Privacy Policy

StudyTrack is committed to protecting your privacy. This Privacy Policy describes how we collect, use, and safeguard information when you use our free A/L study tracking platform, designed specifically for Sri Lankan students.

We collect only the minimum data necessary to provide you with a personalised and functional study tracking experience. We do not monetise your data in any way.

We collect two types of information: data you provide directly when registering and using the platform, and data generated automatically through your activity.

We do not collect payment details, device location, camera or microphone data, or any sensitive personal information beyond what is listed above.

Your data is used exclusively to operate and improve StudyTrack. We use it to:

• Authenticate you and maintain your secure login session
• Store and display your study sessions, marks, subjects, and tasks
• Generate personalised charts, analytics, and progress reports
• Calculate study streaks, daily goals, and heatmap data
• Send OTP verification and password reset emails when requested
• Display A/L exam countdowns and admin announcements
• Improve platform features using anonymised, aggregated usage patterns

We will never use your data to send marketing emails, build advertising profiles, or share individual data with any third party for commercial purposes.

We do not sell, rent, or trade your personal data to anyone. We share data only in these strictly limited circumstances:

• Email delivery (Brevo SMTP): Your email address is passed to Brevo's transactional email service solely to deliver OTP and password reset messages. They receive no academic data.
• Legal requirements: We may disclose data if required by valid Sri Lankan legal process.
• Platform transfer: If ownership of the platform changes, all users will be notified at least 30 days in advance.

We implement multiple technical safeguards to protect your data:

• Passwords are hashed using bcrypt (cost factor 12) and are never stored in plain text
• Email OTP verification is required before any account becomes active
• Password reset tokens expire after 1 hour and are single-use only
• All database queries use prepared statements to prevent SQL injection
• PHP native session handling with server-side session storage
• Input sanitisation applied to all user-submitted data

StudyTrack uses an absolute minimum approach to cookies:

• Session cookie only: A single PHP session cookie keeps you logged in during your browser session. This contains only a random session ID — no personal data whatsoever.

We do not use tracking cookies, analytics tools (Google Analytics, Hotjar, etc.), advertising networks (Google Ads, Facebook Pixel, etc.), or any third-party tracking scripts of any kind.

You have the following rights regarding your personal data at all times:

• Access: View all your data directly in your dashboard at any time — no request needed
• Correction: Update your name and password in the Profile page at any time
• Deletion: Delete individual sessions, marks, subjects, and tasks directly in the platform. For full account deletion, contact us.
• Portability: Contact us to request a structured export of all your study data
• Objection: Object to any data processing by contacting us — we will respond within 14 days

To exercise any of these rights, contact us at support@studytrack.lk.

StudyTrack is specifically designed for A/L students, many of whom are under 18. We take this responsibility very seriously:

• We collect only the minimum data needed for the service to function
• We display no advertising to any users, including minors
• We never share any student's data with third parties for marketing
• Students under 18 should inform a parent or guardian before registering

If you are a parent or guardian and believe your child has registered without your knowledge, please contact us and we will promptly delete the account and all associated data.

We retain your data for as long as your account remains active. Inactive accounts are not automatically deleted — your data persists so you can return at any time.

Upon an account deletion request, the following timeline applies:

• Personal information (name, email) removed within 7 days
• Academic data (sessions, marks, tasks) removed within 30 days
• Anonymised aggregate statistics may be retained indefinitely
• Unverified accounts (incomplete OTP) are automatically purged after 24 hours

We may update this Privacy Policy to reflect changes in our practices or applicable legal requirements. We will update the "Updated" date at the top of this page when changes occur.

For significant changes that affect your rights, we will display a notice on the platform. Continued use of StudyTrack after the effective date of any changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Platform: StudyTrack
• Website: https://studytrack.edurx.icu/studytrack
• Email: support@edurx.icu<

We respond to all privacy-related enquiries within 14 business days.