🔒 Privacy Policy

What we collect

• Account: name, email, password (hashed), optional phone
• Profile: age group, city/province, gender (stats only — never public), category
• CNIC: only for volunteers/experts and certificate-verification tiers
• Activity: lessons, exams, AI drills, XP, events — for your dashboard and national reports (aggregated)
• Child accounts: guardian email; minimal data; no advertising tracking

What we never do

• We NEVER sell your data
• No advertising trackers or third-party profiling
• All servers are in Pakistan — data never leaves the country
• Children's full names never appear on public leaderboards

Your rights

You can export (download) your data or delete your account at any time — Dashboard → Settings. Minor accounts are deleted on guardian request. Inactive accounts are automatically anonymized after the retention period.

Security

Passwords bcrypt-hashed, httpOnly session cookies, admin 2FA, daily backups, TLS (Let's Encrypt), rate limiting. Report vulnerabilities: /.well-known/security.txt

Contact

helpdesk@pisa.org.pk · Data-protection questions to the same address