Confido — Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how Testbook ("Confido," "we," "us," or "our") collects, uses, stores, shares, and protects personal information in connection with the Confido mobile application and related services (the "Services") for users in the United States and Mexico. This Policy should be read together with our Terms of Service.

Confido is currently free to use, with no in-app purchases, subscriptions, or paid features. If we introduce paid features in the future, we will update this Policy and notify you before any charge applies.

By downloading, installing, or using the Services, you acknowledge this Policy and, where required by applicable law, provide your consent to the collection, use, and disclosure of your personal information as described here. If you do not provide information we need to deliver the Services, we may be unable to provide some or all of them.

We may revise this Policy from time to time; continued use of the Services after a revision takes effect is, to the extent permitted by law, acceptance of the revised Policy. We encourage you to review it periodically.

2. Information We Collect

Information you provide directly: name, email address, and profile information; account credentials via Sign in with Apple, Sign in with Google, or email (Confido does not use phone-number sign-in internationally); customer-support communications.

Audio recordings: speech recordings you create during practice and conversation exercises, collected for the purpose of generating feedback and improving speech recognition.

Information collected automatically: device and browser information, IP address, app and device identifiers, usage and activity data, log data, approximate location, and cookies or similar technologies.

Device permissions: subject to your device settings, we may access your microphone (required for speech practice), notifications, and advertising identifiers. You can manage or revoke these permissions in your device settings.

Learning data: lesson progress, exercise results, streaks, and performance analytics.

Information from third parties: information from authentication providers (Apple, Google), analytics and attribution providers, and advertising partners, where permitted by applicable law.

3. How We Use Your Information

We use personal information to: create and manage your account; deliver lessons and speech practice, including processing your voice to generate feedback; personalize your learning path; respond to support requests; send service-related communications; measure and improve app performance and engagement; run analytics and attribution to understand how users find and use Confido; detect and prevent fraud and abuse; maintain security; comply with legal obligations; and, where permitted, send marketing communications and measure advertising campaigns.

4. How We Share Information

We do not sell your personal information to third-party advertisers. We share personal information only in the following circumstances:

Service providers. Vendors who help us operate the Services, including: cloud hosting and data storage (MongoDB, Firebase); speech-recognition and generative-AI providers that process your voice or text to generate feedback and conversation practice (including Deepgram for speech-to-text and Anthropic's Claude for language feedback and tutoring); text-to-speech providers that generate Vani's/Confido's spoken responses; customer support tooling; and messaging/notification infrastructure (Firebase Cloud Messaging).

Analytics and attribution partners, including Firebase Analytics (exported to BigQuery for our own analysis), Branch and AppsFlyer (install attribution and deep linking), and Meta and Google (advertising measurement) — see Section 5 for your choices regarding these.

Legal requirements, where disclosure is required by law, legal process, or governmental request, or necessary to protect our rights, users, or the public.

Fraud prevention and security, including sharing with auditors and relevant authorities for compliance and risk purposes.

Corporate transactions, where personal information may be transferred to a successor in a merger, acquisition, or sale of assets.

With your consent, for any other sharing you have authorized.

5. Cookies, Analytics, Advertising, and Your Choices

We and our partners (Firebase Analytics, Branch, AppsFlyer, Meta, and Google) use SDKs, device identifiers, and similar technologies to measure app performance, understand how users find Confido, and measure the effectiveness of our advertising campaigns on Meta and Google platforms.

Your choices. You can limit or reset your device's advertising identifier (the Android Advertising ID or Apple's App Tracking Transparency setting) in your device settings, and you can manage push-notification permissions the same way. Where Meta or Google advertising data about you is considered a "sale" or "share" under California law, see Section 8 for how to opt out. Disabling these technologies may reduce personalization but will not disable the Services.

6. International Data Transfers

Your personal information may be processed and stored by us or our service providers in the United States, India, and other countries where we or our vendors operate, which may have data-protection laws different from those of your home country. Where we transfer personal information of a Mexican user outside Mexico, we do so consistent with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), including by ensuring the receiving party is bound to comparable protections.

7. Data Retention and Deletion

We retain personal information only as long as necessary to provide the Services, fulfill the purposes for which it was collected, comply with legal, tax, or accounting obligations, resolve disputes, and enforce our agreements. Audio recordings are retained for as long as needed to generate feedback and improve our speech-recognition models, after which they are deleted or anonymized on a schedule we will publish here.

You may request deletion of your account and associated personal information at any time by contacting us at or, where available, through an in-app or web-based deletion flow. We will process valid deletion requests in accordance with applicable law, subject to information we are required or permitted to retain (for example, for legal, tax, fraud-prevention, or dispute-resolution purposes). Data in backups is deleted or anonymized on our normal backup-rotation schedule.

8. Your Privacy Rights — United States

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to: know the categories and specific pieces of personal information we collect, use, and disclose about you; delete personal information we hold about you, subject to exceptions; correct inaccurate personal information; opt out of the "sale" or "sharing" of your personal information (our use of advertising identifiers with Meta and Google for campaign measurement may qualify as "sharing" under CPRA); limit the use of sensitive personal information; and not be discriminated against for exercising these rights.

Categories collected in the past 12 months: identifiers (name, email, device ID); audio/voice recordings; commercial information (purchase history); internet or network activity (app usage); approximate geolocation; and inferences about your learning progress. See Section 2 for detail.

Categories disclosed for a business purpose: to service providers and analytics/advertising partners as described in Section 4.

We do not sell personal information for money. To the extent our advertising partnerships with Meta and Google constitute "sharing" under CPRA, you may opt out by [MECHANISM TBD — e.g., an in-app "Do Not Sell or Share My Personal Information" control, or device-level Limit Ad Tracking / App Tracking Transparency settings].

To exercise these rights, contact us at . We will verify your identity before acting on a request and will respond within the timeframe required by law. You may designate an authorized agent to make a request on your behalf.

9. Your Privacy Rights — Mexico

If you are located in Mexico, the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP") and its regulations give you ARCO rights — the right to Access the personal data we hold about you, Rectify inaccurate data, Cancel (delete) your data, and Oppose certain processing — as well as the right to revoke any consent you have given and to limit the use or disclosure of your data.

To exercise ARCO rights, contact us at with your name and a description of the right you wish to exercise; we will acknowledge your request and respond within the timeframes set by the LFPDPPP. You may also file a complaint with Mexico's data-protection authority, INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales), or its successor authority.

10. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. This is consistent with the U.S. Children's Online Privacy Protection Act (COPPA). Users between 13 and 18 may use the Services only with the consent and supervision of a parent or legal guardian, as described in our Terms of Service.

If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will take reasonable steps to delete that information promptly. If you believe a child has provided us personal information in violation of this Policy, contact us at .

11. Data Security

We implement reasonable technical and organizational measures designed to protect personal information from unauthorized access, disclosure, alteration, or destruction, including encryption, access controls, and monitoring, proportionate to the sensitivity of the data involved.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and should notify us promptly at of any suspected unauthorized access to your account.

12. Third-Party Links and Services

The Services may link to or integrate with third-party websites, applications, or platforms, including social sign-in providers. We do not control and are not responsible for the privacy practices of those third parties. This Policy does not apply to information you provide to, or that is collected by, third-party services; we encourage you to review their privacy policies before using them.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected in an updated "Last Updated" date below, an in-app notice, or an email to your registered address. Your continued use of the Services after a revision takes effect constitutes acceptance of the revised Policy to the extent permitted by applicable law.

14. Contact Us

For questions, requests, or grievances relating to this Policy or our handling of your personal information:

Privacy inquiries / ARCO / CCPA requests:

General support:

This Privacy Policy was last updated on 28 Sep 2026.