Last Updated: June 2026
Privacy Policy
How we collect, use, and protect your data at apedanuma.lk
01
Introduction
Ape Danuma (apedanuma.lk) is a free educational platform for Sri Lankan students from Grade 1 to A/L. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform, including student accounts, teacher accounts, resource downloads, and related features.
By using apedanuma.lk, you agree to the practices described in this policy. This policy is effective as of June 2026.
If you have any questions about this policy, please contact us at [email protected].
By using apedanuma.lk, you agree to the practices described in this policy. This policy is effective as of June 2026.
If you have any questions about this policy, please contact us at [email protected].
02
Information We Collect
Information you provide directly:
Account and activity data (for registered users):
Automatically collected data:
- Contact form: name, email address, message
- Resource requests: name, email, grade, subject, description
- Account data (name, email, password): Legal basis — Contract (necessary to provide the service)
- Google OAuth data (name, email, profile photo): Legal basis — Contract
- Profile data (grade, school, district, province, stream): Legal basis — Contract
- Phone number: Legal basis — Legitimate interest (account security and contact)
- Teacher registration: name, email, subjects taught, experience, institute name, contact details, NIC number, verification documents
- Tuition ad submissions: teacher name, institute name, subjects, grades, contact information, class description, fee range, location
Account and activity data (for registered users):
- Gamification data (XP, level, streak, badges): Legal basis — Legitimate interest (service improvement and engagement)
- Download and activity history: Legal basis — Legitimate interest (service personalisation)
- Student accounts: bookmarked resources, referral code, weekly activity data, last login date
- Teacher accounts: subscription plan, ad performance data (contact clicks), reviews received, gallery images, notification preferences
- Push notification subscriptions: browser endpoint URL, encryption keys (stored to deliver notifications; never shared)
Automatically collected data:
- IP address and approximate location
- Browser type, device type, operating system
- Pages visited, time spent, referring website
03
Automated Decision-Making and Profiling
- We use automated processing to calculate XP points, levels, streaks, and leaderboard rankings based on your activity on the platform.
- We build a subject interest profile (subjectInterests) automatically from your download behaviour to personalise content recommendations. This constitutes profiling under the PDPA.
- Our AI-powered study recommendations are generated using your subject interest profile and activity history.
- These automated processes affect your experience on the platform (e.g. leaderboard position, badge awards, recommended content).
- You have the right to request human review of any automated decision that significantly affects you. To exercise this right, contact us at [email protected].
04
Google OAuth and Authentication
When you sign in using Google, we receive your name, email address, and profile photo from Google. We store your name, email, and avatar URL in our database. We do not receive or store your Google password.
Session data is managed using NextAuth.js and stored as encrypted tokens. Sessions expire automatically after a period of inactivity.
Session data is managed using NextAuth.js and stored as encrypted tokens. Sessions expire automatically after a period of inactivity.
05
Google AdSense and Advertising
We display advertisements through Google AdSense. Advertising revenue helps us maintain the platform and keep all resources free for students.
Google may use cookies to serve ads based on your prior visits to our site or other sites on the internet. You can opt out of personalised advertising by visiting Google's Ads Settings at www.google.com/settings/ads. We do not control the content of third-party advertisements.
Google may use cookies to serve ads based on your prior visits to our site or other sites on the internet. You can opt out of personalised advertising by visiting Google's Ads Settings at www.google.com/settings/ads. We do not control the content of third-party advertisements.
06
Google Analytics
We use Google Analytics to understand how visitors use our platform. This service collects anonymised data including page views, session duration, and geographic location at a country or city level. This data cannot be used to personally identify you.
You can opt out using the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
You can opt out using the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
07
Cookies
We use the following types of cookies:
Essential cookies — Required for authentication sessions and core platform functionality. These cannot be disabled without affecting your ability to log in.
Analytics cookies — Used by Google Analytics to measure site usage and understand which resources are most useful.
Advertising cookies — Used by Google AdSense to serve relevant advertisements that help fund the free platform.
Preference cookies — Used to remember your reading theme preference on blog posts.
You can disable non-essential cookies in your browser settings. Disabling essential cookies may prevent you from logging in.
How to manage cookies:
Essential cookies — Required for authentication sessions and core platform functionality. These cannot be disabled without affecting your ability to log in.
Analytics cookies — Used by Google Analytics to measure site usage and understand which resources are most useful.
Advertising cookies — Used by Google AdSense to serve relevant advertisements that help fund the free platform.
Preference cookies — Used to remember your reading theme preference on blog posts.
You can disable non-essential cookies in your browser settings. Disabling essential cookies may prevent you from logging in.
How to manage cookies:
- Chrome: Settings → Privacy and Security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
08
Push Notifications
If you subscribe to push notifications, we store your browser's push subscription data — specifically the endpoint URL and encryption keys — in our database. This data is used solely to deliver notifications to your device.
We do not share push subscription data with any third parties. You can unsubscribe at any time through your browser's notification settings or from within your account settings. Upon unsubscription, your push subscription data is deleted from our database.
We do not share push subscription data with any third parties. You can unsubscribe at any time through your browser's notification settings or from within your account settings. Upon unsubscription, your push subscription data is deleted from our database.
09
Gamification Data
For student accounts, we collect and store gamification data including XP points, level, login streaks, badges earned, and weekly activity. This data is used to power leaderboards, challenges, and personalised learning recommendations.
Your rank and display name may be visible to other users on the public leaderboard. You can set your profile to private in your account settings, which will hide your ranking from the public leaderboard while retaining your progress data.
Your rank and display name may be visible to other users on the public leaderboard. You can set your profile to private in your account settings, which will hide your ranking from the public leaderboard while retaining your progress data.
10
Teacher Subscriptions and Payments
Teachers who upgrade to a paid subscription plan submit payment via bank transfer. We collect your payment receipt image for verification purposes.
We do not collect or store credit card numbers, bank account details, or any payment card information. Payment receipts are stored securely and reviewed only by authorised administrators. Receipt images are retained for a period of 2 years for accounting purposes.
We do not collect or store credit card numbers, bank account details, or any payment card information. Payment receipts are stored securely and reviewed only by authorised administrators. Receipt images are retained for a period of 2 years for accounting purposes.
11
Children's Privacy
Our platform serves students from Grade 1 upwards, including children under 16 years of age as defined by the Personal Data Protection Act No. 9 of 2022.
Under the PDPA, processing of personal data of children (under 16) requires consent from a parent or legal guardian.
We are implementing age verification and parental consent mechanisms for users under 16. In the meantime, if you are a parent or guardian and believe your child has registered without your consent, please contact [email protected] and we will promptly delete the account and all associated data.
We do not serve targeted advertising directly to users who identify as being in Grade 1 through Grade 9.
Under the PDPA, processing of personal data of children (under 16) requires consent from a parent or legal guardian.
We are implementing age verification and parental consent mechanisms for users under 16. In the meantime, if you are a parent or guardian and believe your child has registered without your consent, please contact [email protected] and we will promptly delete the account and all associated data.
We do not serve targeted advertising directly to users who identify as being in Grade 1 through Grade 9.
12
Data Retention
We retain your information only for as long as necessary to provide our services:
You may request deletion of your personal data at any time by emailing [email protected]. We will respond within 30 days.
- Student and teacher accounts — Retained until you request deletion of your account
- Download history — Automatically deleted after 365 days
- Audit logs — Automatically deleted after 2 years
- Rate-limiting records — Automatically deleted within 24 hours
- Push notification subscriptions — Retained until you unsubscribe
- Resource request records — Retained for platform improvement purposes
- Contact form submissions — Retained for up to 12 months
- Server logs — IP addresses retained for up to 30 days for security purposes, then deleted
You may request deletion of your personal data at any time by emailing [email protected]. We will respond within 30 days.
13
Admin Access
Authorised administrators of Ape Danuma have access to platform data to manage content, review teacher applications, process subscription payments, and maintain platform integrity.
Admin access is role-based — different administrators have access only to the data relevant to their role. All administrator actions are logged for accountability purposes. These audit logs are retained for 2 years.
Admin access is role-based — different administrators have access only to the data relevant to their role. All administrator actions are logged for accountability purposes. These audit logs are retained for 2 years.
14
International Data Transfers
We use the following third-party services which may process your personal data outside Sri Lanka. We rely on contractual safeguards (data processing agreements) with each provider to protect your data.
| Service | Purpose | Data Transferred | Location |
|---|---|---|---|
| MongoDB Atlas | Database hosting | All account and profile data | Singapore / USA |
| Amazon Web Services SES (ap-south-1) | Transactional email delivery | Email address, name | India (Mumbai) |
| Cloudflare R2 | File and document storage | Uploaded files, teacher documents | USA (global CDN) |
| Upstash Redis | Rate limiting and caching | IP address, request metadata | USA |
| Google LLC | Authentication (OAuth), Analytics, Advertising | Name, email, usage data, device identifiers | USA |
| Cloudflare Web Analytics | Website analytics | Page views, approximate location | USA |
| Web Push (browser vendors) | Push notifications | Browser endpoint identifier | Browser vendor servers |
By using Ape Danuma, you acknowledge that your data may be transferred to and processed in these countries, which may have different data protection laws to Sri Lanka.
15
Your Rights
You have the following rights regarding your personal information:
To exercise any of these rights, please contact us at [email protected]. We will respond to all requests within 30 days.
- Right to access — You may request a copy of the personal information we hold about you.
- Right to correct — You may request that we correct any inaccurate information we hold about you.
- Right to delete — You may request that we delete your account and associated personal data.
- Right to data portability — You may request a copy of your data in a portable format.
- Right to withdraw consent — You may withdraw consent at any time (e.g. disable push notifications in your browser settings or contact us to remove your data from marketing communications). Withdrawal does not affect lawfulness of prior processing.
- Right to opt out of advertising — You may opt out of personalised advertising via Google's Ads Settings at www.google.com/settings/ads
- Right to opt out of analytics — You may opt out of Google Analytics tracking via tools.google.com/dlpage/gaoptout
- Right to complain — You have the right to lodge a complaint with the Data Protection Authority of Sri Lanka. Contact details will be published at the Authority's official website once operational.
- Right to object to profiling — You may contact us at [email protected] to request that we stop building your subject interest profile.
To exercise any of these rights, please contact us at [email protected]. We will respond to all requests within 30 days.
16
Third-Party Services and Links
Cloudflare Web Analytics: We use Cloudflare Web Analytics to measure website traffic. This service collects page view data and approximate location. No cookies are used by Cloudflare Web Analytics.
Push Notifications: If you enable push notifications, your browser generates a unique push subscription endpoint which is stored on our servers and transmitted to your browser vendor (Google or Mozilla) to deliver notifications.
Our platform may contain links to third-party websites, including government examination portals, educational institutions, and social media platforms. We are not responsible for the privacy practices or content of those websites.
Advertisements displayed via Google AdSense may link to third-party websites. We do not control or endorse the content or privacy practices of advertised websites.
Push Notifications: If you enable push notifications, your browser generates a unique push subscription endpoint which is stored on our servers and transmitted to your browser vendor (Google or Mozilla) to deliver notifications.
Our platform may contain links to third-party websites, including government examination portals, educational institutions, and social media platforms. We are not responsible for the privacy practices or content of those websites.
Advertisements displayed via Google AdSense may link to third-party websites. We do not control or endorse the content or privacy practices of advertised websites.
17
Governing Law
This Privacy Policy is governed by the laws of Sri Lanka, including applicable provisions of the Personal Data Protection Act. By using our platform, you consent to the collection and use of your information as described in this policy.
18
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The date at the top of this page reflects the most recent revision.
- This policy was last updated: June 2026
- We recommend reviewing this policy periodically to stay informed about how we protect your information.
- Continued use of apedanuma.lk after changes are posted constitutes acceptance of the updated policy.
19
Data Protection Contact
- Ape Danuma does not currently meet the threshold requiring a mandatory Data Protection Officer under Section 20 of the PDPA.
- For all data protection enquiries, please contact: [email protected]
- We aim to respond to all data protection requests within 21 working days as required by the PDPA.
20
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:
For copyright or legal concerns, please email [email protected].
- Email: [email protected]
- Contact form: apedanuma.lk/contact
- Response time: We aim to respond to all privacy-related inquiries within 30 days.
For copyright or legal concerns, please email [email protected].
By using apedanuma.lk, you agree to the terms outlined in this privacy policy.