Privacy Policy

Who we are

Science of Apps is a behavioural psychology consultancy based in New Delhi, India, run by its Founder & CEO, Sushant Singh. We are the data controller (“data fiduciary” under Indian law) for the personal data described in this policy. You can reach us about privacy at any time through our contact form.

What we collect

When you contact us

The contact form asks for your name, email address, product URL, how you heard about us and your message. Only the message is required. The form is sent by email to our team so we can reply; we do not store it in a separate database.

When you sign in with Google (optional)

The site offers Google's one-tap sign-in. If you choose to use it, Google shares your name, email address and profile photo with us. We check the sign-in with Google, then store your name, email address, your Google account ID, when you first and last signed in and the page you signed in on. Your photo is only shown in your own browser, which also remembers that you signed in (local storage). Google's own privacy policy covers its sign-in service, which may set cookies on google.com.

Signing in also subscribes you to our practical UX psychology tips by email — the site tells you so when you sign in, and the first email arrives a few minutes later. We add your name and email address to our email service (MailerLite), which sends those emails, and record when you were subscribed. Every email has a one-click unsubscribe link, and you can also ask us through the contact form to remove you.

When you request the free Laws of UX PDF

The PDF popup asks for your name, email address and, optionally, what you do. We store these with the time of the request and the page you asked from, email you the PDF straight away (attached, with a personal download link) and add your name and email address to our email service (MailerLite) for occasional UX psychology tips — the popup says so before you send. If you correct a mistyped address, we stop using the old one and remove it from MailerLite when it was only there because of that request. Every tips email has a one-click unsubscribe link.

The PDF email links to a short feedback form. If you leave a review, we store it with the name and role you give and, if you add one, your photo (an upload, which we shrink and strip of location data, or your Google profile picture if you signed in with Google). It appears on our website, with your photo, only if you tick the box allowing that and we approve it; otherwise it stays private. The banner may also show how many people have requested the PDF and which edition they chose — as totals only, never anyone's details.

When you take a free certification

Our certification tests need no sign-up. To score one, we store each attempt with the certification, the questions drawn, your score and the times you started and finished, plus a scrambled (hashed) form of your IP address so we can ask you to wait before retaking after a failed attempt. If you pass and claim a certificate, we store the name you type with your score, the date and a credential ID, and anyone who has that ID can see them on our verification page — that is how the people you share it with can check it's genuine. We also store the email address you give and use it only to send you your certificate as a PDF (a copy goes to our founder's inbox); it is never shown on the verification page and we don't add it to any mailing list. Your progress during the test stays in your own browser (local storage).

Our certifications are offered for educational purposes only. Science of Apps is not a government body or accreditation agency, and a certificate is not a degree, licence or recognised qualification — see section 2 of our terms of service.

When you buy a certification plan or add-on

Paid certification plans and add-ons are one-time purchases, paid upfront; there is no subscription and we never charge you again automatically. When you buy, we collect your name, email address, country, the plan and add-ons you chose, the price, currency and taxes charged, and, if you need a tax invoice, your billing address and GST number. We use your country to show you the right currency and send you to the right payment provider.

• Buyers in India pay in Indian rupees (INR) through Cashfree Payments, an RBI-authorised payment aggregator. Cashfree collects your card, UPI, net-banking or wallet details directly on its own secure pages.
• Buyers outside India pay in their local currency (where PayPal supports it) through PayPal. PayPal collects your PayPal account, card or bank details directly; you do not need a PayPal account to pay by card.

We never see or store your full card number, CVV, UPI PIN, bank password or PayPal login. The payment provider sends us only what we need to confirm and record the payment: an order and transaction ID, the amount and currency, the payment status and time, the payment method type (for example “card” or “UPI”), and sometimes the last four digits of a card, the card network or the payer's email and country. Cashfree and PayPal are independent controllers of the data they collect, and they may use it to process the payment, prevent fraud and meet their own legal duties (such as anti-money-laundering and “know your customer” rules) under their own privacy policies: Cashfree and PayPal.

Once your payment is confirmed, we use your name, email address and order details to unlock your plan and add-ons for instant download, email your receipt or invoice, answer support questions and handle any payment dispute.

When you browse the site

• Hosting logs. Our web host (GoDaddy) records standard server logs such as IP address, browser type, pages requested and time of request, used for security and troubleshooting.
• Security and delivery. Cloudflare sits in front of the site to protect it and deliver it quickly. It processes your IP address and request details and may set strictly necessary security cookies.
• Host performance monitoring. GoDaddy adds a small performance-monitoring script to pages served from its hosting, which collects technical timing data about page loads.
• Analytics. We use PostHog to understand how the site is used: pages viewed, how you scroll, links and buttons clicked, how long pages take to load, the referring site, and your browser, device type and approximate location (derived from your IP address). PostHog also records some visits as session replays — mouse movements, scrolling and clicks — so we can see where pages are confusing; anything typed into form fields is masked and never recorded. We also record which contact-form fields were filled in (never what was typed) and technical error reports. If you sign in with Google, these analytics are linked to your name and email address. PostHog sets a first-party cookie to recognise returning visits. You can clear or block the cookie in your browser at any time.
• Google Analytics. We also use Google Analytics to measure visits: pages viewed, how you arrived (search engine, link or campaign), scrolling, links and buttons clicked, file downloads, and your browser, device type and approximate location. It never receives what you type into forms, your name or your email address; if you sign in with Google, it receives only an anonymous account ID so repeat visits are counted once. Google signals and ad personalisation are switched off, so this data is not used for advertising. Google Analytics sets first-party cookies (_ga) to recognise returning visits; you can clear or block them, or install Google's opt-out browser add-on.
• Spam protection. To limit abuse, the contact form and PDF popup temporarily keep a one-way hash of the sender's IP address with submission times; it expires automatically.

We do not use advertising or social-media tracking cookies.

How and why we use it

• To recognise you when you sign in with Google (steps taken at your request).
• To send you the PDF you asked for, and email tips after you sign in or request it (our legitimate interest in keeping in touch with people who chose to sign in, or your consent where the law requires it; you can stop them at any time by unsubscribing).
• To reply to your enquiry and, if you become a client, to deliver our services (our legitimate interest, or steps taken at your request before a contract).
• To take payment for, deliver and support the certification plans and add-ons you buy, and to send receipts and invoices (performance of our contract with you).
• To prevent fraud and misuse of payments and certificates, and to respond to chargebacks and payment disputes (our legitimate interest in protecting our business and buyers).
• To measure and improve the website using analytics (our legitimate interest in understanding which content is useful, or your consent where the law requires it).
• To keep the website secure and working (our legitimate interest in running a reliable service).
• To meet legal obligations, such as keeping tax, GST and accounting records and responding to lawful requests from authorities.

We never sell your personal data or use it for automated decision-making.

Who we share it with

Only with service providers that help us run the site and our business — our web and email host (GoDaddy), our security and delivery provider (Cloudflare), our analytics providers (PostHog and Google Analytics), Google (to check sign-ins) , if you sign in or request the PDF, our email service (MailerLite) and, if you buy a plan, our payment providers (Cashfree Payments for buyers in India and PayPal for buyers outside India) — under their own data protection terms. We may also share records with our accountant or tax adviser, and with government, tax or law-enforcement authorities when the law requires it. These providers may process data outside your country, including in the United States; where required, transfers rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

Enquiries are kept for up to 24 months after our last contact, then deleted, unless you become a client, in which case project records are kept for as long as needed for the engagement and for legal and accounting purposes. Sign-in records are deleted automatically 24 months after your last sign-in, PDF requests 24 months after the request, and certification attempts 90 days after they start. Certificates you claim are kept so they stay verifiable, until you ask us to delete them. If you signed in or requested the PDF, MailerLite keeps your subscription until you unsubscribe or ask us to delete it. Analytics data is kept by PostHog for up to 12 months and by Google Analytics for up to 14 months. Purchase records (order details, invoices and payment confirmations) are kept for 8 years after the end of the financial year of the purchase, because Indian tax and GST law requires us to keep them; we keep your access to the plan and downloads you bought for as long as we offer the service. Cashfree and PayPal keep their own records under their own policies.

Your rights

Depending on where you live — including under the EU and UK GDPR, India's Digital Personal Data Protection Act 2023 and US state privacy laws such as the CCPA — you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. Contact us through the contact form and we will respond within one month. You can also complain to your local data protection authority. In India, if you are not satisfied with how we handle your complaint, you may approach the Data Protection Board of India. If you live in California, we do not sell or “share” your personal information for cross-context behavioural advertising, and we will not treat you differently for exercising your rights.

We may need to keep some data even after you ask us to delete it — for example purchase and invoice records that tax law requires us to keep — but we will tell you what we keep and why.

International buyers and data transfers

We are based in India, so if you use the site or buy from outside India, your data is processed in India and by our providers in other countries, including the United States. Where the EU or UK GDPR applies, we rely on our contract with you (for purchases) and on appropriate safeguards, such as standard contractual clauses, for transfers. If you are in the EU or UK, we do not have a representative there; you can contact us directly through the contact form.

Security

The site is served only over HTTPS. Payments are processed on Cashfree's and PayPal's PCI-DSS-compliant systems, and we never handle card data ourselves. Access to the personal data we hold is limited to the people who need it to run the business. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authorities as the law requires.

Grievance officer

In line with India's Information Technology Act 2000, its rules and the Digital Personal Data Protection Act 2023, our grievance officer is Sushant Singh, Founder & CEO, Science of Apps, New Delhi, India. Send privacy, payment or other complaints through our contact form with “Grievance” in your message. We will acknowledge your complaint within 48 hours and resolve it within one month.

Children

This website is intended for businesses and is not directed at children. We do not knowingly collect data from anyone under 18. Paid plans must be bought by someone aged 18 or older.

Changes to this policy

We will post any changes on this page and update the date at the top.