TYCHR — Cookie and tracking notice
DRAFT, FOR LEGAL REVIEW. Not reviewed by a qualified Indian advocate. Not legal advice.
Version: 1.0-draft · Effective date: [insert] · Last updated: [insert] Applies to: app.tychr.com, platform.tychr.com, www.tychr.com and the TYCHR mobile apps
1. The short version
- We use a small number of cookies and browser storage entries to keep you signed in and to remember your choices. Those are necessary; the site does not work without them.
- We do not do behavioural tracking of students. We do not run targeted advertising, and we never direct advertising at children.
- Analytics and session replay are switched off for every student account, whatever consent exists, and are off entirely unless we tell you here that they are on.
- We do not use advertising cookies, retargeting pixels or data brokers. There is no Meta pixel, no advertising network and no cross-site tracking on the platform — app.tychr.com, platform.tychr.com and the TYCHR apps, which is what this notice is about and what we can check line by line in our own code.
- Our marketing website, www.tychr.com, is a separate WordPress site and is not covered by the statements in this notice. [VEDANT: the cookies and tags on the WordPress site need listing, or this notice needs to say it does not cover them at all.]
2. What a cookie is
A cookie is a small file a website stores in your browser so it can recognise your browser next time. We also use local storage and session storage, which work the same way but are not sent back with every request. Where this notice says "cookie" it means all of these.
3. The cookies and storage we actually use
Taken from the TYCHR platform code as at 1 November 2026.
3.1 Strictly necessary — always on
Without these you cannot sign in or use the platform. They carry no advertising value and are not shared with anyone.
| Name | What it does | Set by | Lifetime |
|---|---|---|---|
tychr_sid | Your signed-in session. This is what keeps you logged in as you move around the platform. | TYCHR (first-party) | Session, or up to the configured session lifetime [insert, from SESSION_MAX_AGE_SECONDS] |
jwt | The signed token that proves to our backend services who you are. | TYCHR (first-party) | Same as your session |
user | Your basic account details (name, role) so the page can render without an extra round trip. | TYCHR (first-party) | Same as your session |
testaccount | Marks an internal test account. Only ever set on internal accounts. | TYCHR (first-party) | Same as your session |
| Cross-site request forgery token | Protects forms and actions from being triggered by another site. | TYCHR (first-party) | Session |
| Browser local storage | Remembers interface choices — the subject you last opened, a draft you were typing, whether a panel was collapsed, your theme. | TYCHR (first-party) | Until you clear your browser |
These do not need your consent. They are necessary to deliver the service you asked for. If you block them you cannot sign in.
3.2 Live classes
Joining a live class sets short-lived entries from our video provider (LiveKit) so your audio and video can connect, and uses your browser's media permissions. These are technically necessary for the class and last only for the class.
3.3 Payments
When you pay, our payment gateway (Razorpay) sets its own cookies on its checkout, to run the payment and to detect fraud. Those are Razorpay's, governed by Razorpay's own policies, and are necessary to take the payment.
3.4 Sign in with Google
If you choose "Sign in with Google", Google sets its own cookies during sign-in. Those are Google's. If you sign in with email instead, this never happens.
3.5 Analytics, session replay and error reporting
Our code can load four such tools. Each one loads only if a key for it was set when the app was built, and each is additionally subject to the rules below. Which keys are set is a per-environment setting rather than something written in the code, so this notice tells you what each tool would do and what governs it. [VEDANT: confirm which of these keys are set on production, and name them here. Our own example configuration carries a Microsoft Clarity project id, so "none is configured" cannot be stated as a fact.]
| Tool | What it does | Cookies it sets | What governs it |
|---|---|---|---|
| PostHog (product analytics) | Counts which features are used, in aggregate | ph_* first-party cookies | Never on a student account. For everyone else, only after you accept on the cookie banner. Session replay is disabled in our configuration |
| Microsoft Clarity (session replay and heatmaps) | Records how a page was used, to find broken interfaces | _clck, _clsk | Never on a student account. For everyone else, only after you accept on the banner |
| Google Analytics 4 | Aggregate site usage statistics | _ga, _ga_* | Never on a student account. For everyone else, only after you accept on the banner. With no measurement id set, googletagmanager.com is never contacted |
| Sentry (error reporting) | Reports a crash so we can fix it. May include your account id and the page you were on | No cookie. A report is sent only at the moment an error happens | Different from the three above: it is on by default and the banner does not switch it off. It is how we find out the platform is broken, not a way of measuring you, and it is listed as a processor in the Privacy notice section 7. [LAWYER: whether error reporting may run without consent, or must be offered on the banner like the rest.] |
If we ever switch one on, these rules bind us:
- Never on a student account. Section 9(3) of the Digital Personal Data Protection Act, 2023 prohibits tracking and behavioural monitoring of children outright — parental consent does not make it lawful. Most of our students are under 18, so these tools are disabled for every student account rather than gated on consent.
- Only with your consent, for everyone else. A parent, adult learner, tutor or staff member sees a cookie banner with a genuine choice. Rejecting is one click, the same as accepting.
- Off means nothing happens. No script tag, no vendor request, no cookie, no storage entry. Not "loaded but idle".
- The provider's data processing agreement is signed before the key is set, never after. See the Processor register.
- This notice is updated first, with the tool named, before it goes live.
3.6 What we do not use
For the avoidance of doubt, and verified against the frontend code:
- No advertising or retargeting pixels. No Meta/Facebook pixel, no Google Ads remarketing tag, no LinkedIn insight tag, no TikTok pixel.
- No cross-site tracking, no device fingerprinting, no data brokers, no sale or sharing of data for advertising.
- No behavioural profiling of students to decide what to sell them.
- No targeted advertising directed at children, ever, by any route.
4. Marketing we do send, and how to stop it
Marketing from TYCHR goes by email, WhatsApp or SMS — never by tracking you around the web, and never to a student account. It goes only to a parent, guardian or adult account that has given the separate marketing consent described in the Privacy notice section 6.1, and every message carries a one-click unsubscribe. See the Privacy notice section 6.
5. Your controls
| What you want | How |
|---|---|
| Change your analytics choice | The Cookie choices link in the footer of every page, which reopens the cookie banner. Accepting and rejecting are one click each, on the way in and on the way back |
| Change a marketing choice | Settings → Privacy, on your account. That card covers the consents we hold on your account; the three analytics tools above are a browser choice and are not on it |
| Stop marketing email, WhatsApp or SMS | One click in any such message, or Settings → Notifications |
| Clear cookies already set | Your browser's settings. Clearing the necessary ones signs you out |
| Block cookies entirely | Your browser's settings. You will not be able to sign in |
| Ask what we hold about you | Settings → Your data, or email vedant@tychr.com |
A "Do Not Track" or Global Privacy Control signal from your browser is treated as a refusal of any optional analytics.
6. Changes
Any change to the tables above is made here first, with the date. If we switch on a tool that was off, we say so in this notice and ask for consent before it runs.
7. Contact
Grievance Officer and data protection contact: Vedant Patnaik, vedant@tychr.com, [insert postal address].
Draft, for legal review.