Privacy Policy | Schema School

This Privacy Policy explains what personal data Schema School collects when you use our service at schemaschools.in, why we collect it, and how we protect it. We have tried to be specific and honest — if something is unclear, email us at hello@schemaschools.in.

"We", "us", and "Schema School" refer to the operator of this specific instance of the Schema School service. "You" refers to any visitor or registered user.

1. What We Collect

Account information

When you create an account we store:

Your email address (used for sign-in and transactional emails).
A bcrypt-hashed password — we never store or log your plaintext password.
Your chosen display name.

Learning progress

To power your streak, achievements, and mastery metrics we record:

Which lessons you have completed and when.
Every exercise attempt — the SQL you submitted, whether it passed or failed, and the timestamp.
Your current streak, total XP, and any achievements unlocked.

Feedback

If you submit in-app feedback, we store the message text together with your email address (so we can follow up if needed) and the timestamp.

Visitor analytics

For every page view we record a lightweight analytics event containing the page path, the HTTP referer, your User-Agent string, and your IP address. We assign a persistent pseudonymous visitor ID (ss_vid cookie) so we can count unique visitors without requiring an account. IP addresses are used to derive an approximate country and are not separately retained in the analytics table beyond the visit row.

DBA chat history

The DBA AI assistant stores your conversation sessions (the messages you send and the responses generated) so you can pick up where you left off. These are tied to your account and deleted when you delete your account.

Bring-Your-Own (BYO) database connections

If you choose to save a BYO database connection string, it is encrypted with AES-256-GCM before it is written to our database — we store only the ciphertext (never the plaintext), and it is decrypted server-side solely to run the request you asked for. Each saved connection is additionally protected by a per-connection unlock passphrase that only you set and know: we keep only a one-way bcrypt hash of that passphrase (never the passphrase itself), and it must be re-entered to unlock the connection in each new session. You can reset a forgotten passphrase from the connection (a single-use link is emailed to your account); self-service resets are limited, after which you must contact us. If you paste a connection string into the DBA tool or Playground without saving it, it is used only for the duration of that request and is never written to our database or logs.

When you export a connected database from the DBA tool (a SQL dump or a CSV ZIP), the data is read only to build that download and is streamed straight to your browser — the exported file is never stored on our servers.

Payment information

If you purchase lifetime access, the payment is processed entirely by Razorpay. We receive confirmation of a successful payment (order ID, payment ID, and amount) but never your card number or banking details. Those remain with Razorpay.

2. Cookies We Use

Session cookie (NextAuth): an HttpOnly, SameSite=Lax, Secure first-party cookie that keeps you signed in. It expires when you sign out or after 30 days of inactivity.
ss_vid (visitor ID): a 1-year first-party cookie containing a random UUID. Used only for counting unique visitors in our own analytics — not shared with third parties.

We do not use advertising cookies or third-party tracking pixels.

3. How We Use Your Data

To authenticate you and keep your account secure.
To track your learning progress, streak, and achievements, and to grade your exercise submissions.
To power the DBA AI assistant — your message and the relevant database schema are sent to Groq to generate a SQL suggestion or explanation (see section 4).
To send transactional and system emails (such as account and security notifications) via Google's Gmail SMTP.
To send you a welcome email and an occasional newsletter about new chapters, diagrams, and features. These are opt-out — you can turn them off anytime from your account settings, while essential transactional messages (security, account, and purchase notices) are always delivered.
To understand which pages are popular so we can improve the curriculum (aggregate analytics, not individual targeting).
To process your payment and record your lifetime-access entitlement.
To respond to feedback or support requests you submit.

We do not sell your data. We do not run ad networks or share data with advertisers.

4. Third-Party Subprocessors

The following third-party services process data on our behalf. Each is bound by their own privacy policy and, where applicable, a data processing agreement.

Neon — our PostgreSQL database host. Your account data, progress, DBA chat history, analytics events, and feedback are stored on Neon's infrastructure. See neon.tech/privacy.
Groq — AI inference. When you use the AI assistant (lessons, playground, or DBA tool), your natural-language question and the relevant database schema are sent to Groq to generate SQL. Your submitted SQL and row-level data are not included unless you explicitly paste them into the prompt. See groq.com/privacy-policy.
Razorpay — payment processing. Card and banking details go directly to Razorpay and are never seen by our servers. See razorpay.com/privacy.
Google (Gmail SMTP) — transactional email. We send system emails through a Gmail account over SMTP, so your email address and the content of those emails pass through Google. See policies.google.com/privacy.
Application host — the cloud platform hosting the Next.js application (e.g., Vercel or equivalent). It processes requests and may retain access logs per their standard retention period.

5. Your Rights

Access: your profile page shows your stored progress, streak, and achievements. You can download a copy of your data by emailing us.
Update: change your display name and password any time from the Settings page.
Delete: the "Danger Zone" in /settings permanently deletes your account, progress, attempt history, DBA chat sessions, and feedback. Deletion is irreversible.
Nominate: under India's DPDP Act you may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity. Email us at hello@schemaschools.in with your nomination and we will record it against your account.
Other rights: depending on where you live you may have additional rights (access, portability, rectification, objection, restriction) under laws such as the GDPR or India's DPDP Act. Email us at hello@schemaschools.in to exercise any of these rights. This notice, and every consent request we make, is available in English.

6. Data Retention

Account and progress data is kept for as long as your account is active. When you delete your account it is removed from primary storage promptly.
Visitor analytics events are retained for 12 months and then purged.
Feedback is retained indefinitely unless you ask us to remove it.
Payment records (order and payment IDs, amounts) are retained for 7 years for accounting and tax compliance.
Backup copies are rotated out within 30 days of the deletion event.

7. Security

Account passwords and per-connection unlock passphrases are stored only as bcrypt hashes. Saved BYO database connection strings are encrypted at rest with AES-256-GCM and are only ever decrypted server-side to run a request you initiate. All production traffic is served over TLS. We never log passwords, passphrases, connection strings, or payment credentials. The application is open source, so the security model is auditable.

To report a suspected security issue, email hello@schemaschools.in — please do not open a public GitHub issue for security matters.

Personal data breaches. If a personal data breach occurs that affects your data, we will notify the Data Protection Board of India and each affected user in the form and manner prescribed under the DPDP Act, 2023, and we will tell you what happened, what data was involved, and what we are doing about it.

8. Children

Schema School is intended for users who are 18 years of age or older. If you are under 18, you may use the Service only with the consent of your parent or legal guardian, and by allowing you to register your parent or guardian confirms that consent. In line with India's DPDP Act, 2023, we do not carry out tracking or behavioural monitoring of children and we do not show targeted advertising to anyone (we show no advertising at all). If you believe a child has created an account without the consent of a parent or guardian, please contact us at hello@schemaschools.in and we will delete it.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be announced on the Service and the "last updated" date at the top of this page will be revised. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

10. Cookies & Similar Technologies

We use cookies and similar technologies to operate Schema School and, with your consent, to understand how it is used. In line with India's Digital Personal Data Protection (DPDP) Act, 2023, we set non-essential cookies only after you consent, and you can change or withdraw that consent at any time. On your first visit you will see a cookie banner — Accept all, Reject non-essential, or Manage — and you can reopen it anytime via the "Cookie preferences" link in the footer.

Strictly necessary (always on). Required for the site to work and exempt from consent: sign-in / session (keeps you logged in), security (CSRF protection), your saved cookie choice (about 180 days), payment (our provider Razorpay sets cookies during checkout to process payments securely), and your theme preference (stored in your browser's local storage).

Analytics (optional — only with your consent). Google Analytics provides pseudonymous, aggregated usage insights that help us improve the platform. These load only after you accept analytics and may be retained for up to 2 years.

We do not use advertising or marketing cookies, cross-site tracking, and we do not sell your personal data.

Managing your choice. Use the "Cookie preferences" link in the footer to change or withdraw your consent at any time — withdrawing disables Google Analytics and deletes its cookies. You can also block or delete cookies in your browser settings, though blocking strictly-necessary cookies may break sign-in and core features.

11. Grievance Redressal

If you have a concern about how your personal data is handled, or about the exercise of any of your rights under this policy, contact our Grievance Officer at hello@schemaschools.in with the subject line "Grievance" and the email address tied to your account. We will acknowledge your grievance within 48 hours and aim to resolve it within 7 days.

If you are in India and are not satisfied with our response, you have the right under the Digital Personal Data Protection Act, 2023 to complain to the Data Protection Board of India after first exhausting this grievance process. Details of the Board and its complaint procedure are published by the Government of India.

12. Contact

Privacy questions: hello@schemaschools.in. Security disclosures: hello@schemaschools.in.