Privacy Policy
Last Updated: 8 November 2026 Effective Date: 15 November 2026
This policy explains what Pookie CA (“we”, “us”) collects when you use our website at pookieca.com, our Android app and our Telegram bot (together, the “Platform”), who handles it for us, and how you can delete it. We do not sell your data.
Who we are
Pookie CA runs the website, the app and the bot. The Android app is on Google Play under the developer name “AiSACA”. You can reach us at support@pookieca.com.
What you give us
We ask for your name and email address when you sign up with Google, and for your WhatsApp number if you sign up on the website or the bot. We use them to sign you in and to send you OTPs, receipts and support replies.
During setup in the app you tell us your CA level, exam attempt, subjects and goal marks. We use them to pick study content for you.
When you chat with Pookie, we receive the messages you type. If you tap “Report response” on an AI reply, we also store the reply, your question, the reason you pick, your account ID and the time.
If you buy on the website, Razorpay takes your payment details. We never see your full card number, CVV or UPI ID. Razorpay tells us the transaction ID and status, the amount, the payment method type, and the name and contact you gave it.
Google gives us your email, name and basic profile when you sign in. Telegram gives us your user ID, first name and language when you use the bot.
What the Android app collects automatically
The app sends usage and device data to the services below. We do not put your email, phone number or chat text in any of it.
- Firebase Analytics (Google) records your app interactions and screen views. It also records your device model, Android version, app version, language, approximate country, the advertising ID and the app instance ID, which is a random ID for your install.
- Firebase Crashlytics (Google) records crashes. It stores the crash log, your device model, Android version, memory and disk size, whether the app was open on screen, and the Crashlytics installation ID.
- Firebase Performance Monitoring (Google) measures how fast the app runs. It records start time, screen rendering, network request addresses without parameters or content, response codes, sizes and times, your connection type, carrier and approximate country.
- Amplitude records the screens you open, the lessons and concepts you view, the drills you start and finish, your practice answers and how many chat messages you send. It ties them to a random ID and your account ID, and also receives your device model, manufacturer, Android version, language, carrier, advertising ID and IP address. Amplitude works out your approximate location from the IP address.
- Amplitude Session Replay records how you move through the app screens. It masks all text on screen, including what you type, so no text is recorded.
- Mixpanel records the same kind of usage events as Amplitude, with your device and app details and an approximate location from your IP address.
- Expo and Firebase Cloud Messaging deliver notifications. If you allow notifications, we store a push token that identifies your phone.
We use the advertising ID for analytics only and never to show ads. You can reset or delete it in Android settings under Privacy, then Ads.
On the website and the bot, we record your device type, operating system and browser, a shortened form of your IP address (to block abuse and detect your region), your bot commands and button taps, and your MCQ attempts, accuracy, time spent and streaks.
Why we use it
We use your data to run your account, take payments, deliver what you bought, send OTPs and receipts, and pick study content for you. We also use it to answer your chat questions, count how the app is used, find crashes and slow screens, and block fraud and abuse. We send you marketing messages only if you opt in, and push notifications only if you allow them. We keep and share records when the law requires it. We make no automated decisions that have legal effects on you.
AI chat
Pookie chat uses AI. When you send a message, the app sends it and the study context needed to answer it, such as the concept you are reading, to our server. Our server passes it through Cloudflare AI Gateway to Anthropic, whose Claude model writes the reply.
Cloudflare AI Gateway logs your messages and the AI replies. We use the logs to check answer quality, find problems and track cost, and we keep them for up to 7 days. The app does not save your chat history after you close it.
Please keep sensitive details such as bank or ID numbers out of chat. AI replies can be wrong, so check important points against ICAI study material.
Who handles your data for us
These companies process your data on our behalf, under their own terms. They use it only to provide their service to us.
| Company | What it does for us |
|---|---|
| Supabase (USA) | Database and sign-in. Holds your account, profile, progress and push token |
| Cloudflare (USA) | Hosts the website and app server, routes email, and runs AI Gateway for chat |
| Anthropic (USA) | Writes the AI chat replies from your messages |
| Google (USA) | Sign-in with Google, Firebase Analytics, Crashlytics, Performance Monitoring and Cloud Messaging |
| Amplitude (USA) | App analytics and Session Replay |
| Mixpanel (USA) | App analytics |
| Expo (USA) | Delivers push notifications |
| Brevo (France) | Sends email and WhatsApp messages |
| Razorpay (India) | Takes payments |
| Telegram (UAE) | Runs the bot and Mini App |
Most of these companies are outside India, so your data is processed in the United States, the European Union, the United Kingdom and the United Arab Emirates. We use contracts with data-protection terms and standard contractual clauses where they apply.
We share data with authorities when the law requires it, and when we need to protect the rights, property or safety of Pookie CA, our users or others. If Pookie CA is merged, acquired or sold, your data moves with it, and we tell you first if it becomes subject to a different policy.
Cookies
The website uses essential cookies and local storage for sign-in, your session and your preferences. We use no third-party advertising cookies on the website and we do not track you across other sites.
How long we keep it
| Data | How long we keep it |
|---|---|
| Account data | Until you delete your account |
| Transaction records | 8 years, as Indian tax law requires |
| Email and messaging logs | 18 months |
| Push token | Until you sign out or delete your account |
| Chat messages and AI replies in AI Gateway logs | Up to 7 days |
| Reports about AI replies | Until you delete your account |
| Amplitude and Mixpanel events | Kept after you delete your account, linked only to random IDs |
| Firebase Analytics data | 14 months |
| Firebase Crashlytics data | 90 days |
| Firebase Performance Monitoring data | 30 days if linked to an IP address, 60 days otherwise |
| Session Replay recordings | 1 month |
When a period ends, we delete the data or strip out anything that identifies you.
See, correct or delete your data
Email support@pookieca.com with the subject “Privacy Request” to get a copy of your data or to fix wrong details. We reply within 30 days.
To delete your account, open the Me tab in the app, then Account, then Delete account. You can also go to https://pookieca.com/account/delete, or email us from your registered address. We delete your profile, your study progress on our servers, your entitlement records, your push token and your reports about AI replies within 30 days, and we overwrite backups within 90 days. We keep transaction records for 8 years because the law requires it. We cancel website subscriptions with no refund (see the Refund Policy). Deleted account data cannot be recovered.
Deleting your account does not remove analytics, crash or AI Gateway log data. Firebase, Crashlytics and AI Gateway data expire at the end of the periods in the table above. Amplitude and Mixpanel keep their events, which carry only random IDs. Once your account is gone, nothing we hold links those IDs back to your name or email.
To stop notifications, turn them off in your phone settings. To stop marketing messages, email us.
Age
You must be 18 or older to use Pookie CA. We do not knowingly collect data from anyone under 18. If you think your child has given us data, email support@pookieca.com and we will delete it.
Security
We send all data over HTTPS and our infrastructure providers encrypt stored data. Only our admin team can reach admin systems, and they sign in to do it. Razorpay alone handles payment data. If you think someone got into your account, email support@pookieca.com right away.
Changes to this policy
When we make a significant change, we tell you by email or a notice on the Platform at least 7 days before it starts. The “Last Updated” date above shows the latest revision.
Contact
Pookie CA, Privacy Inquiries Email: support@pookieca.com Subject line: “Privacy Request”