Blush — Privacy Policy

To provide our services, Blush collects these types of information:

• Learning activity — the courses you enrol in, mock-test attempts and scores, video and lesson progress, and doubts or questions you post.
• Account information — your name, email address, phone number (where provided), and a securely hashed password when you create an account.
• Payment information — we never store your card or bank details. Payments are processed by our payment gateway (Razorpay); we retain only a transaction reference, the amount, and the payment status.
• Device & technical data — device model, operating-system version, app version, crash and diagnostic logs, and a push-notification token (only if you allow notifications).
• Usage analytics — aggregated, non-identifying measurements of how features are used, so we can improve the product.

Blush processes your information only for these purposes:

• To detect and prevent fraud, abuse and policy violations.
• To process payments and issue invoices and receipts.
• To send you course-related notifications — only after you opt in.
• To create, secure and maintain your account.
• To deliver the courses, live classes, notes and mock tests you have access to.
• To respond to your support requests and doubts.
• To meet our legal, tax and accounting obligations.

Blush does not sell or rent your information. We share it only with the following parties, and only as far as needed:

• Firebase Cloud Messaging (Google) — to deliver push notifications — your device token only.
• Razorpay — our payment processor, to take payments and issue refunds.
• Cloud infrastructure providers — such as Hetzner and Vercel, acting as data sub-processors under confidentiality agreements.
• Law enforcement or regulators — only where we are legally compelled by a valid order under Indian law.

These providers act on our instructions and may not use your data for their own ends.

Blush is designed for learners aged 13 or older. Users under 18 should use the app and make purchases only with permission from a parent or guardian. We do not knowingly gather information from anyone under 13, and we remove any such data as soon as we become aware of it.

Under the DPDP Act and Google Play’s policies, you have the right to:

• Nominate another person to exercise these rights on your behalf, as provided under the DPDP Act.
• Withdraw consent for any non-essential processing at any time.
• Delete your data, subject to legal retention requirements.
• Access a copy of the personal data we hold about you.
• Correct information that is inaccurate or out of date.

Contact [email protected] to act on any of the above, and we will get back to you as the law requires.

We keep your account data for as long as your account stays active. You can request deletion at any time using the in-app “Delete my account” option or by emailing [email protected]. We delete your personal data within 30 days, except records we are legally required to retain for tax, accounting or compliance reasons (typically up to 7 years).

Security is built in: passwords are stored only as bcrypt hashes, every connection is protected with TLS 1.2 or above, and backups are kept encrypted. We review our security posture regularly and remediate critical vulnerabilities within 72 hours.

If we make a material change to how we handle your data, we will notify you in the app and update the “Last updated” date at the top of this page. Continuing to use Blush after a change takes effect means you accept the revised policy.

Questions or complaints about how we treat your data? Write to [email protected]. We respond to grievances as soon as we can and within the limits set by the DPDP Act.