Privacy Policy

1. Overview

JZunto ("we", "our", or "us") is committed to respecting your privacy and protecting the personal data of our users, students, and educators. This Privacy Policy outlines what information we collect when you use our platform (jzunto.app), how we use it, and the security measures we employ in adherence to the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

2. Information We Collect

We collect only the minimal data required to provide exam preparation services:

• Account Credentials: Full name, institutional or personal email address, and an encrypted password hash. We never store plain-text passwords.
• Academic Profile Data: Current MCA semester (1, 2, 3, or 4), college or institute name (optional), and chosen elective subjects.
• Practice & Generation History: Records of practice papers generated, timestamps, subject codes, and custom parameters used during your exam drills.
• Technical Logs: IP address, browser user-agent, and error logs collected for system diagnostics and fraud/abuse prevention.

3. How We Use Your Data

Your information is used strictly to:

• Authenticate your account session and maintain secure JWT tokens.
• Display your practice history and provide PDF download access to past papers.
• Enforce fair-use generation limits and maintain platform availability.
• Improve syllabus alignment and fix erroneous questions reported by students.

We do not sell, rent, or monetize your personal information to third-party advertisers or lead-generation brokers.

4. Third-Party Advertising & Google AdSense Disclosures

JZunto may partner with third-party advertising vendors, including Google AdSense, to display relevant advertisements across eligible public informational and marketing pages of our website.

• Advertising Cookies: Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to JZunto or other websites across the Internet.
• Ad Personalization & Opt-Out: Google's use of advertising cookies enables it and its partners to serve ads to users based on their browsing activity. You may opt out of personalized advertising at any time by visiting Google Ads Settings.
• Industry Opt-Out Channels: You can also opt out of participating third-party vendors' use of cookies for interest-based advertising by visiting the Network Advertising Initiative or aboutads.info.
• Strict Protection for Academic & Private Workflows: In compliance with Google Publisher Policies, advertisements are strictly prohibited and never served on student dashboards, active practice exam sessions, paper generation interfaces, account authentication screens, or administrative management portals.

5. Website Analytics & Google Analytics 4 (GA4) Disclosures

We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, to measure aggregate website traffic, understand visitor acquisition channels (including Google organic search, referral domains, and educational campaigns), analyze academic resource interest, and optimize platform navigation.

• Strict Prohibition of Personally Identifiable Information (PII): In strict compliance with Google Analytics Policies and the DPDP Act 2023, JZunto never transmits personal data to Google Analytics. Student names, email addresses, phone numbers, passwords, student identifiers, authentication tokens, generated practice questions, and private academic performance records are completely excluded from analytics collection.
• IP Anonymization & Data Hygiene: IP anonymization is authoritatively enforced on all measurement beacons. All URL query parameters are automatically filtered prior to transmission to strip any inadvertently exposed tokens or credential keys.
• Measurement Scope: We measure aggregate, non-personal metrics such as page views, public curriculum searches, syllabus resource downloads, practice-paper completion milestones, and technical device categories (mobile, desktop, tablet).
• Consent Mode v2: Analytics measurement strictly honors your consent preferences using Google Consent Mode v2 standards.
• Analytics Opt-Out: You can prevent Google Analytics from recognizing your visits on return visits by disabling cookies in your browser or by installing the Google Analytics Opt-out Browser Add-on.

6. Federated Identity & Sign in with Google Disclosures

JZunto provides an optional, privacy-conscious Sign in with Google and Sign up with Google authentication feature powered by official Google Identity Services (GIS).

• Identity Attributes Received: When you authenticate using your Google Account, JZunto receives your unique Google subject identifier (sub), your verified Google email address, your display name, and your profile picture URL (if available).
• Purpose of Processing: We process your unique Google sub to uniquely and securely identify your account without storing third-party passwords, your verified email address to maintain your student account records, and your name and profile picture to personalize your student dashboard workspace.
• Database Association: Your unique Google identifier is stored in JZunto's encrypted PostgreSQL database (google_id with strict uniqueness constraints). We never request or access Google Drive, Gmail, Contacts, Calendar, or any auxiliary Google APIs.
• Cryptographic Verification & Session Security: Google ID tokens are verified server-side using Google's cryptographic public keys (enforcing valid signatures, audience matching, trusted issuer, and unexpired lifetime). Google tokens are never stored as session tokens. Following verification, JZunto issues its own isolated, secure, HttpOnly, encrypted session cookies (jz_access_token, jz_refresh_token). Credentials are never stored in browser localStorage or sessionStorage.
• Strict Role Boundaries: Google authentication is restricted strictly to non-admin student accounts. Administrative portals cannot be accessed or provisioned through Google Sign-In.
• Compliance with Google User Data Policy: JZunto adheres strictly to the Google API Services User Data Policy, including Limited Use requirements where applicable.

7. Data Storage & Security

All application data is securely hosted on high-availability PostgreSQL infrastructure provided by Neon Inc., utilizing automated TLS 1.3 encryption in transit and AES-256 encryption at rest. Passwords are salted and hashed using industry-standard bcrypt algorithms.

8. Your Rights as a Data Principal

Under the DPDP Act 2023, you have the right to request access to the personal data we hold about you, request rectification of inaccurate records, or request complete erasure of your account and associated generation logs.

To exercise these rights, email our team at support@jzunto.app.

Administrative Oversight: Outbound support correspondence, system notifications, and inbound inquiries may be mirrored to authorized administrator supervision destinations for quality control, audit compliance, and service reliability. Verification and security audit notifications never contain raw passwords or accessible session credentials.