Privacy Policy

Crugex (crugex.com) is operated by Mejona Technology LLP, a limited liability partnership registered in India with its office at Patna, Bihar – 800014 (“Crugex”, “we”, “us”). We are the Data Fiduciary for your personal data under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025.

This policy explains, in plain language, what we collect, why we collect it, how long we keep it, who we share it with, and how you stay in control. If anything here is unclear, grievance@crugex.com reaches a human.

• Account data — your name, email address, college, course/branch, graduation year, and your chosen handle. Your password is stored only as a cryptographic hash; we never see it.
• Activity data (your proof) — the events the platform witnesses: lessons completed, courses finished, certificates earned, assessments taken and their scores, questions asked, answers posted and accepted, votes, daily check-ins, streaks and XP transactions.
• Content you post — questions, answers, comments, reviews and any files or links you attach.
• Recruiter-facing data — only what you choose to make visible: your proof profile link, verified skills, scores and certificates.
• Device & log data — IP address, device and browser type, and server logs, collected for security and to meet CERT-In obligations (see §7).
• Support data — anything you send us through email, the newsletter form, or grievance channels.

• To operate the platform: accounts, courses, practice, the Q&A commons, assessments, XP, streaks and profiles.
• To build your proof profile — the record of what you actually finished — and share it only as you direct.
• To keep the commons safe: moderation, abuse detection, and enforcement of our rules.
• For security and legal compliance, including CERT-In logging requirements.
• To answer your questions and support requests.

We do not use your data for behavioural advertising, and we do not sell personal data — to anyone, ever. If that ever changes, this policy will change first, and we will seek fresh consent where required.

Under the DPDP Act, anyone below 18 is a child, and their personal data can be processed only with verifiable consent of a parent or lawful guardian.

• If you are under 18, a parent or guardian must review this policy and our Terms of Use, and consent to your account before you use Crugex. We may verify that consent through reasonable technical and documentary means.
• We never serve behavioural or targeted advertising to children, and we do not track children for advertising purposes.
• If we learn that we hold a child's data without the required consent, we will delete it — except where an applicable law requires us to keep it.

The marketing site you are reading uses strictly necessary storage only — there are no advertising or third-party tracking cookies on crugex.com, and fonts are served from our own servers.

Crugex keeps strictly necessary storage only: sign-in is handled by our authentication provider (Supabase), which sets a strictly necessary session cookie for the authentication domain, and your session reference plus small preferences live in your browser’s local storage. Your product data — courses, assessments, applications and proof records — is stored in Crugex’s server-side database, not in your browser. Changes to this picture will be reflected in this policy and our Cookies page first.

• Never sold. We do not sell or rent personal data.
• Infrastructure processors — hosting, database, email and CDN providers that store and process data strictly on our instructions under contract.
• Recruiters and colleges — only the parts of your profile you explicitly grant access to. Access is a grant from you, revocable at any time; it is never automatic.
• Legal & security — regulators, law enforcement, or our CERT-In empanelled auditors, where a valid legal requirement applies.

• Location. Personal data is stored on infrastructure located in India. If processing ever requires a transfer outside India, it will follow the restrictions notified under the DPDP Act.
• Account and proof data — kept while your account is active. If you delete your account, personal data is removed within 30 days, except what the law requires us to retain.
• Security logs — retained for a rolling 180 days in India, per CERT-In directions, then deleted.
• De-identified aggregates (like “average streak length”) may be retained after deletion — these cannot identify you.

• All traffic is encrypted in transit (TLS); passwords are stored only as salted hashes.
• Access to production data is restricted to a small, named engineering team.
• Security incidents are reported to CERT-In within the mandated 6-hour window, and affected users are notified without undue delay.
• Full details are on our Security page.

• Access a summary of your personal data and the list of processors handling it.
• Correct, complete or update your personal data.
• Erase your account and personal data, unless retention is required by law.
• Withdraw consent at any time — withdrawal is as easy as giving consent, and we will stop processing except where the law requires it.
• Nominate another individual to exercise your rights if you are unable to.

To exercise any right, email grievance@crugex.com. We respond within the timelines prescribed under the DPDP Act and Rules. If you are unsatisfied with our response, you may escalate to our Grievance Officer ( /grievance ) and thereafter to the Data Protection Board of India.

Assessments are scored automatically, and XP is awarded automatically, by deterministic rules — not opaque profiling. If an automated result materially affects your Verified status, you may request a human review through our grievance channel.

Our Grievance Officer handles privacy and content complaints under the IT Rules, 2021 and the DPDP Act. Complaints are acknowledged within 72 hours and resolved within 15 days. Full details, timelines and escalation paths are on the Grievance Officer page.

If we change this policy materially, we will notify registered users by email and in-app notice before the change takes effect, and update the date above. Continued use after notice means you accept the updated policy.