Privacy Policy

Who we are

Parho is an exam-preparation platform for students of the Boards of Intermediate and Secondary Education (BISE) in Punjab, Pakistan. In data-protection terms we are the controller of the information described below. You can reach us at privacy@parho.online.

What we collect

Information you give us

• Account details — your name and email address. Your email address is also your sign-in identifier.
• Academic details — the board and class you select, plus your daily study goal and how you heard about us.
• Your password — stored only as a scrypt hash with a unique random salt. We cannot read it, and neither can anyone who obtains a copy of our database.

Information created as you study

• Which questions you answered, what you picked, and whether it was correct.
• Test, drill and competition attempts, including scores and time taken.
• Your mistake notebook entries, XP total, level and day streak.
• Study sessions you add to your planner.

What we deliberately do not collect

We do not use advertising trackers, we do not build behavioural profiles, we do not record your location, and we do not read anything outside the app. We do not ask for your CNIC, date of birth, or payment details.

Why we use it

• To run the service — signing you in, showing your chapters, scoring your tests.
• To show you your own progress — mastery, accuracy and streaks are calculated from your attempts and shown only to you.
• To run competitions — when you enter one, your display name, initials and score appear on that competition's leaderboard. Your email address never does.
• To keep the platform working — diagnosing errors and preventing abuse.

We do not use your data to train machine-learning models, and we do not send it to advertising networks.

Cookies

Parho sets exactly one cookie: takhti_session. It holds a signed reference to your account, is marked httpOnly so page scripts cannot read it, and expires after 30 days. It is strictly necessary to keep you signed in — there is no tracking or analytics cookie to opt out of.

Your theme preference is kept in your browser's local storage. That never reaches our servers and clearing your browser data removes it.

Who can see your data

• You — everything, through the app and the data export in Settings.
• Administrators of your Parho instance — your name, email, board, class and activity counts, so they can support you and manage content. Administrators can reset a password but can never read an existing one.
• Other students — only your display name, initials and score, and only on a competition leaderboard you chose to enter.

We do not sell, rent or share your data with third parties.

How long we keep it

Your account and study history are kept for as long as your account exists. Password reset and email verification links expire within an hour of being issued and are single-use.

Your rights

• Access and portability — Settings → Privacy & Data → Export data gives you a complete JSON file of everything we hold about you.
• Correction — edit your name, board and class any time in Settings.
• Deletion — Settings → Privacy & Data → Delete account. You confirm by typing your email address. Deletion is immediate and permanent: your profile, attempts, mistakes, XP and competition entries are all removed and cannot be restored.

Children

Parho is designed for secondary-school students. If you are under 18, please make sure a parent or guardian is happy for you to use it. If you believe a child's data has been submitted without appropriate consent, contact us and we will remove it.

Security

Passwords are hashed with scrypt and verified with a constant-time comparison. Session cookies are HMAC-signed and httpOnly. Correct answers are never sent to the browser before a paper is submitted, and all scoring happens on the server. No system is perfect, so if you find a vulnerability please tell us at security@parho.online before disclosing it publicly.

Changes

If we change this policy we will update the date at the top of this page. Material changes will also be announced inside the app.