Privacy Policy

Who this covers

This website is run by Shashwat Yadav (“I”, “me”). The policy covers the whole site, including the contact form, the chat assistant and Live Classes (sign-in, enrolment and the My Classes page). For anything about your data, write to support@shashwatyadav.in.

What I collect, and why

Live Classes account

• Name and email address. To create your account, show you your classes and send you emails about them.
• Google account ID. If you sign in with Google, I also save the ID Google gives me for your account, so the next sign-in finds the same account.
• Password (older accounts only). Some earlier accounts have a password. It is stored only as a one-way hash, never in readable form.
• Mobile number with country code. Asked when you enrol, so I can reach you about a class if needed. It is checked for format only; it is not verified by SMS. You can edit it on My Classes.
• Class enrolments. Which class session you joined, when, and its status, together with a copy of your name, email and mobile number as they were when you enrolled.
• One-time codes. Codes for email verification and password reset are emailed to you. They are stored only as a hash, expire after 10 minutes and can be tried a limited number of times.
• Emails. See “Emails I send you” below.

Emails I send you

Students receive these emails about their classes:

• a welcome email the first time you sign in with Google;
• an enrolment confirmation with the class, date and time, a link to My Classes and a calendar file (.ics) you can add to your own calendar;
• a notice if a class is cancelled or rescheduled;
• a notice if I remove you from a class, when I choose to send one;
• a reminder 15 minutes before a class starts. You can switch it off on My Classes.

Sign-in and password-reset codes are also emailed to you (see One-time codes above). The Meet link is not put in these emails; it is only emailed if I have chosen to send calendar invites for a class (see Google Calendar below).

The emails are sent from support@shashwatyadav.in through Hostinger’s mail service. They contain no tracking pixels, no remote images and no marketing tools. I keep a log of each email (its type, the class, whether it was sent or failed, and any error message) so that the same email is not sent twice and failures can be fixed. Only I can see this log.

Cancelling and being removed

You can cancel your own enrolment on My Classes until 2 hours before the class starts. I can also remove a student from a class, and I may send them a notice when I do; My Classes then shows “Removed by organiser”. A reason I enter for the removal is kept with the enrolment.

Admin activity log

When I add, change, cancel, remove or delete things in the admin area, the site records which action it was, on which list, the record numbers involved and how many records. It holds no names, email addresses or mobile numbers.

Cookies and sign-in sessions

Live Classes uses only the cookies and browser storage it needs to work:

• live-classes-session: the session cookie that keeps you signed in. It is used only under /classes and the session ends after about 2 hours without activity. The server records the session together with your IP address and browser details.
• XSRF-TOKEN: a security token that protects forms. It is used only under /classes and lasts about 2 hours.
• A “remember me” cookie, set if you tick Remember me and always when you sign in with Google. It keeps you signed in on that browser for 30 days, or until you log out.
• lc_in: a small hint cookie that lets the site’s pages show Classes and My Classes instead of Log in. It contains only the number 1, no personal data, lasts 30 days and is removed when you log out.
• lc_intent: an entry in your browser’s session storage (not a cookie) that remembers which class you chose before going to Google to sign in. It stays in that browser tab only and is used only within 20 minutes.

Contact form

If you send a message through the contact form I receive what you type: name, phone or WhatsApp number, email, the service you need, budget range, your message, and the page you sent it from. It is saved in a Google Sheet that only I use, and an email notification goes to me. You also get an automatic confirmation email.

Chat assistant

The messages you type in the chat window are sent through my server to an AI service (OpenRouter) so it can write a reply; the last few messages of the conversation are included so replies make sense. The site does not keep a log of chats. If you choose to give your name and contact details to the assistant, they are saved as an enquiry in the same Google Sheet as the contact form.

Measurement and hosting

The site uses Google Tag Manager to load measurement tags. Those tags can set their own cookies, and what they measure is configured in Tag Manager rather than in the site’s own code. My hosting provider (Hostinger) also keeps standard server logs.

Google sign-in

When you choose “Continue with Google”, the site asks Google only for your basic profile and email address (your name, email address and account ID). It does not ask for access to your Google Calendar, Drive, contacts or anything else. I do not save your Google profile picture or any Google access token for your account. You can remove the connection at any time at myaccount.google.com/permissions.

Google Calendar access (site owner only)

Students are never asked to connect a calendar. Only I, as the site owner, connect my own Google account from the admin area, so the site can create, update and delete class events, with Google Meet links, on my calendar.

• The access requested is Google Calendar event access (calendar.events) plus my email address, to show which account is connected.
• The site stores the connected account’s email address and a long-lived access token (a refresh token). The token is encrypted in the database and is never shown on any page or sent to a visitor’s browser.
• I can disconnect at any time from the admin area, which revokes the token at Google and deletes it from the site.
• By default students are not added to the calendar event. Only if I tick the invite option for a class are the email addresses of its enrolled students sent to Google so Google can email them a calendar invite. That invite contains the Meet link.
• Information received from Google APIs is used only to provide these class features. My use and transfer of it follows the Google API Services User Data Policy, including its Limited Use requirements.

Who can see your information

• Me. In the admin area I can see students’ names, emails, mobile numbers and enrolments, the log of emails sent to them and the admin activity log, and export lists as a spreadsheet for running classes.
• Other students: no. Students cannot see each other’s details. The class Meet link is visible only to students enrolled in that class (see the Terms).
• Service providers that handle data for the site: my hosting provider (Hostinger), including its mail service that delivers the site’s emails, Google (sign-in, Sheets and Gmail for the contact form, Calendar and Meet for classes), OpenRouter (chat replies) and Google Tag Manager.

I do not sell your information and I do not use it for advertising.

How long it is kept

• Sign-in codes expire after 10 minutes. Sign-in sessions end after 2 hours without activity (a “remember me” sign-in lasts 30 days, or until you log out).
• Your Live Classes account, mobile number, enrolments, the email log and the admin activity log are kept until deletion is requested, so you can see your class history. I do not delete accounts automatically.
• Trash. When I delete a class, a class session or an enrolment (for example one that was cancelled or removed), it goes to Trash first, stays there for 30 days and is then deleted permanently. Items in Trash are not shown to students or on the public schedule and are not sent any emails.
• Contact-form and chat enquiries stay in my Google Sheet until I delete them.

Your choices and deleting your data

You can correct your mobile number yourself on My Classes. To see, correct or delete what I hold about you, email support@shashwatyadav.in from the email address you signed up with and say what you would like. For a deletion request I will delete your account, mobile number and enrolments, and any enquiry you sent, within 30 days, and confirm by email.

I can add, edit and delete student accounts from the admin area. Deleting a student’s account removes their name, email address, mobile number, enrolments, sign-in sessions and remember-me tokens, and cancels any upcoming enrolments first. A record that an email was sent stays in the email log, but without any link to the person. To ask for your account to be deleted, email support@shashwatyadav.in; requests are handled within 30 days.

Security

The site is served over HTTPS. Passwords and sign-in codes are stored only as hashes, the Google Calendar token is encrypted, and the admin area is restricted to my account. No online system is perfectly secure, so if you think your account has been misused, tell me right away.

Changes to this policy

If what the site does changes, I will update this page and the date at the top.

Changes in the 9 October 2026 update:

• Listed every email students receive and how the email log is used.
• Listed each cookie and browser-storage entry with how long it lasts. A “remember me” sign-in lasts 30 days (this page used to say until you log out).
• Added cancelling and removal from a class, account deletion by me, the 30-day Trash and the admin activity log.

Contact

Shashwat Yadav · support@shashwatyadav.in · Terms of use