Privacy Policy

What we collect

• Account details: your mobile number (used to sign in with a one-time code), and optionally your name, email address and a password. Passwords are stored only as a one-way Argon2 hash — we can never see them.
• Billing details when you buy a package: name, email, mobile number, address, city and (optionally) postcode. We keep these to prefill your next checkout; you can edit them at Account → Billing.
• Payment records: the package, amount, transaction ID and status of each payment, plus the payment confirmation our payment gateway (SSLCommerz) returns. We never receive or store your full card number, PIN or mobile banking password.
• Learning data: the questions you answer, whether you got them right, your confidence rating, Model Test answers, scores and timing, your revision queue, and your AI Study Plan.
• AI usage: how many Live AI messages you send each day. We do not store the text of your Live AI chats on our servers.
• Technical data: your browser stores your language choice and sign-in session on your device. For visitors who are not signed in, we keep a salted, one-way hash of the IP address (never the address itself) to limit free AI previews per day.

How we use it

• To sign you in, run your account and keep it secure.
• To give you practice, Model Tests, revision, progress and AI features based on your own results.
• To process payments and activate the packages you buy.
• To apply fair limits — one free trial per phone number and email, and daily AI message limits.
• To send you service SMS (such as sign-in codes) and, unless you opt out, occasional SMS about your plan and new features.
• To measure and improve our marketing (see "Analytics and advertising").

Who we share it with

We do not sell your personal data. We share only what each service needs to work:

• SSLCommerz — our payment gateway receives your billing details and the payment amount to process a payment.
• BulkSMSBD — our SMS provider receives your mobile number and the message text to deliver sign-in codes and SMS updates.
• Supabase (database and sign-in) and Vercel (hosting, Singapore region) — store and serve the app and your data on our behalf.
• Google Gemini — receives the text of your Live AI chat messages to write replies, and question text to write answer explanations. No name, phone number or account ID is sent.
• Anthropic Claude — receives a summary of your progress (subject accuracy, weakest chapters, recent Model Test scores) to write your AI Study Plan, and question text for some answer explanations. No name, phone number or account ID is sent.
• OpenAI — receives only question text, to find matching study material. No personal data is sent.
• Meta (Facebook) and Google Analytics — see below.
• Authorities, when Bangladeshi law requires it.

Analytics and advertising

We use the Meta Pixel and Google Analytics 4 on our public and student pages. They use cookies (such as _fbp, _fbc and _ga) to count visits and to tell us which ads lead to sign-ups and purchases.

When you sign up, start a checkout or complete a purchase, we also report that event directly to Meta (Conversions API). Your email, mobile number and account ID are sent only as one-way (SHA-256) hashes; your IP address, browser type and the purchase value are sent as they are.

You can block these cookies in your browser settings or with an ad blocker; BCS.Guru keeps working without them. You can also manage ad preferences in your Facebook and Google account settings.

Marketing SMS

We may send occasional SMS about your plan (for example, when it is about to expire) and new features. You can turn these off anytime at Account → Profile → "Promotional SMS". Sign-in codes and payment messages are always sent, because the service needs them.

How long we keep data

We keep your account and learning data while your account exists, so your progress is there when you come back. Payment records are kept for as long as your account exists, and SSLCommerz keeps its own record of every payment. Daily usage counters are kept as simple counts and contain no message content.

Your choices and rights

• See and edit your name, email and billing details at Account.
• Turn promotional SMS off at Account → Profile.
• Ask us for a copy of your data, to correct it, or to delete your account — write to hello@teckpal.com from your account email, or message us on WhatsApp from your registered number. We reply within 7 working days. Deleting your account permanently removes your progress and purchases; SSLCommerz keeps its own record of payments you made.

Security

Data between your device and BCS.Guru is sent over HTTPS, passwords are hashed, payment card details are handled only by SSLCommerz, and database access is restricted so each student can only read their own records. Staff access to account data is limited to a small group of administrators, and every change they make to an account is logged. No system is perfectly secure, so please keep your sign-in code and password private.

Children

BCS.Guru is built for BCS candidates, who are university graduates. It is not meant for children under 18.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and tell you in the app or by SMS before it takes effect.

Contact

TeckPal Technology Ltd, AKM Tower, Lift 4, M-65, Beside BRAC University, Progati Sarani, Dhaka 1212. Email: hello@teckpal.com · Phone / WhatsApp: 01825555570 (10:00 am – 10:00 pm, 7 days).