Privacy notice

1. Who is responsible for your information

Empathia is operated by [operator name] (“we”, “us”), [operator address]. We decide how and why your information is used, which makes us the “data fiduciary” under the DPDP Act.

• Questions about privacy: [contact email]
• Grievance officer: Grievance Officer — [contact email]

2. What we collect and why

We collect information only when you use Empathia, and only for the purposes listed here.

Please do not write personal details about yourself or other people (such as full names, phone numbers or addresses) in reflections or reports. Activities never require them.

3. What we never collect or do

• We never ask for an exact birth date, photographs, other people’s names, your location, your contacts or proof of kind actions.
• We do not show advertisements and do not sell or rent personal information.
• We do not track children’s behaviour across other websites, build advertising profiles or send targeted advertising.
• We do not use your reflections to train artificial-intelligence systems or for any purpose other than showing them to you.
• Scores and badges celebrate practice. We do not use them to judge, rank or diagnose anyone.

4. Cookies

Empathia uses only the cookies it needs to work. There are no advertising, analytics or third-party cookies, and the site loads no scripts, fonts or trackers from other companies.

5. Why we are allowed to use your information

We use your information with your consent, which you give when you start playing or create an account, and, for children on the paths listed in section 6, with the consent of a parent or guardian. We also use limited information where the law allows it without separate consent, for example to keep the service secure or to comply with a legal obligation.

You can withdraw consent at any time by deleting your guest progress or account (section 10). Withdrawing consent does not affect what was done before, and some records may be kept where the law requires it.

6. Children and guardians

Empathia is designed for learners from age 5. Under the DPDP Act, anyone under 18 is a child.

• Creating an account on these learning paths needs a parent’s or guardian’s email address and their agreement: Little Hearts (Ages 5–8), Growing Together (Ages 9–12), Real World (Ages 13–17).
• Children can also play as guests without giving any contact details. Guest progress stays in that browser.
• Parents and guardians can ask us to see, export, correct or delete a child’s information by writing to [contact email] from the guardian email address on the account.
• There is no messaging between users and no public profile, so children cannot be contacted by other users through Empathia.

If you believe a child has created an account without the right consent, please contact us and we will review and, if needed, delete it.

7. Who can see your information

• You. Your progress, history and reflections are visible to you when you are signed in or using the same browser as a guest.
• Our administrators see totals (for example how many activities were completed) and basic account details such as email and status, to run and support the service. They cannot read reflections, see passwords or see sign-in secrets.
• PrayagEdu Games, if you opened Empathia from it: we report that you started, completed an activity (activity number, level and XP earned) or finished playing, so your school can see participation. We never send your answers, reflections or reports.
• Service providers who host the servers and, if configured, deliver password-reset emails. They process information only on our instructions and must keep it secure.
• Authorities, only when the law requires it.

We do not share personal information with advertisers or data brokers.

8. Where we keep it and how we protect it

Information is stored on servers located in India. We protect it with:

• encrypted connections (HTTPS) for every page;
• passwords stored only as one-way hashes;
• reflections encrypted before they are stored, with a key kept outside the database;
• checks on every request so no one can open another person’s progress or reflections;
• sign-in sessions that can be ended, limits on repeated sign-in attempts, and a record of every administrator action;
• encrypted backups that are rotated regularly.

No system is perfectly secure. If a personal-data breach happens, we will inform affected people and the Data Protection Board of India as the law requires.

9. How long we keep it

When an account is deleted, its progress, reflections and preferences are deleted immediately. A minimal record that the account existed and was deleted (with the email removed) is kept so that administrator records stay accurate. Deleted information disappears from backups when those backups expire.

10. Your rights and choices

• See and download your information: Profile → “Download my data”.
• Correct it: change your nickname, picture, learning path, language and preferences in your profile. To change an account email, write to [contact email].
• Delete it: Profile → “Delete my account” or, for guests, “Delete my guest progress”.
• Withdraw consent: delete your progress or account as above, or ask us to.
• Nominate someone to act for you if you die or are unable to manage your account, by writing to us.
• Raise a grievance with our grievance officer (section 1). If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We aim to respond to every request within 30 days. We may ask you to confirm that the request comes from you, or from the child’s guardian.

11. Changes to this notice

If we change this notice in a way that matters, we will show a message in Empathia before the change takes effect and, where required, ask for consent again. The date below shows when this version took effect.

12. Contact

• [operator name], [operator address]
• Email: [contact email]
• Grievance officer: Grievance Officer — [contact email]