Most privacy policies are written so that nobody finishes them. This one is written to be finished. If something here reads as vague, that is a fault: tell us and we will fix the wording.
The short version
- You can read the whole school without an account, an email address or a real name.
- We do not sell your data. We do not run advertising. There is no ad technology on this site.
- A child never hands us an email address. A teacher makes the account and gives the child a username on a slip of paper.
- Everything held about you is listed on your own page at My Addaly, and you can download all of it as one file.
- The Addaly app for iPhone and Android needs no account, asks for no permissions, and carries no advertising, analytics or tracking code.
What your account holds
This is the whole list, in the order the download gives it. Nothing about anybody else is in it.
- Who you are here. The handle we generated for you, a display name and a short biography if you wrote them, the kind of account it is, how you sign in, the day you joined, when you were last here, and the last IP address we recorded. If a school made your account, the class you are in and the teachers who teach it.
- What you have learnt. The courses you have opened and finished, every lesson you have completed, and for each lesson check the answer you gave first, whether it was right, and whether you went on to the study group.
- Your exam results. When you sat each paper, whether you passed, your score against the pass mark, the modules you were asked to re-read, and any course a pass or a teacher opened for you.
- Your study-group rounds. The question, your first answer, your second answer after the discussion, and the right answer.
- What you told us. The problems you reported, with the page you were on and what you wrote, and any rating you gave a tutor.
- Your use of the AI helpers. A count per day of the chats, images and files you asked for: enough to apply the daily limit that keeps them free for everyone, and no more.
- Your sign-ins. When each session started, when it expires, the browser it came from and its IP address.
- Agreements. Which version you accepted and the day you accepted it.
Two things are deliberately left out of the download. Session tokens, because a file on a shared computer must not be a key to your account. And any legal hold, because the law that requires one requires it to be kept quietly.
What each way in gives us
- A slip from a teacher. A username and a password, both made by the school. No email address, no phone number, no name you gave us yourself. The address on the account is a synthetic one the site invents that can never receive mail.
- Google. Whatever Google returns when you choose it: your name, your email address and your picture. We use the address to keep your account reachable, not to market at you. Nothing is ever written back to your Google account.
- A code to your email address. The address, so the code can be sent, and so you can sign in again later.
- A guest name. Nothing. It lives on the device you are using, and if you clear the browser it is gone.
Email from us
An address you give us gets two kinds of email. Service mail is about your own account: a welcome when you join, a sign-in code when you ask for one, and a notice if something about your account’s security changes. It comes whatever your letter settings are, because an account needs a way to reach its owner.
Letters are a weekly note of where you are and what comes next, and a monthly note of what is new. They go only to an adult who ticked the box for them, never to a pupil, and every copy has an unsubscribe link that works with one click and no sign-in. You can change either choice on your own page, under My Addaly. We keep a record of what was sent to whom and when, so that we can prove a letter was asked for and stop sending to an address that bounces.
The Addaly app
The app for iPhone and Android is the same school, and it holds nothing about you that the website does not. It needs no account. It asks for no permission to use your contacts, location, camera, microphone or photos, and it contains no advertising, analytics, crash-reporting or tracking code.
On your phone it keeps a copy of the course list, so that the app opens without a signal; every lesson you open, so that it opens again without one; any course or textbook you choose to keep; which lessons you have read and where you stopped in each film, so that it can offer to continue; and your answer to its one question before Ask. None of that is sent to us, and deleting the app deletes all of it. The app sets out each lesson itself from the school’s data, and it sends no visit to the web analytics described below. On Android it may vibrate briefly when you tap; that needs no permission you are asked for.
Ask is part of the app too. Before your first question, it says in its own words where a question goes (to an AI model from Anthropic, or, if that one cannot answer, to a DeepSeek model reached through OpenRouter) and asks whether to go on. Nothing is sent until you choose to, and we do not keep your question.
If you use Send feedback or Report a mistake in the app, we keep what you wrote, the screen you were on, the size of your screen, and the app’s version with your phone’s system version. If you use Report this answer in Ask, we also keep the question and the answer you are reporting. None of these carries a name or an address. To have a report deleted, use the complaints page.
Counting visits
We count visits to the website with Cloudflare Web Analytics. It sets no cookie and stores nothing on your device. For each page it records the address, the site you came from and how long the page took to load, and Cloudflare works out the country, the browser and the kind of device from the connection. We see only totals, never a person.
What a class roster holds
A school that uses Addaly creates a class and a row for each pupil: the name the school entered, the username it generated, and the password it printed once on a slip. A teacher sees what their own pupils have finished and what they are in the middle of. They never see a score, a rank or a leaderboard, and never a pupil in a class they do not teach. Every action a member of staff takes is written to an append-only log that nobody, including us, can edit afterwards.
What we deliberately do not collect
- Your real name, unless you or your school typed it.
- Your contacts, your location, or anything from other apps.
- Third-party trackers and advertising pixels. There are none.
- Anything about your health, your family or your income.
How long we keep it
- Your learning record stays until you or your school asks us to erase it.
- IP addresses and access logs are held so that we can deal with abuse, then discarded.
- A minimum we do not get to choose. India’s Digital Personal Data Protection Rules require platforms to retain personal data and processing logs for at least one year, and that floor applies even after an account is erased. We would rather tell you than let “erase” imply something it cannot mean. The account and the record go at once; the underlying entries age out.
- Legal holds. Where the law obliges us to preserve material, as it does for child sexual abuse material and trafficking, we preserve it and report it. That obligation survives an erasure request, and we would rather say so plainly than bury it.
Your rights, and a parent’s
Under India’s Digital Personal Data Protection Act, and as a matter of how we would want to be treated: you can ask what we hold, ask us to correct it, ask us to erase it, and withdraw your consent.
If you have your own account, you do not have to ask: go to My Addaly, where the same list is printed and the download sits beside it.
If you are a parent asking about a child, ask the child’s school. An administrator there has a parents’ desk in the staff portal that shows exactly what is held about that one child, in the child’s own words, and can correct the name or erase the account and everything attached to it in a single step. We route a parent through the school because the school is who knows that you are the parent. If a school does not answer, come to the complaints page and we will.
The only request we will refuse is the legal-hold case above, and we will tell you if that is why.
Children
India treats anyone under 18 as a child and requires verifiable parental consent before a child’s personal data is processed. Nobody under 18 may make their own account here. The public doors, which are Google, a code to an email address and the guest name, are for adults. A child uses Addaly through a school, which asks the parent before it creates the account. The full rule is in Terms of use.
We do not profile a pupil, target anything at a pupil, or track a pupil beyond the record of what they have read and the papers they have sat. If we learn that somebody under 18 made an account through a public door, we remove it.
Who else sees your data
Each of these sees only what it needs to do one job, and nobody buys any of it, because it is not for sale.
- Cloudflare runs the site and its network, keeps the textbooks and films, counts visits as described above, and runs one of the automated safety checks on what people write.
- Neon holds the database in which your account and your learning record are kept.
- Resend sends the sign-in codes and the letters.
- Google, if you choose to sign in with Google.
- The AI model providers. A question you put to a tutor or to Ask, with the lessons that match it, goes to an AI model to be answered: Claude, made by Anthropic, and if Claude cannot answer, a DeepSeek model reached through OpenRouter. Claude also runs another of the safety checks. Addaly does not store an Ask question, and we do not use your questions to train anybody’s model. Each provider handles a request under its own terms and may keep it for a short time to watch for abuse.
If we are ever legally compelled to hand something over, we will tell you unless we are forbidden from doing so.
If this changes
We will say so, before it takes effect, in language you can check against this version. “No advertising, no data sale, no policy whiplash” is a promise in the User Bill of Rights, and this page is downstream of it, not the other way around.