Privacy Policy

Ceylon Code Company PVT LTD ("we," "us," or "our") operates the BrainzUp mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the App.

By using the App, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

  • Account Information: When you register, we collect your first and last name, email address, and password. If you sign up with Google or Apple instead, you do not create a BrainzUp password, and we receive your name and email address from that service, as described in section 1.4.

  • Profile Information: Educational details such as your exam class, exam year, stream, subjects, preferred language, and the name of your school.

  • Approximate Location: During sign-up you select your district and nearest city or town from a list. We use this to understand where our students are located and to improve the App for different regions. We never access your device's GPS or precise location.

  • User-Generated Content: Custom exams, templates, and study preferences you create within the App, and the reports or feedback you submit about questions.

1.2 Information Collected Automatically

  • Device Information: Device type, operating system version, unique device identifiers, and mobile network information.

  • Usage Data: Features used, pages viewed, study sessions, exam attempts, scores, time spent on topics, and interaction patterns, including how you interact with individual exam questions.

  • Crash and Performance Data: Error logs, crash reports, and app performance metrics to help us improve stability.

  • Notification Interaction Data: Reminders and streak notifications are scheduled locally on your device; we record whether you open them so we can make them more useful.

1.3 Information from Third-Party Services

  • PostHog Analytics: We use PostHog to collect usage statistics and user engagement data, and to record session replays (recordings of screens viewed and in-app navigation and interactions) to understand how the App is used and improve it. Session replays may include information visible on your screen while you use the App. Sensitive fields such as passwords are always masked and never recorded.

  • Firebase Crashlytics: We collect crash reports and diagnostic data to identify and fix bugs. Crash reports are not linked to your account.

  • Google AdMob: Our advertising partner may collect device identifiers and ad interaction data to serve advertisements.

1.4 Information from Google or Apple Sign-In (new subsection)

You can sign up for and sign in to the App with your Google account or, on iOS, with Sign in with Apple, instead of an email address and password. Sign-up takes the same steps either way, including accepting our Terms of Use (see section 5).

What we receive:

  • From Google: your name, your email address, whether Google has verified that address, and an ID that identifies your Google account to BrainzUp. Google may also send your profile photo, which we do not use or store.

  • From Apple: an ID that identifies your Apple Account to BrainzUp, your email address and, the first time you sign in, your name. If you choose Hide My Email, we receive a private relay address that Apple created for BrainzUp instead of your email address. Apple also gives us a token that lets us revoke BrainzUp's access to your Apple sign-in.

We never receive your Google or Apple password. Signing in this way does not give us access to your Gmail, contacts, files or any other data in your Google or Apple account.

How we use it:

  • To create your BrainzUp account and sign you in. During sign-up your name and email address are filled in for you, and you can change your name before you finish.

  • To check whether the email address already belongs to a BrainzUp account, so that each email address has only one account.

  • Once your account exists, your name and email address are account information, used as described in section 2.

  • Our analytics record whether you signed in with email, Google or Apple. While you sign up, your name and email address are masked in session replays.

How we store and share it:

  • We store the Google or Apple account ID and the email address that came with it, together with the rest of your account information.

  • We encrypt Apple's token before storing it and use it only to revoke BrainzUp's access when your account is deleted.

  • We do not sell this information or share it with advertisers.

  • BrainzUp's use of information received from Google adheres to the Google API Services User Data Policy.

Removing access:

  • When your account is deleted, we delete this information and revoke BrainzUp's access to your Apple sign-in.

  • You can also remove BrainzUp from your Google Account at myaccount.google.com/connections, or from your Apple Account settings under Sign in with Apple. This does not delete your BrainzUp account or its data. To delete those, delete your account in the App or contact us at support@brainzup.lk.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the App and its features.

  • Personalize your learning experience based on your subjects, class level, and study habits.

  • Send study reminders, streak notifications, and inactivity alerts to support your learning goals.

  • Analyze usage trends and app performance to improve our services.

  • Maintain the accuracy and reliability of question statistics and exam results.

  • Display advertisements through Google AdMob.

  • Detect, prevent, and address technical issues and security threats.

  • Communicate with you about updates, support, and promotional materials (with your consent).

3. Data Storage And Security

  • User preferences and settings are stored locally on your device.

  • We implement industry-standard security measures to protect your data during transmission and storage.

  • No security system is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

4. Third-Party Services

The App uses the following third-party services that may collect information:

We encourage you to review the privacy policies of these third-party services.

5. Children's And Students Privacy

The App is designed for students preparing for GCE O/L and A/L examinations, and many of our users are under 18. If you are under 18, you may use the App only with the consent of a parent or guardian, as confirmed when accepting our Terms of Use during registration.

We do not knowingly collect personal information from children under the age of 13 without parental consent. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at support@brainzup.lk so we can take appropriate action, including deleting the account and its data.

6. Notifications And Background Services

  • The App may show notifications including study reminders, streak updates, and inactivity alerts. These are scheduled locally on your device.

  • Background services run periodically to check for study inactivity and schedule relevant reminders.

  • You can disable notifications at any time through your device settings or within the App.

7. Advertising

  • The App displays advertisements served by Google AdMob.

  • AdMob may use device identifiers and ad interaction data to serve and measure advertisements. Depending on your platform and device settings, ads may be personalized or non-personalized.

  • On iOS, the App does not use Apple's App Tracking Transparency framework and does not access your device's advertising identifier (IDFA), so ads on iOS are non-personalized and we do not track you across other companies' apps or websites.

  • You can opt out of personalized advertising through your device's advertising settings.

8. Your Rights

Depending on your jurisdiction — including under Sri Lanka's Personal Data Protection Act, No. 9 of 2022 — you may have the right to:

  • Access the personal information we hold about you.

  • Request correction of inaccurate information.

  • Request deletion of your personal information.

  • Withdraw consent for data processing.

  • Object to or restrict certain data processing activities.

You can delete your account and its associated data directly within the App from the settings screen. To exercise any other rights, please contact us at support@brainzup.lk.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. If you delete your account or request deletion, we will delete or anonymize your data within a reasonable timeframe, except where retention is required by law. For accounts created with Google or Apple, this includes the link to that Google or Apple account and the Apple token described in section 1.4.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our analytics and crash-reporting providers host their services. By using the App, you consent to the transfer of your information to such countries.

11. Changes To This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy within the App or by other appropriate means. Your continued use of the App after such changes constitutes your acceptance of the revised policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us:

Ceylon Code Company PVT LTD

Email: support@brainzup.lk

Website: www.brainzup.lk

Last Updated: 1/10/2026