Skip to content
MSRX PlannerMSRX PlannerHome

Privacy Policy

Early Access. Last updated 14 October 2026. This page describes what the software actually does, written from the code, in plain language. For how the system is built see How MSRX Planner works; for a walkthrough see the User Guide.

The short version

  • Your notes, plans and study data are yours. We do not sell them, we do not show advertising, and we do not train AI models on them.
  • Without an account everything stays in your browser. It leaves your device only when you sign in and sync.
  • The AI coach sees a small summary of your workspace, listed below. It is optional.
  • You can export everything and delete your account yourself, at any time, from Settings.

Who is responsible for your data

For India’s Digital Personal Data Protection Act 2023 the data fiduciary, and under the UK and EU GDPR the data controller, is Mrinal Singh Raja, an individual publishing under the name “MSRX”. MSRX is a brand name, not a registered company. Requests and grievances, including under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, go to mrinalsinghraja@gmail.com. We aim to acknowledge within 24 hours and resolve within 15 days. If you are in India you may also complain to the Data Protection Board; in the EU or UK, to your national data protection authority.

What we collect, and why

  • Account details. Your email address, and your name if you sign in with Google. Used to identify your account and send sign-in and password emails. Basis: providing the service you asked for.
  • Your study content. The workspaces, subjects, notes, assignments, exams, revision cards, planner sessions, materials you upload, and study groups you create. Used to store and sync your work and show it back to you and to people you choose to share it with. Basis: providing the service.
  • Study activity. Which sessions you completed, cards you reviewed and questions you attempted. Used to compute your streak, readiness and revision schedule, all on your device and in your own workspace. Never used to rank or profile you against other people.
  • Preferences. Theme, accent, notification and feature settings. Stored on your device and synced to your account.
  • Technical logs. Our hosting provider keeps short-lived request logs (time, path, status) for security and debugging. We use them to fix faults, not to study you.

We do not collect your phone number, address, school or government identifiers, location beyond the approximate country-level location in anonymous visit counts, contacts, or payment details. MSRX Planner is free and takes no payments.

Where your data lives

MSRX Planner is local-first. Your device holds a full working copy, which is why the app works offline. When you sign in, changes are sent to our cloud database so they follow you across devices.

  • On your device. Your browser’s local storage holds your workspace copy and a queue of changes waiting to sync. Small keys remember things such as your last visit, dismissed notices and whether the invite prompt was answered. Nothing in these keys is sent anywhere except the workspace data you sync. Clearing site data in your browser erases them.
  • In the cloud. Supabase hosts our PostgreSQL database, sign-in service and private file storage. Row-Level Security means a signed-in user can read and write only their own rows and content explicitly shared with them. Uploaded files sit in private storage under a folder named for your account and are served only by short-lived signed links after a permission check.
  • Hosting. Vercel serves the website and runs the server routes, including the AI route.

Who else handles data (processors)

We use these services to run MSRX Planner. They process data on our instructions and under their own terms. We do not give your data to anyone else.

  • Supabase — database, authentication, file storage. Holds your account and study content.
  • Vercel — hosting, request logs and anonymous visit counts.
  • Groq — runs the language model behind the AI coach. Receives only what is described under AI features.
  • Cloudflare Turnstile — a bot check on sign-in, sign-up and password reset. It sees the request your browser makes to verify that you are not an automated script.
  • Resend — delivers sign-in and password emails from the msrx.co.in domain.
  • Google — only if you choose “Continue with Google”. We receive your name and email from Google.

Some of these providers run servers outside India. By using the service you accept that your data may be processed in those locations. We keep the list above current; it is the complete list.

AI features: exactly what is sent

When you ask the coach something, your browser builds a summary of at most 5 KB and sends it with your question to our server, which forwards it to Groq. The summary can include:

  • your display name, workspace name and study goal;
  • counts and scores computed on your device (overdue items, cards due, readiness, consistency);
  • titles of overdue assignments and upcoming exams, and today’s session titles;
  • the question you typed (up to 2,000 characters).

If you use the PDF feature, the text of the pages you select (up to about 14,000 characters) is extracted in your browser and sent for that request; the file itself is not. Your other notes, files and account details are not sent. Do not type into the coach anything you would not want a language-model provider to process, such as other people’s personal details or passwords. API keys are held on our servers and are never exposed to your browser. We do not store coach conversations in our database; Groq handles requests under its own terms and retention. AI is optional: nothing else in the app needs it.

Anonymous visit counts

We count visits with Vercel Web Analytics, which is part of the service that hosts this site. It sets no cookies and stores nothing on your device. For each page view it records the page address, the site that linked you here, an approximate location (country, region and city) worked out from the request, and your browser, operating system and type of device. Anything after a ? or # in the address is removed before the count is sent, because that part can hold something you typed.

Inside your workspace, record identifiers in the address are replaced with a placeholder before the count is sent, so it learns that a note or a subject was opened and never which one. Invite links are never counted at all.

It does not store your IP address. Visitors are told apart only by a hash of the request that Vercel discards after 24 hours, so a page view cannot be tied to you, to your account, to your other visits, or to what you do on other websites. What we see is totals: how many people opened which page. A content blocker, or turning JavaScript off, stops the count and changes nothing else about the site.

Cookies

We set the cookies needed to keep you signed in (a secure, httpOnly session from Supabase). We set no advertising or tracking cookies, so there is no cookie banner to dismiss.

Sharing

Nothing is shared until you choose to share it. When you add something to a study group, only that group’s members can see it. You can remove a share or leave a group at any time. What you share with a group is visible to its members, who can copy it, so share with people you trust.

How long we keep it

  • While your account exists: your content stays until you delete it.
  • Deleted items: a note, assignment or card you delete moves to trash and is purged after 30 days.
  • Deleted account: deleting your account removes your profile and everything you own from the live database at once.
  • Backups: because we run on a free database plan with no provider backups, we take our own periodic backups, held privately on the operator’s own computer and used only to recover from a failure. A backup taken before you deleted your account may still contain your data until it is overwritten by newer ones, normally within a few weeks.
  • Visit counts: anonymous totals may be kept indefinitely because they describe no one.

Security

  • All traffic uses HTTPS; data is encrypted at rest by the provider.
  • Access is denied by default; Row-Level Security enforces per-account access in the database itself.
  • Passwords are never stored by us; they are hashed by the sign-in service. Sessions use secure cookies.
  • Sign-in is protected by a bot check, and the AI route requires you to be signed in and caps the size of every request.
  • No system is perfectly secure. If a breach affects your data we will tell the people affected without undue delay, and the Data Protection Board where the law requires.

Children and young people

MSRX Planner is for students aged 13 and over. Under India’s Digital Personal Data Protection Act a person under 18 is a child. If you are under 18 you may use the service only with the permission of your parent or legal guardian, and by creating an account you confirm that you have it. We do not show advertising to anyone, do not track or profile anyone’s behaviour for marketing, and do not use study data for anything but running your own planner. A parent or guardian who believes a child has signed up without permission can write to us and we will delete the account.

Your rights

You can access, correct, export and erase your data, withdraw consent, and nominate someone to act for you under the DPDP Act, and you have the corresponding rights under GDPR where it applies. Most of this you can do yourself: export a full JSON copy from Settings → Data and delete your account from Settings → Data. For anything else, email us. See Data Deletion for the details.

Changes

If we change this policy in a way that matters we will update the date above and show a notice in the app. Earlier wording is not retained as a separate page.

Contact

mrinalsinghraja@gmail.com · msrx.co.in

This page is a plain-language description of how the product works. It is not legal advice and has not been reviewed by a lawyer.