Privacy Policy | Donarun Das

1. Who We Are

This policy covers donarundas.com, learn.donarundas.com, and the Deco Room app for iPhone and Android, operated by Donarun Das, a TDI/PADI certified technical diving instructor based in India.

Deco Room is the phone front end for the same learning platform: the same account, the same courses, the same server. Everything the app sends about you goes to learn.donarundas.com over HTTPS, apart from the exam grading described in section 5. The app makes one other outside request, and it is worth naming: the schedule screen downloads the public training calendar from Google Calendar. That request carries no account details and nothing you have typed — only the IP address and app identification that any download carries.

Contact: [email protected]

2. What We Collect on the Website and Learning Platform

When you contact us (via the contact form): your name, email address, and the message you send. This is used solely to respond to your enquiry.

When you sign in to learn.donarundas.com via Google: we receive your name, email address, and profile picture from Google, as permitted by your Google account settings. This information is used to create and manage your learning account.

Automatically: standard server logs (IP address, browser type, pages visited) for security and performance monitoring. We do not use advertising trackers or sell data to third parties.

3. What the Deco Room App Collects

The app carries no advertising SDK and no analytics SDK. Nothing in it follows you across other apps or websites, there is no advertising identifier, and none of what is listed below is used for advertising or sold to anyone. It is all linked to your account, because the account is what the courses hang off.

Your email address and name — from Google Sign-In, or from the account you sign in to with a password. The email address is the account; the name is what the instructor sees when you ask for access to a course.
Your user ID on learn.donarundas.com — the account your enrolments, progress and results are stored against.
Which chapters you have read and which retrieval checks you have answered. This is what unlocks the final exam and what the instructor sees as your progress.
The written answers you submit in a final exam, together with the mark and feedback they receive. How those are graded is section 5, and it is worth reading.

That is the whole list. The app asks for no location, no contacts, no photos, no microphone and no health permissions, and it reads no device identifiers.

4. What Never Leaves Your Phone

Your diver record stays on the device. Blood group, allergies, medical clearance date, next of kin and their number, insurance policy and cover, the insurer's emergency line and your local emergency number are written to the iOS keychain or the Android keystore and are never transmitted. We do not receive them, there is no copy on the server, and no backup of them reaches us. They exist so the emergency card opens on a boat with no signal and no sign-in, which is the only moment they matter.

Crash reports stay on the device too. There is no crash-reporting service in the app. When something breaks, the report is written locally and shown to you under Me → Problem reports, for you to copy out and send if you want to. Nothing is sent automatically.

The Advisor answers on the device. What you ask it is not sent anywhere; it searches content already downloaded to your phone.

App lock, if you turn it on, uses Face ID, Touch ID or your device passcode. Your phone does the checking and tells the app only whether it succeeded. No fingerprint, face data or passcode ever reaches the app, and none of it reaches us.

5. How Written Exam Answers Are Graded

The final exam is written in your own words, and it is graded by an AI model rather than by hand. You should know that before you sit it.

When you submit, your answers go to our server at learn.donarundas.com. For each question, the server sends three things to Anthropic's Claude API: the question, the instructor's answer key for it, and what you wrote. A score and a short piece of feedback come back, and are stored against your attempt.

Your identity is not sent with them. The grader receives the exam text and nothing else — no name, no email address, no account ID, no course record.

Anthropic acts as a processor here: it grades on our instruction and has no other use for the text. Anthropic's published Commercial Terms of Service state that "Anthropic may not train models on Customer Content from Services", so on the terms we contract under, your answers are not training material. We rely on that commitment; we are not in a position to audit it.

If the Claude API is unavailable, the server can fall back to one other provider, Groq. The same three items are sent and nothing more. Those two are the whole list: an answer is only ever sent somewhere named on this page, and Google's Gemini API was removed as a fallback in August 2026 precisely because its unpaid tier reserves the right to use submitted content and to have people read it.

If you would rather your written answers were not sent to a grading provider at all, email [email protected] before you sit the exam and it will be marked by hand instead.

6. How We Use Your Information

To respond to enquiries and schedule training
To provide access to course content on learn.donarundas.com and in the Deco Room app
To process and record requests for access to a course
To track course progress, retrieval checks and exam results
To send course-related communications (no marketing without explicit consent)

7. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. Data may be shared with:

Google, for authentication via Google Sign-In, and for the public training calendar the app's schedule screen downloads (governed by Google's Privacy Policy)
Anthropic, and as a fallback Groq, for grading written exam answers as described in section 5
Razorpay, if you pay a course deposit online. Your card details go to Razorpay directly and never reach us.
Hosting providers, for the operation of our servers (data processed within the scope of service delivery only)
Legal obligations, if required by law

8. Data Retention

Contact form submissions are retained for as long as needed to complete your enquiry. Learning account data — your profile, enrolments, progress, exam attempts and grades — is retained while your account exists, because the attempt and its mark are the record behind any certification issued from it.

Exam records outlive the account. If you delete your account, the attempt, the mark and the answers behind it are kept, because they are the evidence for a certification that does not disappear when a login does. They are kept without your name or email address against them — the account they belong to has been anonymised, so what remains is a mark against a deleted account rather than a named person's exam paper. Everything else goes; the deletion page lists it item by item.

We do not control how long a grading provider keeps the exam text sent to it under section 5. That is governed by their own terms, not ours.

Your diver record is not retained by us at all, because we never receive it. It lives on your phone until you clear it.

9. Deleting Your Account

You can delete your account at any time, from the app under Me → Delete account, or by email if you do not have the app. What deletion removes, what is kept, and how long it takes are set out on a page of their own: Delete your account.

Read it before you ask. These are paid courses, and deleting the account ends the access that was paid for.

10. Your Rights

You have the right to access, correct, or delete personal data we hold about you. To exercise these rights, email [email protected]. We will respond within 30 days.

11. Cookies and Sessions

learn.donarundas.com uses session cookies required for Moodle to function (authentication, CSRF protection). No advertising or tracking cookies are used. You can disable cookies in your browser but this will prevent you from signing in.

The app uses no cookies. It holds a session token which expires four weeks after your last use, after which it signs you out and you sign in again.

12. Children

Technical and rebreather training is adult certification, with minimum ages and medical prerequisites set by the training agencies. The app is listed for an audience of 18 and over, nothing here is designed to attract children, and we do not knowingly create accounts for anyone under 18. If you believe a child has an account here, email us and it will be removed.

13. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the site or the app after changes constitutes acceptance of the updated policy.