This policy explains how the Awaz app, as published on Google Play, and this website use your information. Awaz is an Android app for government-job exam preparation (app ID on Google Play: fyi.awaz.app). Contact: support@awaz.fyi, phone +880 1345-579642.
In short
- To use the app, you sign in with a mobile number or a Google account. Google's Firebase Authentication runs sign-in for us.
- Your answers, results, bookmarks and other study records are saved on your phone and sync through our server to your other signed-in devices. Questions, explanations and images require an internet connection. Upstash stores the synced copy for us. Android's own backup may also copy local data to your Google account; see below.
- The app sends usage statistics to Google Analytics, so that we can see which parts of the app are used. For a test, they include a broad score band. They contain no name, mobile number, email address or answers. You can turn them off in Settings.
- Some parts of the app need a package. Packages are bought on the Awaz website. The app checks with our server whether your account has a package, and if you buy one, the order is kept on that server. We never receive card numbers, PINs or verification codes.
- The app has no ads. We do not use your data for advertising, and we do not sell it.
What we collect, and why
Your account. Firebase keeps an account ID, the dates the account was created and last signed in, and:
- with mobile-number sign-in: your mobile number;
- with Google sign-in: your Google account's name, email address, profile-photo link and a link to that account. The app never shows or downloads the photo.
We use this only to sign you in and keep your account, to show in Settings which account you are signed in with, to fill in your name when you first set up the app (you can change it), and to know whose data is on your phone.
Security data. To prevent abuse, Firebase uses your IP address and basic device and app details (the user agent) when you sign in and while you stay signed in. For mobile-number sign-in, it also checks that the request comes from the genuine app. It uses Google Play Integrity for this, or, if that fails, a reCAPTCHA check in your browser, which Google runs under its own privacy policy.
The verification code. Google sends a 6-digit code to your number by SMS, and the app sends the code back to Firebase to sign you in. The app has no permission to read your SMS messages. Android may fill in the code for you: if Android asks and you allow it, the app reads that one message and keeps only the code.
Usage statistics. The app uses Google Analytics for Firebase, a Google service, to measure how the app is used. This starts after you sign in. We use it only to see which job tracks and features are used, how many model tests are finished and how many people come back, so that we can improve the app. Analytics receives:
- IDs that Google's software creates automatically for this installation of the app. They are not your account ID. You get new ones if you reinstall the app or delete your account in the app;
- your phone's brand and model, its Android version and language, and the app's version;
- your approximate location (city or region, and country), which Google works out from your IP address. Google states that Analytics does not store the IP address itself;
- when you open the app, how long you use it and which pages you open; and when the app or Android is updated, the app's data is cleared, or the app is removed;
- the job track you chose and, for Special BCS (Health), the post (medical or dental);
- when you start or finish a model test or a practice session: which model test, or which kind of practice and subject, and a broad band for your score and your time (for example "60–79%");
- that you used search, the report-a-problem button or a backup. The search text, the report and the backup file are not sent;
- the link that brought you to install the app, if there was one.
Analytics does not receive your name, mobile number, email address or account ID, the questions you saw, your answers, your bookmarks, or anything you typed. The app does not collect the advertising ID and has no permission to read it. This data is not used for advertising, and it is not linked to your Google account.
Google processes this data for us as our service provider. See How Google uses information from sites or apps that use our services.
To turn it off, open Settings, choose Data and privacy, then turn off Send usage data. The app then stops sending usage statistics at once, and everything else works as before.
Emails to us. If you write to support@awaz.fyi, we use your email address and message only to reply and to keep a record of your request. Our email service provider stores these emails for us. The app's report-a-problem action only opens your own email app with a draft addressed to us; the draft contains the question, its options and answer, its code, the paper it belongs to and the app version, and nothing is sent unless you send it.
Checking for a package. To find out whether the signed-in account has a package, the app contacts our server and sends proof of your sign-in (a token issued by Firebase). The token carries your account ID and your mobile number or email address. The server uses it to find packages bought for that number or email and tells the app when the package ends. The server keeps your account ID, the package's term and when that information was last given to the app. The token itself is not stored.
Syncing your study data. When you are signed in and have internet access, the app sends your name and ordinary settings, answers and results, bookmarks, mistakes, flashcard marks and course enrollments to our server so they can appear on another device signed in to the same account. Awaz does not send the extra-time accommodation preference or the choice to send Analytics data to Upstash; syncing cannot turn Analytics back on. Android's own backup or device transfer may still move these local preferences to another phone, as described below. The server stores synced records under your account ID in Upstash Redis. The app keeps a local copy of your study records and sends pending changes when a connection is available. Question content is separate: the app reads the questions, explanations and images it needs from a private Upstash Blob bucket through short-lived links authorized by our server. The app holds this content in memory while in use and does not save a question bank on your device for offline study.
Buying a package. Packages are bought on the Awaz website, not in the app. On the checkout page you type the mobile number or Google email of the account the package is for; a contact mobile number, if that account is an email; and, if you wish, an email address for the receipt. We also record the time you ticked the consent box. We use this to attach the package to the right account, to contact you about the payment, and to keep records of orders, refunds and complaints.
You pay on the payment service provider's own page. For the payment we send the provider a mobile number, an email address (one of our own if you gave none), the package name, the amount and the order number. You enter card numbers, mobile-banking PINs and verification codes directly on the provider's page. We never receive or store them.
Our payment service provider is SSLCOMMERZ. SSLCOMMERZ and the bank or mobile-banking service involved use what you enter on the payment page under their own policies.
For each order our server keeps: the order number, the package, the amount, the date and time, the number and email given at checkout, the provider's transaction number, the payment method (for example which mobile-banking service or which kind of card) and part of a number sent by the provider (for a card, its first six and last four digits; for other methods, the last four characters). It also keeps the result of the automated-abuse check, the card's brand and issuing country, and the provider's risk mark. It never holds a full card number, a PIN or a verification code. Orders that were never paid are kept in the same way.
What the app keeps on your phone
The app keeps the following in its private storage on your phone, which other apps cannot read. Study data and ordinary settings also sync to our server as described above; the extra-time and Analytics choices are excluded from Awaz's sync but may be included in Android backup or device transfer:
- the name you type in the app, your avatar, daily goal, and the exam you are preparing for and its date;
- exam results and answers, bookmarks, mistakes list, flashcards and enrolled courses;
- reminders and other settings, including the extra-time preference;
- the ID of the account that the data on the phone belongs to, so it cannot be opened under a different account.
The usage statistics described above carry only a summary of your study: the job track and post you chose, which model test you took or which kind of practice you did and in which subject, and broad score and time bands. Analytics does not receive your answers, results or bookmarks. Your synced study records go to our server under your account ID, separately from Analytics.
Uninstalling the app deletes its local copy. The synced copy remains until you delete your account.
Backup and conflict recovery files. When you choose to export a backup, the app saves it where you choose. It holds your name, settings and study data, but no phone number, email address or account ID. If this phone and another device have different study changes, the app also makes two unencrypted recovery copies in its private storage before you choose which version to keep. You can export those copies from the sync settings. They remain on this phone until you delete all progress or the account. If you save an exported file to a cloud service, that service's terms apply.
Android backup. Depending on your phone's backup settings, Android may copy the app's study data and local settings, including your extra-time and Analytics choices, to your Google account and restore them on a new phone. Question content is not saved as a downloaded bank and is not included in backups. Private conflict recovery copies are also excluded. Google runs this backup, and we cannot see it.
Permissions
- Notifications: for study reminders, which stay off until you turn them on. Reminders are made on your phone; we send no push notifications.
- Run at startup: to set your reminders again after your phone restarts.
- Internet and network status: to sign in, stay signed in, check for a package, load questions, explanations and images, sync your study data, delete your account and send usage statistics.
Google's sign-in and Analytics libraries add a few technical permissions of their own, for example to finish sending data. None of them gives access to your personal content.
The app does not ask for your location, camera, microphone, contacts, SMS, call log, files or advertising ID.
Sharing and security
Your account data and the usage statistics go to Google, which works for us as our service provider: Firebase Authentication runs sign-in (including sending the SMS), and Google Analytics counts how the app is used. Google processes account data in the United States, and usage statistics in its data centres in several countries. All of this is outside Bangladesh. The data is sent over encrypted connections, and Firebase stores account data encrypted.
Our server runs on Google Cloud in Singapore. Upstash stores package, order and synced study data for us in the Redis database whose primary region is US East 1 (Northern Virginia, United States). The private question-bank bucket uses Upstash Blob's global infrastructure. These services operate outside Bangladesh. The app and website use our server's authenticated endpoints; they cannot read the Redis database directly. What we send to the payment service provider is listed above.
We give your data to no one other than the service providers named above, unless Bangladeshi law requires it.
The most sensitive data we hold is your mobile number or email address. We do not collect national ID or health data. If you buy a package, we keep the order and payment details described above, never a card number, a PIN or a verification code.
How long data is kept
- Account: until you delete it. Firebase then removes it from its live and backup systems within 180 days.
- Sign-in IP address logs (Firebase): a few weeks.
- Usage statistics: Google keeps the data linked to an installation's ID for 2 months, and then deletes it in a clean-up that runs once a month. Totals that identify no one, such as how many model tests were finished in a week, are kept.
- Emails to us: up to 12 months.
- Package term: until you delete your account.
- Synced study data and settings: until you delete your account. Uninstalling one device does not delete the synced copy.
- Order and payment records: 6 years, for accounts, legal duties, complaints and disputes. This includes orders that were never paid. They are kept after you delete your account, but cut off from it. They still hold the number or email given at checkout.
- Our server's audit records: 6 years. They record when an order was attached to an account, when package information was given to the app, and when an account was deleted. After an account is deleted these records still hold that account's ID; they hold no mobile number or email.
- Request logs of the website and our server (with IP addresses): 30 days.
- Data on your phone: until you delete it or uninstall the app.
Your rights
By signing in, you agree that your account data, synced study data and usage statistics are used as this policy describes, including their processing outside Bangladesh. By ticking the consent box at checkout, you agree that the details you give there are used as this policy describes and sent to the payment service provider for the payment, and that the order is kept in our Upstash database (US East 1) for 6 years.
You can see your account under Settings → Account, and save your study data to a backup file. To stop usage statistics, turn off Send usage data in Settings. To ask for a copy or correction of your account or order data, or to object to how it is used, write to support@awaz.fyi. To delete your account data or withdraw consent, delete your account: see Delete your account. Signing out alone keeps the account.
Usage statistics are not linked to your account, so we cannot look up, copy or delete one person's statistics. They expire as described above.
We answer requests within 30 days. You may also complain to Bangladesh's National Data Management Authority once it is operating.
Children
Awaz is for adults aged 18 and over. If we learn that an account belongs to someone under 18, we will delete it.
This website
- This website has no ads and no analytics, and sets no cookie of its own.
- The checkout page and the payment result page keep two technical values in your browser's storage for that tab (session storage): a random value, so that one order is not created twice, and a code for the order, so that the receipt can be shown. They are removed when you close the tab.
- The checkout page, and no other page, uses Google reCAPTCHA to tell people from automated abuse. Google receives what that service collects from your browser and device and may set its own cookies; Google's Privacy Policy and Terms of Service apply to it. We ourselves send Google only the code that reCAPTCHA gives the page.
- The website runs on Vercel. The app and payment APIs run on Google's Firebase and Google Cloud. These providers receive your IP address and basic request details to deliver and protect the service, and retain their service logs under their own settings. Our own database holds no IP address.
Changes
We will post any new version of this policy here with a new effective date, and announce important changes in the app or on this website.
Effective 3 October 2026. Last updated 3 October 2026.