My dashboardSign in

Privacy notice

VERSION 1 · EFFECTIVE 4 OCTOBER 2026

This notice explains what personal data Arrowbox collects, why, who it goes to, how long it is kept and what you can do about it. We collect as little as the service needs, we don’t sell it, and we don’t use it for advertising.

1. Who we are

Arrowbox is run by Arrowbox Pvt. Ltd., a company in India, with its registered office at Sobha Dream Acres, Balagere Main Road, Bangalore, Karnataka, India. For your data, we are the data fiduciary (the “controller”). Write to privacy@arrowbox.example about anything in this notice.

2. What we collect

Your account

  • Your email address, a username and your password, which is stored only as a secure hash.
  • If you sign in with Google: your Google account’s email address, name and an identifier for the account, which Google shares with us when you agree. We never see your Google password.
  • The devices you’re signed in on (browser and rough device type), so you can see and end sessions.

Your reading

  • When you’re signed in: which sections of each topic you’ve read, your quick-check answers and scores, and the days you read (for your streak).
  • Feedback you choose to send: whether a section helped, problems you report and the coming-soon topics you ask to hear about. Signed out, it is kept with a code made from your IP address and a value that changes every day, so it can’t be traced to you or linked across days; the IP address itself isn’t stored.

If you subscribe

  • Your billing name, billing country and address, the plan, prices and dates, and the status of each payment, so we can bill you, issue receipts and meet tax law.
  • Your card or UPI details go straight to Razorpay, our payment processor. We never receive or store them; we keep only references to the payment, how you paid (card, UPI and so on) and, for a card, the network (such as Visa), whether it is credit or debit and whether it was issued outside India, as Razorpay reports them.

Technical data

  • Server logs: the time, the page or API address, the response and your IP address and browser, kept briefly to run and secure the service, for 30 days.
  • Page speed measurements from a sample of visits: load and response times, the page, the window width and connection type. They carry no cookie or identifier. Browsers that send Global Privacy Control or Do Not Track aren’t measured.

3. Analytics, only if you allow it

Analytics is off unless you turn it on in Privacy choices (the banner, or the link at the foot of every page), where you can turn it off again at any time. If your browser sends Global Privacy Control or Do Not Track, it stays off. With it on, your browser tells our own servers how pages are used: which pages and sections were read, whether quick-check answers were right (not which option you chose), how many results a search found (not what you typed) and which coming-soon topics you looked at. It is tied to a random code kept in your browser, not to your account, email or IP address, and the code is deleted when you turn analytics off. It isn’t shared with anyone or used for advertising.

4. Why we use it

  • To provide the service you asked for: your account, sign-in, progress and your subscription and receipts.
  • With your consent: analytics, and emails about topics you ask to hear about. You can withdraw consent at any time.
  • To keep Arrowbox safe and working: security, preventing abuse, fixing faults.
  • Because the law requires it: tax and accounting records, and answering lawful requests.

We don’t sell personal data, show advertising, or make decisions about you by automated means alone.

5. Who we share it with

Only with service providers who process it for us, under contract, for the purposes above:

  • Amazon Web Services: hosting and database, in Mumbai, India (ap-south-1).
  • Razorpay: payment processing, in India.
  • Google: sign-in, only if you choose “Continue with Google”.
  • Amazon Web Services (Amazon SES): sends our emails, such as sign-in links and receipts, from Mumbai, India.
  • Sentry: error reports when something breaks, with the page, the error and technical details about the browser. We strip passwords, tokens and payment details before they are sent. Sentry may process them outside India.

We may also disclose data where the law requires it, or to protect people’s safety or the service. Fonts are served from our own servers, so loading a page doesn’t contact a font provider.

6. Where it is stored

Your data is stored in India. Some providers may process it in other countries; where they do, we rely on the protections the law requires for such transfers.

7. How long we keep it

  • Your account, progress and feedback: for as long as your account exists.
  • When you delete your account, your personal data is erased within 30 days, including from backups as they cycle out.
  • Billing and tax records: for 8 years, as Indian tax law requires, then deleted.
  • Analytics records and server logs: 30 days, then deleted.

8. Your rights

You can:

  • see and export your data, from your account page (“Your data”);
  • correct your details, from your account page;
  • delete your account and its data, from your account page;
  • withdraw consent to analytics or emails at any time, as easily as you gave it;
  • nominate someone to exercise these rights for you if you die or become unable to;
  • complain to us, and if you aren’t satisfied, to the Data Protection Board of India (or your local regulator if you live elsewhere).

For anything you can’t do from your account, write to privacy@arrowbox.example. We reply within 5 working days.

9. Grievance officer

Rakesh Ranjan, Grievance Officer, privacy@arrowbox.example, Arrowbox Pvt. Ltd., Sobha Dream Acres, Balagere Main Road, Bangalore, Karnataka, India. We acknowledge a grievance within 24 hours and resolve it within 15 days.

10. Cookies and browser storage

Arrowbox sets one cookie, to keep you signed in. There are no advertising or third-party cookies. Your browser’s local storage keeps a few preferences (reader zoom, dismissed tips, whether to offer quick checks, your privacy choices), your progress while you’re signed out, and the analytics code only if you allow analytics.

11. Age

Arrowbox is for people aged 18 and over. We don’t knowingly collect data from anyone younger; if you believe a child has an account, write to us and we’ll delete it.

12. Security

Data travels over encrypted connections, passwords are hashed, and access to production data is limited to the people who need it. No system is perfectly secure; if a breach affects your data, we’ll tell you and the authorities as the law requires.

13. Changes to this notice

When we change this notice, we update the date at the top. For a change that matters, we’ll tell signed-in readers by email or on the site before it takes effect.