Privacy Policy

1. Who is responsible for your data

Devi Ahilya Prakashan, trading as Yashraj Books, is responsible for the personal data described here, as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Our registered address is 26, Subhash Chowk, Khajuri Bazar, Rajwada, Indore 452002, Madhya Pradesh, India. For any privacy request, contact our Grievance Officer below or write to business@yashrajbooks.com.

Grievance Officer:

• Name: Mrs. Khushbu Sharma
• Phone: +91 62693 01000
• Email: business@yashrajbooks.com
• Address: Devi Ahilya Prakashan, 26, Subhash Chowk, Khajuri Bazar, Rajwada, Indore 452002, Madhya Pradesh, India

2. What we collect

• Account details: your mobile number (used to sign in by OTP), your name, and — if you add them — email, university, college, course, semester, the exam you're preparing for, address and a profile photo. Staff accounts additionally hold a work email and password.
• Purchases: the plans and packages you buy, the amount, the date, PhonePe order and transaction references, and your GST invoice. We never receive your card number, UPI PIN or bank credentials — you enter those on PhonePe's own payment page.
• Wallet and referrals: wallet credits and debits and why they happened; your referral code and who referred whom.
• Reading activity: which books you open, your current page, how long each reading session lasts, and your bookmarks, highlights and notes. This powers "continue reading", your shelf, and the reading check in our refund rule.
• Content protection: if an attempt to copy, print, screenshot or save a book is detected, we record it with basic device information against your account.
• Device and session: a random device identifier created by the app, the device type (Android, iOS or web) and sign-in session records — used to allow one signed-in device at a time. If you allow notifications, a push-notification token for your device.
• Support and notifications: your support requests and our replies; the notifications we send you (in-app, push, email or SMS) and whether they were delivered or read.
• Technical logs: IP address, app or browser version and the requests made, kept in server logs for security and troubleshooting.

We don't use advertising trackers or third-party analytics in the apps, and we don't buy data about you from anyone.

3. What the app keeps on your phone

• Your sign-in tokens, in the phone's secure storage (Android Keystore / iOS Keychain).
• A copy of recently loaded lists (the catalogue, your shelf and rentals) so the app opens quickly. It is deleted when you sign out.
• Books you choose to save for offline reading, encrypted and readable only inside the app; deleted on sign-out, when the plan ends, or when you remove them.
• Where on a page you placed each highlight, so it is drawn in the same spot next time.

App permissions: photos (only when you choose a profile picture, through the system photo picker) and notifications (only if you allow them). The apps do not use your camera, microphone, contacts or location.

4. Why we use it

• To provide the Service: signing you in, your shelf, remembering your page, syncing highlights, and recommending books for your course or exam (performance of our contract with you).
• To take payment, issue invoices, credit refunds and rewards, and keep the financial records the law requires (contract and legal obligation).
• To protect books from copying and redistribution, including the per-account watermark and protection records (our legitimate interest in protecting licensed content, which you agree to in the Terms).
• To send transactional messages — OTPs, payment confirmations, plan-expiry reminders, refund decisions and support replies. These can't be switched off while you have an account, because they're about your purchases.
• To send offers and new-book announcements only with your consent, which you can withdraw at any time.
• To understand usage in aggregate (for example, which books are most read). These reports don't identify individual students.

5. Who we share it with

We share personal information only with the providers we need to run the Service, and only what each one needs:

• PhonePe (PhonePe Payment Gateway) — payments and refunds (the amount and an order reference; your payment details are entered on PhonePe's own page, not ours).
• MSG91 — sending the SMS one-time password and SMS notifications (your mobile number and the message).
• Cloudflare — storing book files, cover images, profile photos and invoices (R2 storage).
• Google Firebase / Apple Push Notification service — delivering push notifications, if you allow them (device token and the message).
• Our hosting provider — the servers where the application and database run.
• Your institution — only where your access is provided through your university or institution, and only what that arrangement needs.

Each acts on our instructions under a contract. We don't sell your information, and we don't share it with advertisers. We disclose information when the law requires it (for example, a valid order from a court or government authority), or where it's necessary to enforce our Terms or protect our rights, our students or the public.

6. How long we keep it

• Account details, shelf, bookmarks and highlights: for as long as your account exists.
• Orders, invoices, wallet and refund records: 8 years after the transaction, as required by Indian tax and company law, even after you delete your account.
• Reading sessions and progress: while your account exists.
• Content-protection records: 2 years, or longer where they're evidence in an ongoing investigation.
• One-time passwords: minutes — deleted as soon as they're used or expire.
• Server logs: for a limited period, for security and troubleshooting, and then deleted.

When you delete your account we delete or anonymise everything except the records we're required to keep, within 30 days.

7. Your choices and rights

You can see and update your profile in Account → Your profile, and delete your account from the same page (see Account & Data Deletion).

You also have the right to access a summary of the personal data we hold about you, to correct it, to have it erased (subject to the retention periods above), to withdraw consent, and to nominate someone to exercise these rights for you. Write to our Grievance Officer and we'll respond within 30 days. If you're not satisfied, you may complain to the Data Protection Board of India.

8. Children

The Service is intended for students preparing for university and professional examinations, and isn't directed at children under 18. A user under 18 must have a parent's or guardian's consent. If we learn we've collected a child's information without that consent, we'll delete it.

9. Security

Data is encrypted in transit. Sessions use short-lived signed tokens and only one device can be signed in at a time. Staff passwords are hashed; students don't have passwords at all. Books are streamed through our servers with your access checked on every request, never from a public link, and offline copies are encrypted on the device. Access to production systems is limited to staff who need it.

No system is perfectly secure. If we discover a breach that affects your personal information, we'll notify you and the relevant authority as the law requires.

10. Cookies and browser storage

The website uses browser storage only for what's needed to run it: your sign-in tokens, your reader preferences and which notifications you've read. We don't set advertising or cross-site tracking cookies. Clearing your browser storage signs you out but doesn't delete your account.

11. Changes to this policy

We'll update this page when our practices change and tell you in the app or by email if the change is material. The date at the top shows the version in force. This policy forms part of our Terms & Conditions; refunds are covered separately in the Refund & Cancellation Policy.