Privacy Policy

"Gyan Guru" (also "we", "us", or "our") operates the website at gyanguru.com.np and the associated learning platform. We are based in Nepal. If you have any questions about this policy or how we handle your information, you can reach us by email at meet@gyanguru.com.np.

This policy applies to everyone who uses Gyan Guru: students who enroll in classes and webinars, teachers who create and deliver them, and visitors who browse the site without signing in.

Information you give us when you sign up

• Account basics: your full name, email address, and a profile photo. If you sign in with Google, we receive these from your Google account.
• Profile details you complete: phone number, location, school or college, date of birth, current education level, and how you heard about us.
• Teacher application details: if you apply to teach, we also collect your teaching experience, qualifications, biography, the subjects and curricula you cover, and sample content you upload.

Information generated while you use the platform

• Enrollments, registrations, and bookings for classes, webinars, and one-on-one consultations.
• Reviews and ratings you leave for teachers or classes.
• Payment records: the amount paid, the product purchased, and a reference ID returned by our payment provider. We do not store card numbers, bank credentials, or eSewa PINs on our servers.
• Content you upload: class thumbnails, webinar banners, profile images, and other media.

Technical information we observe

• Session data: a secure session token, IP address, and browser user-agent string, used to keep you signed in and to detect suspicious activity.
• Logs and metrics: request paths, response codes, latency, and error traces. These contain identifiers but are used only to operate and debug the service.

Gyan Guru uses Google for two separate things. Each is described below so you know exactly what data is accessed and why.

3.1 Signing in with Google (students and teachers)

You can create an account or sign in with your Google account. When you do, Google shares your basic profile information with us: your name, email address, and profile picture. We use these only to create and authenticate your Gyan Guru account. We do not receive a password from Google, and we do not get access to your Gmail, Drive, Photos, or any other Google service through sign-in.

3.2 Connecting Google Calendar for teachers

Teachers on Gyan Guru deliver live online classes, webinars, and one-on-one consultations through Google Meet. To schedule these sessions reliably, a verified teacher can connect their Google account so that we can create calendar events and Meet links on their behalf. This is a separate, explicit authorization step that only teachers see, and it stays optional until a class is scheduled.

Scopes we request

When a teacher chooses to connect Google, we ask Google for the minimum scopes needed to run the product:

• https://www.googleapis.com/auth/calendar.events: used to create, update, and delete calendar events on the teacher's primary Google Calendar for sessions the teacher schedules on Gyan Guru. Each event generates a Google Meet link that students use to join the live session. We use this scope only for events that represent Gyan Guru sessions the teacher has published.
• https://www.googleapis.com/auth/userinfo.email: used once, during the connection flow, to confirm which Google account has been linked, so the teacher and the scheduled events belong to the same calendar.

What we do with this access

• Create calendar events on the teacher's primary calendar for every class, webinar session, or consultation the teacher schedules on Gyan Guru. The event includes the title, the scheduled start and end time, the teacher as an attendee, and a Google Meet conference entry point.
• Generate a Google Meet link automatically as part of creating the event, then show that link to the teacher and to students enrolled in the session.
• Update or delete the event if the teacher reschedules or cancels the session on Gyan Guru, so calendar and Meet state stay in sync with the platform.
• Optionally invite a platform monitor email as an "optional" attendee, only if platform quality monitoring is configured and only to allow a reviewer to drop into a session on request. This is disabled by default.

What we do not do

• We do not read, list, export, or analyze events that are not created by Gyan Guru.
• We do not use Google user data to train generalized AI or machine learning models.
• We do not sell Google user data, and we do not transfer it for any advertising purpose.
• We do not let humans read Google user data, except where (a) we have the teacher's explicit consent for a specific case, (b) it is necessary for security (for example, investigating abuse), (c) it is necessary to comply with law, or (d) the data has been aggregated and anonymized.

How we store the authorization

When a teacher connects Google, we receive an OAuth refresh token from Google. We encrypt that refresh token at rest before storing it in our database, together with the Google email address and the list of granted scopes. Access tokens are short-lived and held only in memory while we make an API call. Refresh tokens are used only from our server, never exposed to the browser.

Teachers can disconnect Google at any time from their teacher dashboard. When they do, we revoke the refresh token with Google and delete our stored copy. Teachers can also revoke access directly at myaccount.google.com/permissions.

We use the information we collect to:

• Create and secure your account, sign you in, and keep your session alive.
• Let you browse teachers, classes, webinars, and consultations, and enroll in the ones you choose.
• Process payments for enrollments and consultations through our payment provider, and show you receipts and your purchase history.
• Send you transactional emails that are part of the service, such as sign-in verifications, class reminders, enrollment confirmations, and payout notices for teachers. You cannot opt out of critical account and transactional emails while you have an active account.
• Schedule your live sessions and deliver Google Meet links, as described in Section 3.
• Review teacher applications, verify qualifications, and resolve disputes or safety issues.
• Measure aggregate usage, improve the product, and detect fraud, abuse, or violations of our terms.
• Comply with applicable law.

We do not sell your personal information. We share it only with the service providers we need to run Gyan Guru, and only to the extent they need it to do their job:

• Google (Sign-In, Calendar, Meet): authentication and scheduling, as described in Section 3.
• Payment Gateway: our Nepal payment processor. When you pay, you are redirected to the payment page to complete the transaction. We send an order reference and amount, and we receive back a signed confirmation. We do not handle your transaction PIN or bank credentials.
• Resend: transactional email delivery for sign-in, reminders, and receipts. They process the email address and the message contents on our behalf.
• UploadThing: storage and delivery of images you upload, such as profile pictures and class thumbnails.
• Our hosting and database providers, which store the application data described in this policy.

We may also share information when we are required to by law, when it is necessary to investigate fraud or safety incidents, or in connection with a business transition such as a merger or acquisition. If that happens we will tell you, and any new operator must continue to honor this policy or ask for your renewed consent.

We use a small number of cookies and local-storage entries to keep you signed in and remember your preferences. Specifically:

• A secure, HTTP-only session cookie that identifies your current sign-in.
• A short-lived cookie used during the Google sign-in flow to protect against cross-site request forgery.
• A local-storage entry for your theme preference (light or dark).

We do not use advertising cookies or third-party tracking pixels.

• Account data: kept while your account is active. When you delete your account, we delete your profile and personal information within 30 days, except where we are required to keep records (for example, invoices for tax reasons).
• Enrollment, booking, and payment records: kept for up to 7 years to meet accounting and tax obligations.
• Google Calendar authorization: stored only while the teacher has it connected. When the teacher disconnects, we revoke it with Google and delete our encrypted copy.
• Application logs and metrics: kept for up to 90 days, then rotated out.
• Backups: encrypted backups of our database may retain deleted information for up to 30 additional days before they are overwritten.

We protect your information with the following safeguards:

• All traffic between your browser and Gyan Guru is served over HTTPS with a strict transport policy and modern TLS.
• Google OAuth refresh tokens are encrypted at rest before being stored in our database. Access tokens are short-lived and kept in memory only while a request is in flight.
• Passwords, when used, are hashed. We sign session tokens with a server-side secret and set them as HTTP-only, SameSite cookies.
• We apply a strict Content Security Policy, along with anti-clickjacking and cross-origin isolation headers, to reduce the risk of browser-based attacks.
• Access to production data is limited to a small number of staff for a narrow set of operational reasons, and all access is logged.

No system is perfect. If you believe your account has been compromised, or you spot a vulnerability, please write to meet@gyanguru.com.np.

You can always:

• See and edit your profile information from the profile page.
• Disconnect Google from the teacher dashboard. Once disconnected we revoke and delete the refresh token we hold. You can also revoke access at myaccount.google.com/permissions.
• Request a copy of the personal data we hold about you.
• Request deletion of your account and the personal data associated with it, subject to the retention exceptions above.
• Object or complain to the handling of your data.

Write to us at meet@gyanguru.com.np for any of the requests above. We will respond within 30 days.

Gyan Guru is a learning platform, and many of our students/learners are minors preparing for school, SEE, higher studies, or early college. Anyone under the age of 16 who uses Gyan Guru must do so with the involvement of a parent or legal guardian, who is responsible for setting up the account and supervising its use. Parents who believe their child has created an account without their involvement can contact us to have it closed and the data deleted.

Gyan Guru is primarily built for learners and teachers in Nepal. If you use the service from outside Nepal, you understand that your information will be processed in Nepal and in the countries where our cloud providers operate. Where local law requires it, we will put appropriate safeguards in place before any transfer.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. If the changes are material (for example, if we start using Google data for a new purpose), we will notify active users by email and ask for renewed consent where that is required.

For privacy questions, data access or deletion requests, or anything else covered by this policy, email us at meet@gyanguru.com.np. You can also write to us in the in-app support chat while signed in.