This Privacy Policy explains how LUYM QUEST collects, uses, shares, and protects personal information. It applies only to the LUYM Quest mobile application.
1. Who we are
This Privacy Policy applies to the mobile application LUYM QUEST (Android package name com.luym.quest).
LUYM QUEST is developed and operated by Dharma Labs, a program of Dharmalife Foundation gGmbH.
On Google Play, the app is listed under the developer name Dharma Labs. The registered legal entity behind Dharma Labs, and the data controller for the purposes of this policy, is Dharmalife Foundation gGmbH.
LUYM Quest is the official learning app for Dharmalife’s LUYM (Lighting Up Young Minds) programme. The in-app parental consent form describes LUYM Learning as a digital tutoring programme for children.
This policy applies only to LUYM Quest. It does not apply to other websites or apps.
LUYM Quest is a child-directed education app. A parent or guardian must give consent before a child can use the full service.
During registration the app collects the child’s date of birth. The current app requires the child to be at least 3 years old, so that families can create an account ahead of a child starting the core curriculum. Learners aged 3-5 are onboarded so a parent or teacher can prepare their profile in advance; learning content, quests, and assessments are built for and unlocked to learners aged 6-16.
The in-app consent form refers to India’s Digital Personal Data Protection Act, 2023 (DPDPA) and COPPA.
3. Information we collect
We collect the following information through LUYM Quest. Unless noted, it is sent to our app backend at luym.dharmalifelabs.com.
Parental consent; can be updated in Settings (re-verified by OTP if changed)
Required for consent, revoke, and account deletion
Child’s date of birth
Onboarding; can be updated in Settings
Required at onboarding
Grade
Onboarding; can be updated in Settings
Required at onboarding
State and district
Onboarding (chosen from our lists, not from GPS)
Required at onboarding
Block, village, and street
Settings (address section)
Optional until the parent/learner saves a full address
School name
Settings
Optional
Email address and password
Optional email login; email may also appear on the account profile if the backend has one
Optional (mobile OTP login does not require email)
Parental consent choices
Consent form: (1) participation and use of the child’s data described in the form; (2) optional use of the mobile number for future campaign communication
Required to finish signup (campaign opt-in is a separate checkbox)
Generated avatar
Avatar picker (illustrated avatar, not a camera photo)
Required to finish signup; can be changed later
We do not collect government ID numbers (such as Aadhaar or PAN) in this app.
3.2 Photos, videos, and files
If the learner uses capstone or baseline submission features, the app may collect:
photographs taken with the camera or chosen from the device;
videos recorded with the camera or chosen from the device;
PDF documents chosen with the file picker.
These files are uploaded to our cloud storage (see Section 6) and linked to the learner’s account (including the learner’s LUYM ID in the file name).
The in-app upload screens ask users not to include personal or sensitive information in submissions.
3.3 Voice and chat (Roshni)
The app includes Roshni, an AI learning assistant.
Typed messages are sent to our servers and to the Roshni chatbot service.
If the learner uses the microphone, the device’s speech recognition converts speech to text. That text is then sent as a chat message. No raw audio files are uploaded to our backend.
Chat history is stored against the learner’s user ID.
The in-app Roshni disclaimer asks users not to enter personal or sensitive information into the chatbot. Dharmalife states it is not responsible for misuse of information or for inaccurate chatbot answers.
Roshni requests are not sent to the web and web search is not enabled for the LUYM Quest app.
3.4 Account and learning information created by the app
LUYM ID and internal user IDs (assigned by our systems; shown in Settings and on certificates; cannot be edited in the app)
Learning progress, lessons completed, quiz and assessment answers and scores, XP, badges, streaks, ranks, leaderboard standing, resume position, and similar activity
Capstone / baseline scores and feedback
Course certificates (which can show the learner’s name and LUYM ID)
Device identifier used to register for push: Android ID on Android; identifier for vendor on iOS
Device platform (Android or iOS)
Authentication tokens (session JWT and refresh token) stored on the device
Crash and diagnostic information sent to Sentry (stack traces and device/app context). The app does not currently attach the learner’s name to Sentry in client code; Sentry may still receive technical device data.
Standard network information created when the app uses the internet (such as IP address), which our hosts and service providers may process as part of providing the service
3.6 Information we do not collect in this app
Based on the current LUYM Quest client:
precise GPS / device location coordinates;
contacts;
payment card, UPI, or bank details (the app has no payments);
advertising ID for ads (the app has no advertising SDK);
employee ID.
Location note. The LUYM Quest app does not request location permission and does not read GPS. Address information is what the user selects (state, district, and later block, village, street).
4. How we collect information
Information you type or select in registration, login, onboarding, Settings, quizzes, and chat
OTPs you enter after we send a code to the child or parent mobile number
Camera, photo/video library (user-selected items), and document picker, after the user grants permission
Microphone, after the user grants permission, for Roshni voice input
Automatic collection of push tokens and crash reports when those features run
Our servers assign LUYM IDs and store learning progress as the child uses the app
Optional campaign communication if the parent opted in; push notifications if permitted
App operation and safety
Authentication, abuse prevention, crash diagnosis
Comply with law and respond to requests
Access, correction, deletion, consent withdrawal
We do not use LUYM Quest data to show third-party advertising in the app.
6. How we share information
We share information with the service providers needed to run LUYM Quest. We do not sell personal information.
Our own systems. The LUYM / Dharmalife app backend and the Roshni chatbot service are both developed and operated by Dharmalife itself — they are not third-party vendors. They are listed below for transparency about how data moves between our own systems.
Roshni chatbot service (api-chatbot.dharmalife.in) — Dharmalife-operated
AI answers
User ID, session ID, message text, language, and the learner’s login token (used to authenticate the request to our own service)
Third-party service providers.
Recipient
Role
Information involved
Amazon Web Services (S3 bucket used for learner uploads, CloudFront delivery, Cognito guest credentials for upload)
Store and deliver capstone/baseline files
Photos, videos, PDFs; object keys may include the LUYM ID
Firebase Cloud Messaging (Google)
Push notifications
Push token, device platform, and message delivery
Sentry
Crash and error monitoring
Diagnostic/crash data (processed on Sentry’s infrastructure, including a United States ingest endpoint used by the current app configuration)
DiceBear
Generate illustrated avatars
Avatar image is loaded from DiceBear using a seed; this is not a photograph of the child
Device speech recognition (including the system speech service on Android)
Convert voice to text for Roshni
Microphone audio / transcript as provided by the device OS
Our SMS delivery provider
Send OTPs
Child or parent mobile number and the OTP
We may also disclose information if required by law, to protect a child or other person from harm, or to establish or defend legal claims.
If the parent consented to campaign communication, the child’s or parent’s mobile number may be used for those messages.
7. Permissions the app uses
LUYM Quest may ask for:
Camera — take a poster photo or video for capstone / baseline work
Photos / files (user-selected) — choose an existing photo, video, or PDF to upload. The Android app is configured not to request broad photo-library read permissions (READ_MEDIA_IMAGES / READ_MEDIA_VIDEO)
Microphone — voice messages for Roshni
Notifications — learning reminders and a local notice when a certificate is saved
Internet — operate the app
Storage / save image — save a certificate image to the device (on modern Android this uses the media store without broad gallery read access)
The app does not request location, contacts, phone-call, or Bluetooth permissions.
The user can refuse a permission. Some features (upload, voice chat, push) will not work without it.
8. Account, tokens, and local storage
Creating an account is required to use the main features of LUYM Quest.
After login, the app stores authentication tokens in secure on-device storage. Tokens are removed from the device when the user logs out, or when consent is revoked, or when account deletion succeeds.
The app also keeps a small local cache (for example last learner id, last pathway, and whether a push token was already registered). Some cache keys may remain after logout until the app is uninstalled.
Certificates the user saves are stored in the device gallery / via the system share sheet and may remain after the app is uninstalled.
Logging out does not delete the server account. Learning progress remains on our servers so the learner can sign in again.
9. How to delete your account or withdraw consent
Delete account
In the app: Profile → Settings → Privacy → Delete account.
A parent OTP is sent to the saved parent mobile number. After the OTP is verified, the app calls our account-deletion API and signs the user out.
After account deletion, it cannot be reactivated. We retain the account data in an inactive state for 15 days following the deletion request, after which we permanently remove or anonymize any personal information from our systems. Transactional and usage records associated with the account (such as course progress, activity logs, or platform interactions) may be retained beyond this period in a de-identified form, linked only to an internal user identifier rather than to the name, contact details, or other personal information. We retain this de-identified data for internal tracking, analytics, and record-keeping purposes only. Capstone project submissions (videos, slide decks, or images) are treated as personal data because they may capture a learner's likeness, voice, or home environment. These submission files are permanently deleted within the same 15-day window, rather than anonymized. The associated grading outcome — score, band, and rubric feedback — contains no personal information and is retained as part of our transactional records.
If in-app deletion fails, email it@dharmalifelabs.com from a parent contact we can verify.
Withdraw parental consent
In the app: Profile → Settings → Privacy → Revoke parental consent.
A parent OTP is required. After verification the app records the revoke request and signs the learner out. The learner cannot use the app again until consent is given again.
Other requests
A parent or eligible user may request access to or correction of information by using Settings (name, date of birth, grade, school, address, parent details) or by emailing it@dharmalifelabs.com.
10. Data retention
Account and learning records: kept while the account is active, then 15 days after deletion.
Capstone / baseline files on AWS: deleted after 15-days when the account is deleted
Push tokens: until logout / new token / account deletion
Crash reports in Sentry: 90 days
Saved certificates on the user’s device: controlled by the user
11. Security
We send information over HTTPS. Login tokens are stored in the device’s secure storage, not in ordinary app preferences.
No method of transmission or storage is completely secure. We cannot guarantee absolute security.
12. International processing
Our primary app backend is operated on dharmalifelabs.com hosts. Learner upload files are stored using Amazon Web Services in the ap-south-1 (Mumbai) region.
Crash and error diagnostic data collected through Sentry may be transferred to and processed on servers located outside India, including in the United States. We take steps to ensure that any such cross-border transfer is carried out in accordance with the Digital Personal Data Protection Act, 2023, and only to jurisdictions not restricted by the Central Government under Section 16 of the Act. Sentry processes this data solely for the purpose of identifying, diagnosing, and resolving technical errors, and is contractually bound to apply appropriate technical and organizational safeguards to protect it.
Applicable law. Because LUYM Quest's operations, learners, and app backend are based in India, this policy is governed primarily by India's Digital Personal Data Protection Act, 2023 (DPDPA). Dharmalife Foundation gGmbH, the registered legal entity behind LUYM Quest, is established in Germany and complies with the EU General Data Protection Regulation (GDPR) as well.
13. Children’s privacy
We collect personal information from children only to provide LUYM Quest, with parental consent obtained in the app (parent name, parent mobile, and OTP verification).
Parents can review or update many profile fields in Settings, withdraw consent, or delete the account as described above.
We do not use children’s data from this app for third-party advertising.
14. Payments
LUYM Quest does not process payments, UPI, or bank details in the current app.
15. Changes to this policy
We will post updates to this page and change the “Last updated” date. If changes are material, we will also notify you in the app.
