Privacy Policy

1. Introduction

Mookti, Inc. ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our educational platform and services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, and profile information
• Payment and Purchase Information: Payment details are processed securely by Stripe for web purchases or Apple for App Store purchases. We never store full credit card numbers. We receive and retain purchase records such as the product, transaction identifier, subscription status, purchase and renewal dates, and refund or revocation status
• Educational Content: Study materials, course information, goals, and learning activities
• Communication: Messages you send to support or through our platform

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, and interaction patterns
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies: Small files stored on your device for authentication and preferences
• Learning Analytics: Progress data, performance metrics, and study patterns to personalize your experience

3. How We Use Your Information

We use your information to:

• Provide and improve our educational services
• Personalize your learning experience with Ellen (our AI assistant)
• Process payments and manage subscriptions
• Send service updates and respond to your requests
• Analyze usage to improve our platform (using aggregated, de-identified data)
• Conduct research to advance learning science (with appropriate consent or anonymization)
• Send you marketing communications (you can opt out anytime)
• Ensure security and prevent fraud
• Comply with legal obligations

3.1 AI and Machine Learning

We use AI to power your learning experience. We may use aggregated, anonymized data to improve our AI systems. Data obtained from Google APIs (including Google Calendar and Google Tasks data) is never used to develop, improve, or train generalized AI or machine-learning models, and is used only to provide and improve Mookti's user-facing features. If we ever want to use any other personal data to train AI models, we will obtain your explicit consent first and give you full control over what data is used.

4. Third-Party Services

We use trusted third-party services to operate our platform:

• Stripe: Payment processing (subject to their privacy policy)
• Apple: In-app purchase processing, subscription management, transaction verification, refunds, and App Store server notifications for purchases made in Mookti's iPhone, iPad, and Mac App Store apps (subject to Apple's privacy policy)
• Firebase: Authentication and database services
• Vercel: Web hosting and content delivery
• AI Providers: Anthropic (Claude models), Google (Gemini models), OpenAI (GPT models), and Voyage AI (embeddings that make your study materials searchable) power Ellen and related features. These providers process your queries and content solely to provide the service and do not use your data to train their models. Data obtained from Google APIs is never used to develop, improve, or train generalized AI or machine-learning models.
• Analytics: PostHog (product analytics and session replay — replays show page layout and clicks only; all text, typed input, and images are masked before recording) and Vercel Analytics across our website and app, and Firebase Analytics and Vercel Speed Insights in our app at app.mookti.com, for usage insights. In the EU/UK, Canada, Brazil, India, and other regions with opt-in rules, analytics run only after you say yes — through the cookie banner on our website, and through the consent prompt or Settings → Privacy in the app. Elsewhere they run by default until you turn them off. We use the resulting data in aggregated form.
• Error Monitoring: Sentry, to detect and diagnose errors and crashes across our website and app. In the app, Sentry can also record a masked replay of a session (typed text hidden, media blocked); like our other session replays, this runs only while your analytics choice is on.

These providers are contractually required to protect your data and use it only for providing services to us.

4.1 Google Calendar and Google Tasks Integration

If you choose to connect your Google account, Mookti accesses your Google Calendar and Google Tasks data through Google's OAuth 2.0 authorization. Here is what we access and why:

Data we read from Google Calendar:

• Your calendar list (names and IDs of your calendars)
• Event details: titles, descriptions, locations, start/end times, and event status
• Your Google Account email address (to identify your connected account)

Data we write to Google Calendar:

• Study sessions and learning events you create in Mookti can be synced to your Google Calendar
• Updates or deletions to synced events are reflected in both directions
• A dedicated "Mookti Study" calendar is created in your account so study events stay organized separately from your personal calendars

Data we read from Google Tasks:

• Your task lists (names and IDs), used to find or create the list where your Mookti study tasks live

Data we write to Google Tasks:

• Study tasks created in Mookti (for example, "Review Chapter 5") are synced to Google Tasks
• Task status updates and deletions are reflected as you progress

How we store and use this data:

• Your OAuth tokens (access and refresh tokens) are stored securely in our database and used only to maintain your calendar connection
• Synced calendar events are stored in our database to display within the Mookti app and enable bidirectional sync
• Sync activity is logged for troubleshooting and to support incremental sync (only fetching changes since the last sync)
• We do not use your Google Calendar or Google Tasks data for advertising, marketing, model training, or any purpose unrelated to providing and improving the calendar and task sync features

How to disconnect:

• You can disconnect Google Calendar at any time from your account settings
• When you disconnect, we revoke our access with Google and delete your stored OAuth tokens
• You can also revoke access directly from your Google Account permissions page

5. Data Sharing and Disclosure

We only share your information when:

• You consent: When you explicitly agree to share information
• Service providers: With third parties who help operate our platform (under strict data protection agreements)
• Educational partners: With your consent, we may share information with educational institutions or service providers you choose to connect with
• Aggregated data: We may share anonymized, aggregated data for research or business purposes
• Legal requirements: When required by law, court order, or to protect rights and safety
• Business transfers: In connection with a merger or acquisition (your rights remain protected)
• Advertising measurement (website only): With your permission — or, in regions where the law allows, until you opt out — we share limited browsing information from mookti.com (such as pages visited and a cookie identifier) with Reddit to measure our ads and reach similar audiences. This counts as "sharing" under California law. You can opt out any time via Do Not Sell or Share My Personal Information in the site footer, and we honor Global Privacy Control signals. We do not share information from inside the Mookti app for advertising.

We never sell your personal information to third parties. Google user data is never shared or transferred under the provisions above except as necessary to provide the calendar and task sync features, consistent with the Limited Use requirements of the Google API Services User Data Policy.

6. Data Security

We implement industry-standard security measures including:

• 256-bit SSL encryption for data transmission
• Encrypted data storage
• Regular security audits and updates
• Access controls and authentication requirements
• Secure, SOC 2 compliant data centers

In the event of a data breach affecting your personal information, we will notify you within 72 hours.

7. Data Retention

7.1 Active Accounts

We retain your data while your account is active and you continue to use Mookti.

7.2 After Subscription Cancellation

When you cancel your subscription:

• You lose access to premium features at the end of your billing period
• Your account and data remain intact
• You can resubscribe anytime to regain full access
• Your learning progress and history are preserved

Why we keep your account: Many users return after taking a break. We preserve your learning data so you can pick up where you left off.

7.3 Account Deletion (User-Requested)

You can permanently delete your account and all data at any time:

How to Delete Your Account:

• Option 1: Click "Delete Account" in your account settings
• Option 2: Email privacy@mookti.com from your registered email address
• Web request: Use the public Mookti account-deletion page even if you no longer have the app installed

What happens when you delete:

• We process your request within 24-48 hours
• All your data is permanently deleted from our systems
• You receive a confirmation email when deletion is complete
• This action cannot be undone

What gets deleted:

• Your profile and account information
• All conversations with Ellen
• Your learning progress and study history
• All study sessions and notes
• Your subscription and payment methods
• All stored embeddings and AI-generated data

7.4 Legal Retention Requirements

Some data is retained for legal compliance even after account deletion:

• Payment records: Anonymized billing data retained for 7 years (tax law requirement)
• Audit logs: Deletion requests and timestamps retained for 7 years (compliance requirement)
• Anonymized analytics: Aggregated usage data retained indefinitely (research purposes)

All retained data is anonymized and cannot be linked back to you.

7.5 Parental Rights (Users Under 18)

Parents and guardians can ask us to delete a child's account. See Section 9 (Children's Privacy) for the age rules that apply in each region and how to make a request.

7.6 Backups

Deleted data may persist in backups for up to 90 days, after which it is permanently removed from all systems.

8. Your Privacy Rights

8.1 All Users

You have the right to:

• Access: Request a copy of your personal data
• Correct: Update inaccurate information
• Delete: Request deletion of your account and data
• Export: Download your data in a portable format
• Opt-out: Unsubscribe from marketing emails (service-related emails still sent)
• Object: Object to certain types of data processing
• Withdraw consent: Withdraw previously given consent for data use

8.2 California Residents (CCPA)

California residents have additional rights:

• Right to know what personal information we collect and how it's used
• Right to delete personal information
• Right to opt out of the "sale" or "sharing" of personal information — we don't sell data; to stop the advertising-measurement sharing described in Section 5, use Do Not Sell or Share My Personal Information in the site footer. In the app, analytics can be turned off any time in Settings → Privacy. We honor Global Privacy Control (GPC) browser signals as an opt-out on both.
• Right to non-discrimination for exercising privacy rights

To exercise these rights, email privacy@mookti.com

8.3 European Users (GDPR)

If you're in the EU/EEA, you have additional rights under GDPR including data portability, the right to object to processing, and the right to lodge a complaint with your supervisory authority.

8.4 India (Digital Personal Data Protection Act, 2023)

If you are in India, you have the right to:

• Access a summary of the personal data we hold about you and how we use it
• Have inaccurate or incomplete data corrected or updated
• Have your data erased when it is no longer needed for the purpose you gave it
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated
• Have a grievance heard and answered

To exercise any of these rights or to raise a grievance, email privacy@mookti.com. We aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. We process your data on the basis of your consent, which you can withdraw at any time by deleting your account (Settings → Delete account) or by emailing us; withdrawal does not affect processing that already happened.

9. Children's Privacy

Age Requirement: Mookti is intended for users 13 and older, and for users 18 and older in India. Our Terms of Service do not permit children under 13 to use Mookti anywhere, or anyone under 18 to use Mookti in India. We do not knowingly collect personal information from either.

9.1 Children Under 13 (COPPA)

Children under 13 may not create an account or use Mookti. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us personal information, contact privacy@mookti.com.

9.2 Parental Rights (Users 13–17 Outside India)

For users under 18 years of age, parents or legal guardians can:

• Review their child's personal information
• Request deletion of their child's data
• Refuse further collection of their child's information

Contact us at privacy@mookti.com with proof of parental/guardian relationship to exercise these rights.

9.3 Teen Users (13–17 Outside India)

Users aged 13-17 should have parental awareness of their Mookti use. We encourage parents to discuss online privacy with their teens.

9.4 Users in India

Under India's Digital Personal Data Protection Act, 2023, anyone under 18 is a child. Mookti is only available to people 18 and older in India, and we do not knowingly process the personal data of a child in India.

• When you sign up or sign in from India, we ask you to confirm that you are 18 or older. We record that confirmation (the date, the version of the notice you saw, and technical details such as your IP address) so we can show it was given.
• Until you confirm you are 18 or older, we do not collect usage analytics, run session recording, or use any tracking, behavioural monitoring, or targeted advertising on your visit.
• If you tell us you are under 18, we pause your account and stop processing your data beyond what is needed to let you download or delete it. Your account stays paused unless you contact us at privacy@mookti.com and we resolve it with you.
• We do not currently offer a parental-consent process for users in India who are under 18.
• If you are a parent or guardian in India and believe your child has created an account, email privacy@mookti.com and we will delete it.

10. Cookies and Tracking

On our website (mookti.com) we use:

• Essential: mookti_consent and mookti_regime remember your cookie choice and the region-based rules that apply to you. Always on.
• Analytics: PostHog (ph_*) for page views, clicks, and anonymized session replays; Vercel Analytics (cookieless).
• Advertising: Reddit (_rdt_*) for ad measurement and audiences, as described in Section 5.

In the EU/UK, Canada, Brazil, India, and other regions with opt-in rules, analytics and advertising cookies run only after you accept them in our cookie banner. Elsewhere, they run by default and you can turn them off at any time via Cookie settings / Do Not Sell or Share My Personal Information in the site footer; we also honor Global Privacy Control signals.

In the Mookti app (app.mookti.com) we use:

• Essential: sign-in and session cookies, a guest-session marker, mookti-geo (the region whose rules apply to you), and your analytics choice. Always on.
• Analytics: PostHog (ph_*) for usage events and masked session replays (layout and clicks only — text, typed input, and images are masked); Firebase Analytics (_ga*) and Firebase Performance; Vercel Analytics and Speed Insights (cookieless); and Sentry session replay (masked). None of these run until your analytics choice is on.

The same regional rule applies in the app: in opt-in regions nothing above runs until you choose Allow analytics in the app's consent prompt; elsewhere analytics run by default. You can change your choice at any time in Settings → Privacy in the app, and we honor Global Privacy Control signals there too. Your choice is saved to your account and follows you across your devices (for guests, it is saved on the device). If you declined analytics cookies on mookti.com, the app starts from that choice. There is no advertising tracking in the app. If you are in India and have not yet confirmed that you are 18 or older, we do not collect usage analytics from you in the app at all — the analytics controls stay off until you do. You can also control cookies through your browser settings; disabling essential cookies may limit some features.

11. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers in compliance with applicable laws.

12. Marketing Communications

We may send you marketing emails about new features, offers, and educational content. You can opt out anytime by:

• Clicking "unsubscribe" in any email
• Updating preferences in your account settings
• Emailing hello@mookti.com

You'll still receive important service-related emails even if you opt out of marketing.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We'll notify you of significant changes by:

• Email to your registered address
• Prominent notice on our website
• In-app notification

Continued use after changes constitutes acceptance of the updated policy. For material changes that require consent, we'll obtain your explicit agreement.

14. Your Choices and Controls

• Account Settings: Update preferences and privacy controls in your account
• Email Preferences: Opt-out links in all marketing emails
• Cookie Controls: Cookie settings / Do Not Sell or Share My Personal Information in the website footer, Settings → Privacy in the app, plus your browser settings
• Data Download: Request your data export anytime
• Account Deletion: Permanently delete your account from settings
• Consent Management: Review and withdraw consents for specific uses

15. Contact Us

Questions about this privacy policy or your data?

• Privacy inquiries: privacy@mookti.com
• Support: help@mookti.com
• General: hello@mookti.com

Response time: We respond to privacy requests within 48 hours and fulfill requests within 30 days as required by law.

16. Our Public Benefit Commitment

As a Public Benefit Corporation, we're legally committed to balancing profit with purpose. Our data practices reflect this commitment:

• We prioritize your privacy and learning success over profit maximization
• We make data decisions based on what's best for students and learners
• We're transparent about how we use data to improve learning outcomes
• We give you meaningful control over your information
• We advocate for strong privacy protections in education technology