Privacy policy

Information you give us

• Phone number. Your phone number is your account. We use it to send you a one-time password (OTP) to sign in, and to link your tests, subscription and payments to you. Thervu does not use passwords.
• Name and PIN code. We ask for your name and your area PIN code when you sign up. Your name is shown on leaderboards; if you have not given a name, a masked version of your phone number is shown instead. We use PIN codes only in aggregate, to understand which regions our users come from.
• Preferences. The exam you are preparing for and your preferred language (Tamil, English or both).
• Things you create. Notes, favourite questions, syllabus-tracker progress, and messages you send to the AI tutor (see section 6).
• Question reports. If you report a question, we store the report, the reason you chose, any details you add and your account ID, so our reviewers can act on it.
• Referral codes. If you join with a friend’s referral code, we record who referred you so that referral rewards can be credited.
• Support emails. If you write to us, we keep your message and our reply so we can follow up.

Information created when you use Thervu

• Test activity. The tests you take, the questions served, the answers you choose, time taken, scores, subject and topic breakdowns, weak areas, your revision queue and your leaderboard positions. This is what makes the marking and analysis work.
• Subscription records. Your plan and billing period, the subscription’s status, its start and renewal dates, and the subscription and payment IDs returned by our payment gateway (see section 5).
• Notifications. The in-app notifications we send you and whether you have read them.

Information collected automatically

• Sign-in sessions. For each device you are signed in on: a device identifier and name, IP address, browser or app details (user agent), and when the session was created and last used. We use these to keep you signed in, to show you your signed-in devices, and to apply your plan’s device limit (see section 9).
• Push notification tokens. If you allow notifications in the Android app: a push token for your device, its platform and your notification language (see section 7).
• Website analytics. Usage data from our public website, described in section 8.

We do not collect your precise location, contacts, photos, SMS inbox or call logs.

• To create your account and sign you in with a one-time password.
• To build tests, mark them, and show your analysis, history, weak areas, revision queue, favourites and leaderboard position.
• To run your subscription: activate a plan, apply plan limits, renew it, and handle cancellations and refunds.
• To keep accounts secure: apply device limits, limit repeated OTP requests, and investigate misuse such as account sharing or scraping.
• To improve the question bank. Aggregate statistics, such as how many people answer a question correctly, help us find weak or wrongly keyed questions.
• To send service messages: OTPs, and in-app and push notifications about your tests, current affairs and your account. We do not send marketing SMS without your consent.
• To answer your support requests, and to meet legal, tax and accounting obligations under Indian law.

We do not sell your personal data, and we do not use your answers or scores to target advertising.

To deliver an OTP, we first try WhatsApp, which is operated by Meta. We send the message from our own WhatsApp number through a messaging server we run, so your phone number and the OTP pass through that server and WhatsApp.

If that fails, we pass your phone number and the OTP to an Indian SMS provider. We currently use 2Factor, with Fast2SMS and MSG91 as alternates. They may use your number only to deliver that message.

OTPs expire within minutes and can be used only once. We limit how many OTPs can be requested for a number, and from one network address, in a short period.

Paid plans are processed by our payment partners: PhonePe for payments on our website and Razorpay for payments in the Android app. You enter your card, UPI or bank details on their checkout, not on Thervu.

Thervu never sees or stores your card number, CVV, UPI PIN or bank login. We store only what we need to run your subscription: the subscription and order IDs from PhonePe or Razorpay, your plan and billing period, any coupon you used, the subscription’s status and its current period dates. PhonePe and Razorpay keep payment details under their own privacy policies.

Paid plans are autopay subscriptions. The mandate is registered with your bank, card or UPI app through PhonePe or Razorpay, and you can cancel it there or ask us to cancel it. See our refund and cancellation policy.

When you send a message to the AI tutor, your message, the earlier messages in that conversation and the names of the topics you picked are sent to DeepSeek, a third-party AI provider, to generate the reply. DeepSeek processes this data on servers outside India.

We store your conversations so you can come back to them. You can delete a conversation in the app at any time, which deletes its messages from our database.

Please don’t share personal details such as your phone number, address or ID numbers in the chat. AI replies can be wrong, so check important facts against official sources.

We show notifications inside the app, for example about your results, daily tests and current affairs.

In the Android app we can also send push notifications. These are delivered through Expo’s push notification service, which passes them to Google Firebase Cloud Messaging. To do this we store a push token for your device. You can turn push notifications off in your phone’s settings at any time, and signing out turns them off for that device.

Our public website, thervu.in, may use Google Analytics 4 and Microsoft Clarity to understand which pages are read and where visitors get stuck. Google Analytics uses cookies to count visits. Clarity records how visitors interact with a page, such as clicks, scrolling and mouse movement, and masks sensitive text that visitors type. These services receive your IP address and device information and process them under Google’s and Microsoft’s privacy policies.

The Thervu web app uses your browser’s local storage to keep you signed in and to remember preferences such as language. Clearing it signs you out.

We do not sell analytics data or use it to build advertising profiles.

Each plan allows a set number of devices to be signed in at the same time: 1 on Free, 2 on Pro and 5 on Premium. If you sign in on one more device than your plan allows, your oldest session is signed out. You can see your signed-in devices, and sign any of them out, from your profile.

A session stays signed in while you keep using it, and expires after a long period without use.

The free plan is supported by ads: Google AdMob in the Android app and Google AdSense on the web. On the free plan, hints on the results screen are unlocked by watching an ad. Ads are not shown during a test, and are not shown on the Pro or Premium plans.

Google may use cookies or your device’s advertising ID to serve and measure ads, as described in Google’s privacy policy. You can limit personalised ads in your Android settings or in your Google account.

We do not share your phone number, answers or scores with advertisers.

We share personal data only with service providers that help us run Thervu, and only what each of them needs:

• WhatsApp (Meta): your phone number and the OTP, to deliver OTPs.
• SMS providers (2Factor, Fast2SMS, MSG91): your phone number, to deliver OTPs.
• PhonePe and Razorpay: payment and subscription processing.
• Hosting and infrastructure (Cloudflare, Vercel, Turso): the servers and database that run Thervu and store your account and test data.
• DeepSeek: AI tutor conversations (section 6).
• Expo and Google Firebase Cloud Messaging: push notification delivery (section 7).
• Google (AdMob, AdSense, Analytics) and Microsoft (Clarity): free-plan advertising and website analytics (sections 8 and 10).

We may also disclose information when the law, a court or a competent authority requires it, or where it is necessary to prevent fraud or to protect the rights and safety of our users.

Some of these providers process data outside India. We transfer personal data abroad only as Indian law permits.

• Account and test data: for as long as your account is active.
• After you ask us to delete your account: we delete or irreversibly anonymise your personal data within 30 days.
• Inactive accounts: if an account has not been used for 24 months, we may delete it after telling you on your registered number.
• Payment and subscription records: for as long as Indian tax and accounting law requires, even after your account is deleted. These records never include card or UPI details.
• AI tutor conversations: until you delete them or your account is deleted.
• Session and security records: up to 12 months.

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we use it.
• Correct and update your details. You can change your name, PIN code, exam and language, and move your account to a new phone number, in the app.
• Erase your account and the personal data linked to it. Anonymised statistics that cannot identify you, such as how often a question is answered correctly, may be kept.
• Withdraw consent for optional processing, such as push notifications and personalised ads. Withdrawing consent does not affect processing that happened before.
• Nominate another person to exercise these rights for you if you die or become unable to do so.
• Seek redress for a grievance from our Grievance Officer (section 15).

To make a request, email support@thervu.in with your registered phone number. We may send an OTP to that number to confirm that the request is yours. We respond within 30 days.

Deleting your account does not by itself cancel an active subscription. Cancel the subscription first, or ask us to do both in the same email.

You sign in with one-time passwords, so there is no password to leak. Data is sent over HTTPS and stored with managed providers, and access is limited to the people who need it to run the service. Device limits stop an account being shared without your knowledge.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires.

If you have a complaint about how we handle your personal data, or about any content on Thervu, you can contact our Grievance Officer, appointed under the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023:

We acknowledge complaints within 24 hours and aim to resolve them within 15 days of receiving them.

If you are not satisfied with how we have handled a complaint about your personal data, you may complain to the Data Protection Board of India.

Thervu is meant for adults preparing for recruitment exams. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, write to support@thervu.in and we will delete it.

We update this policy when the product or the law changes. The “Last updated” date at the top shows the current version. If a change materially affects how we use your data, we will tell you in the app before it takes effect.

Questions or requests about privacy: support@thervu.in. You can also use our contact page.