Privacy policy
Who we are
College Fit guides students from class 9 through college, and their parents, in Telangana and Andhra Pradesh. Our team is based in Hyderabad. College Fit is run by BitByteBuild Private Limited, 3rd floor, Manne Residence, Plot No. 265, Road No. 33, Ayyappa Society, Hyderabad, Telangana 500081 ("College Fit", "we", "us").
Under India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, we are the data fiduciary for your family's information: we decide why and how it is used, and we are responsible for it.
What this policy covers
This policy covers the College Fit app on the web and on Android, our counselling service, and this website, collfit.com. When you first sign in to the app, the parent who set up the family is shown a short notice and asked for consent. The notice summarises this policy; this policy gives the detail.
What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Family details | Names, relationships to the student, phone numbers, the language each person prefers | You, when we set up your family, and when you invite members |
| The consenting parent | Full name, relationship and date of birth, to confirm the parent is an adult | The parent, when giving consent |
| Your child's education | Class, school, board, exams, marks and ranks | You and your child |
| Your family's plan | Priorities such as cost and distance, the plan, tasks, shortlist and decisions | Your family and your counsellor |
| Messages and files | Chat messages, photos, PDFs, voice notes, documents you upload, Check This questions | Your family and your counsellor |
| Calls | Date, time, attendance, the counsellor's notes and your rating. Calls are not recorded. | Your counsellor and you |
| Account and device | Sign-in sessions and the kind of device each is on (for example "Android app, Pixel 7"), passkeys (we hold only the public key), notification tokens for your devices | Your browser or phone |
| Activity | Who has read which message, when tasks were done, a log of who on our team opened your family's space, and your internet address for a few minutes to stop repeated sign-in attempts. We also count how often public pages and videos are viewed, without knowing who viewed them. | The app, as you use it |
| Messages to us | What you write to hello@collfit.com, or to our WhatsApp number | You, including families who don't join |
When we set up your family, before you sign in, we record the student's name, class, board, school and city, and the parent's name, relationship, phone number and language, from our first conversation with you. We need these to create your family's space and send you the sign-in link; nothing else is added until a parent agrees to the notice.
We do not collect Aadhaar numbers, and the app refuses a message that contains one. We do not collect payment card or bank details, your location, or your contacts. Your fingerprint or face never leaves your phone: your phone checks it, and we never see it. Please don't send mark sheets or ID documents by email or WhatsApp; upload them in the app instead.
How we use it
We use your family's information for these purposes, and no others:
- Counselling your child (needed). Building your family's plan, tasks and shortlist, answering your messages and Check This questions, holding calls, checking documents, and sending reminders before deadlines.
- Running the service safely. Signing you in, keeping each family's space private, keeping time on our promises to you, and fixing faults.
- Feedback (optional). Asking you how the service is going, if you agree.
- Improving the service (optional). Learning from the questions families ask, with names removed, if you agree.
We do not sell your information, show you advertising, track or monitor your child's behaviour, target advertising at children, or use your information to train artificial intelligence. Notifications on your phone never include your child's details: they say only that something new is waiting in the app.
Consent for your child
Students in school are usually under 18. The law treats them as children, so a parent or lawful guardian gives verifiable consent on their behalf. Before anything about your child is shown in the app, or anything more is collected:
- we set up the family after speaking with the parent, and send the sign-in link only to the parent's own phone number;
- the parent reads our notice, in the language they chose, gives their full name, relationship and date of birth to confirm they are an adult, and agrees;
- at the first planning call, the counsellor confirms the parent's identity and marks the consent as checked;
- we record the consent, the notice version and the time. A consent record is never edited; a change is a new record.
Most college students are 18 or older. If the student is 18 or older when your family joins, or turns 18 while we work with your family, we ask the student for their own consent, and from then on the rights below are theirs.
The counselling purpose is needed for the service. The two optional purposes can be turned off at any time: tell your counsellor in the app's chat, or write to our grievance officer. To withdraw consent altogether, use "Delete our data" in Settings, or tell us in the same ways; we then stop the service and delete your family's information as described below. Withdrawing doesn't affect what was done before.
Who can see it
- Your family. The parent who set up the family and up to four people they invite (five in all) see your family's space. Each signs in separately.
- Your counsellor and their backup, our head of counselling, who oversees the quality of every family's counselling, and our founder.
- Other staff only when there is a reason, such as fixing a fault you reported. They must record the reason, and their access ends after 12 hours. Every access is logged.
We share information with the authorities only if the law requires it.
Services we use
These companies process information for us, under their terms for business customers and only to provide their service to us:
| Service | What it does for us |
|---|---|
| Amazon Web Services | Hosts the app, its database and your files in Mumbai, with backups in Hyderabad |
| Cloudflare | Carries traffic between you and the app securely, and hosts this website |
| Google Firebase Cloud Messaging | Delivers notifications to the Android app. It sees only generic text, such as "You have a new message". |
| Google Workspace | Receives what you write to hello@collfit.com |
We also use these services, which have their own privacy terms, outside the app:
| Service | What it does for us |
|---|---|
| Google Meet | Video calls with your counsellor, through a link in the app. Calls are not recorded. |
| Your counsellor sends sign-in links and the occasional reminder from our WhatsApp Business phone, by hand. |
Web notifications are delivered by your own browser's push service (for example, Google's for Chrome or Apple's for Safari), with the same generic text.
Where it is stored
Your family's information, files and backups are stored in India: in Mumbai, with backup copies in Hyderabad. Cloudflare and the push services may carry traffic outside India in transit, without storing your family's information. Google Workspace, Google Meet and WhatsApp may process your emails, calls and WhatsApp messages with us outside India.
How we protect it
- Connections are encrypted, and the server accepts no connection from the internet except through Cloudflare.
- Dates of birth, marks and phone numbers are encrypted again inside the database. Disks and backups are encrypted.
- Files are kept in private storage, and links to them expire within minutes.
- There are no passwords to steal: sign-in links work once and expire in 48 hours, then you use your fingerprint or face, which never leaves your phone. Staff must use a passkey.
- Our logs contain no names or phone numbers.
How long we keep it
- During counselling, we keep your family's information for as long as your family uses College Fit.
- When your plan ends, or you stop, we tell you 7 days before your plan ends. If your family does not continue, we delete everything, backups included, within 60 days of the end. You can download your data first.
- If you ask us to delete your data, we do it within 7 days, and it leaves our backups within 60 days.
- Sign-in sessions end after 90 days without use on a family member's device.
- Emails and WhatsApp messages from families who don't join are deleted within [6 months: confirm]. Those from families who join follow the same rules as the rest of their information.
- Our system logs, which hold no names or phone numbers, are kept for one year for security.
We may keep a record that consent was given or withdrawn, and that a deletion was done, for as long as the law requires us to show it.
Your rights
Under the DPDP Act, you can:
- See your information. The parent who set up the family can use "Download our data" in Settings to get a copy as a file.
- Correct it. Most details can be changed in the app; for anything else, ask your counsellor.
- Delete it. The parent who set up the family can use "Delete our data" in Settings.
- Withdraw consent, as described above.
- Nominate someone to use these rights for you if you die or become unable to: write to our grievance officer with their name and how to reach them.
- Complain to us, and then to the Data Protection Board of India.
Other adult family members, and the student once 18, can ask for a copy of their own information or its deletion by writing to their counsellor in the app or to our grievance officer. Our staff act on download and deletion requests within 7 days. A child's rights are used by the parent or guardian who gave consent.
Cookies and tracking
This website sets no cookies and loads nothing from other companies: no analytics, no advertising and no social media buttons. If you choose a light or dark theme, your browser remembers that choice on your own device (in its local storage); it is never sent to us. Cloudflare, which hosts the site, keeps standard request logs for security.
The app uses only the cookies it needs to work: one that keeps you signed in, one that protects your forms from misuse, and three that remember your language and your light or dark theme, including the language you pick before signing in. The Android app keeps its sign-in in your phone's secure storage. Neither has third-party analytics or advertising.
If something goes wrong
If your family's information is ever exposed, we will tell you without delay, in the app and by message, in plain words:
- what happened, and when;
- what information it affected, and what it could mean for you;
- what we have done to stop it and limit the harm;
- what you can do to protect yourself, and who to contact.
We will also report it to the Data Protection Board within 72 hours, and to CERT-In within 6 hours, as the law requires.
Questions and complaints
For anything about your information, write to our grievance officer:
[name of the grievance officer]
[email address] · [phone number]
[postal address]
We will acknowledge your complaint within 7 days and resolve it within [30 days: lawyer to confirm]. If you are not satisfied with our answer, or we don't reply in time, you can complain to the Data Protection Board of India through its online complaint service.
Changes to this policy
If we change how we use your family's information, we will update this page and the notice in the app. If a change needs your consent, we will ask for it in the app before it applies to you.