing that identifies you to us. No name, no email, no fingerprint, and no server-side record of which page you read. Google Analytics does set its own cookies in your browser and does count the page — see the cookies section below for exactly which ones. Your theme choice and whether the optional navigation rail is switched on are stored on your device and never leave your browser.
With an account: a display name (a nickname is fine), your email address, your age band, and your learning progress. Note that we ask for your year of birth, not your full date of birth, and store only the band — because the band is all the law requires us to know.
What we deliberately do not collect: your location, your contacts, your phone number, your PAN or Aadhaar, your income, your bank or investment details, or any advertising identifier. We are not a regulated financial entity and we have no lawful need for any of it. If a site offering financial education asks you for your PAN, that is worth asking about.
What we do with it, and what we refuse to
We do this
- Recording that a lesson or quiz was completed, so the learner can see their own progress.
- Showing a learner their own progress, badges and streak.
- Showing a teacher completion and quiz performance for their own class.
- Platform-wide aggregate counts computed on our own servers from data we already hold.
- A reminder on a fixed schedule that the learner or their parent switched on.
- Aggregate pageview measurement through Google Analytics, on the owner's instruction — see ACCEPTED_COMPLIANCE_GAPS.
We refuse to do this
- Session replay, heatmaps, or any recording of what a visitor does on a page.
- Any advertising or retargeting SDK, on any surface.
- Building a behavioural profile to predict churn or to lengthen a session.
- A/B testing engagement mechanics on anyone under 18.
- Retention or cohort analysis keyed to identifiable children.
- Sending a user ID, email, age band or learning progress to Google Analytics or any other third party.
- Notification timing derived from an individual child's usage pattern.
- Exporting gamification state to any marketing or profiling system.
- Targeted advertising to anyone, of any age.
Cookies and trackers
We set 2 strictly necessary preferences (theme, sidebar), which stay on your device. Google Analytics sets 2 cookies (_ga, _ga_YTTM0P2P5T) to count visits. We set no advertising cookie of any kind. We load one third-party script.
There is no cookie banner, and analytics runs without asking you. We are not going to dress that up: a banner would be the correct thing to build, and it has not been built. Showing you one that did not actually gate the tag would be worse than showing you none, so until it exists this paragraph is the disclosure.
These are vendors we considered and turned down, and why — recorded here so the decision outlives whoever made it:
| Vendor | Why not |
|---|---|
| PostHog | Product analytics with per-person profiles and session replay. |
| Mixpanel | Behavioural profiling is the product. |
| Microsoft Clarity | Session recording. Records a child using the site. |
| Hotjar | Session recording and heatmaps. |
| Meta Pixel | Advertising retargeting. Prohibited for children in terms. |
| Google Ads / AdSense | We run no advertising at all — see REVENUE_PROMISES. |
| Any A/B testing SDK | Experimenting on minors to optimise engagement. |
Where your data lives
Course-progress data is stored in Google Firebase with India (Mumbai) selected as its region, and the site is served from Mumbai. Sign-in itself runs on Google's authentication service, whose identity records may be processed on Google infrastructure outside India. We send personal data nowhere else.
Your rights
Under the DPDP Act you can ask us to:
- tell you what data we hold about you and who we have shared it with (nobody);
- correct anything that is wrong;
- delete your account and everything in it;
- nominate someone to exercise these rights if you cannot;
- withdraw consent, which must be as easy as giving it.
Deletion is completed within 30 days. Start any of these on your data page or email privacy@moneylingo.in.
Complaints
Our Grievance Officer is reachable at grievance@moneylingo.in. We acknowledge within 24 hours and aim to resolve within 15 days. See the grievance page for the full process.
Pre-launch note. This notice describes the design as built. The named Grievance Officer and Data Protection contact, and the verifiable parental consent mechanism, must be finalised and reviewed by Indian counsel before accounts are opened to the public.