Legal & Trust
Privacy Policy
Effective 7 October 2026. This covers the hosted service. The Android app's policy is published separately at sasikumar-23.github.io/privacy.html.
Who does what
The academy using Vagai Silambam decides what student information to record — it is the data controller. We host and process that information on the academy's behalf, as the processor.
What we hold
Account data: academy name, your name, email, phone, username and a hashed password (argon2id — never plain text).
Academy records: students (names in English and Tamil, date of birth, gender, contact, address, training level, medical notes), guardians, attendance, events, fees and payments, uniforms, achievements and certificates.
Billing: plan, subscription status and payment references. Card details are handled by Razorpay and never reach our servers.
Operational: audit logs of significant actions, and server logs. We do not log passwords or access tokens.
Files and attendance in your Google account
When you connect Google, photos, certificates and documents are stored in your Google Drive, and attendance is written to your Google Sheet. We request only the access needed for this, store the resulting tokens encrypted, and never use them for anything else. Disconnecting stops our access; the files remain yours. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
How it is used
To run the service, support you, process subscription payments, keep the service secure, and meet legal obligations. We do not sell data, we do not use academy records for advertising, and we do not use them to train machine-learning models.
Keeping academies apart
Each academy's records are isolated. Every request is checked against the signed-in user's academy on the server, and the database independently rejects queries that cross that boundary.
Who else sees it
Only our hosting and database provider, Razorpay for payments, and Google for the Drive and Sheets features you enable. Each is bound to handle the data only as instructed. We disclose information otherwise only where the law requires it.
Children's information
Academies often record information about students under 18. The academy is responsible for obtaining consent from parents or guardians before entering it. The service is intended for instructors and administrators, not for children.
Retention and deletion
Records are kept while the academy's account exists. Cancelling or letting a subscription lapse does not delete anything. On a written deletion request we remove the academy's data within 30 days, except what we must keep for tax and accounting. Files in your Google Drive are yours to delete.
Security
Encrypted connections, argon2id password hashing, encrypted Google tokens, role-based access, audit logging and regular backups. No system is perfectly secure; we will notify affected academies promptly about any breach that affects them.
Contact
Privacy questions, access or deletion requests: sasikumar23125@gmail.com.