Privacy Policy

Last updated April 27, 2026

Effective Date: 2026-04-27

1. Who we are

Voxcess ("we", "our", "us") is a software company headquartered in Telangana, India, building accessibility-first applications for blind and low-vision users. Our products include the Voxcess Typing Trainer, Voxcess Aptitude Trainer, and related tools available on Windows desktop and Android mobile platforms.

2. Information we collect

To deliver and protect our services, we collect:

  • Account information — your email, display name, and Google account ID when you sign in with Google. We do not store your Google password.
  • Device identifiers — a hashed hardware fingerprint (HWID) of the device(s) you sign in from, used solely to enforce our one-Windows-plus-one-Android device policy and to detect account sharing. We do not use this data for advertising or sell it to third parties.
  • Practice data — concept attempts, accuracy, mastery levels, exam scores, bookmarks, scratchpad notes, and streak history. Stored privately to your account.
  • Payment data — order metadata (amount, plan, status). Card and UPI details are handled exclusively by our payment processor (Razorpay) and never reach our servers.
  • Diagnostic data — crash reports and anonymized error traces (Android only, via Firebase Crashlytics) to fix bugs.
  • Session metadata — IP address (for the geolocation-distance fraud check), session token, and approximate city resolved from IP. Retained 30 days for security investigation.

3. Information we do not collect

  • We do not collect your contacts, photos, microphone audio, camera images, exact location (GPS), or browsing history.
  • The Android app requests no "dangerous" permissions other than POST_NOTIFICATIONS (for streak reminders) which you can decline.
  • We do not use third-party analytics SDKs that track you across apps or websites.

4. How we use your information

  • To authenticate you, deliver subscription content, and personalize practice difficulty.
  • To enforce our subscription policy (one Windows + one Android device per account).
  • To detect and prevent account sharing (concurrent-session check, geolocation distance check).
  • To process payments and send transactional emails (receipts, password resets, account notices).
  • To diagnose and fix crashes (Android only, with anonymized data).
  • To send streak/practice reminders only if you opt in to notifications.

5. Data sharing

We share your information only with the following processors, each contractually bound to confidentiality and lawful use:

  • Google Firebase (hosting, authentication, Firestore database, Crashlytics) — data stored in us-central1 region.
  • Razorpay — payment processing for Indian users.
  • Brevo (Sendinblue) — transactional email delivery.
  • ipapi.co — IP-to-city resolution for fraud checks (we send only IP, never your identity).

We do not sell your personal information to anyone, ever.

6. Data retention

  • Practice data: retained as long as your account is active.
  • Session metadata + IP geolocation: 30 days.
  • Crash reports: 90 days (Firebase Crashlytics default).
  • Payment records: retained 7 years per Indian tax law.
  • You may request account deletion at any time by emailing privacy@voxcess.com; we will delete within 30 days.

7. Your rights

You have the right to:

  • Access a copy of your personal data.
  • Correct inaccurate data.
  • Delete your account and associated data.
  • Withdraw consent for non-essential processing (e.g., notifications).
  • Lodge a complaint with India's Data Protection Board.

To exercise any of these, email privacy@voxcess.com.

8. Children

Our services are not directed at children under 13. We do not knowingly collect data from anyone under 13.

9. Security

  • Tokens stored on Android use AES-256 EncryptedSharedPreferences with keys in the Android Keystore.
  • Tokens stored on Windows use AES-256-GCM with PBKDF2-HMAC-SHA256 key derivation, machine-bound.
  • License responses are HMAC-SHA256 signed and replay-protected via nonce + timestamp.
  • All API traffic is HTTPS-only. Firestore rules deny client-side reads of sensitive collections.

10. Changes to this policy

We will post the updated effective date at the top of this page when we make material changes. Continued use after changes constitutes acceptance.

11. Contact

Privacy questions: privacy@voxcess.com
General support: support@voxcess.com
Founder: Shahzada Saleem