Privacy Policy

Last updated: 2 October 2026

Who we are

MegaExams (megaexams.com) is run by Goodfit Software LLC, a Delaware limited liability company, 254 Chapman Road, Ste 208 #23129, Newark, Delaware 19702, USA. Questions about this policy go to prasanth@megaexams.com. A real person reads that inbox.

Schools own their students' data

When a school, college, academy or teacher uses MegaExams with their students, they decide what is collected and why. We process student data only to run the service for them, under their direction. For US schools this makes us a "school official" under FERPA. Schools and parents should read our student data privacy page, which goes into more detail.

What we collect

Teachers and staff: name, email address, institution name, an optional password (stored only as a bcrypt hash), and the questions, exams and courses you create.
Students: name and email address. Optionally phone, city, class or grade, and school, if the student or teacher fills them in. Exam answers, scores, and time taken. Photos a student uploads of handwritten answers or course doubts.
Proctoring (only when a teacher turns it on for an exam): counts of events such as leaving the exam tab, exiting fullscreen, copy and paste, plus the browser's user agent. If the teacher also turns on webcam proctoring, a small still photo (320 x 240) is taken about every 45 seconds during the exam. No audio is ever recorded.
Approximate location: the country and city worked out from the student's IP address, using a database on our own server. We store the country and city, not the IP address.
Server logs: our web server records requests (including IP address and browser) for about 14 days, for security and fixing errors.

How we use it

To run exams, mark them, show results and rankings that the teacher has turned on, produce scorecards and certificates, send sign-in codes and exam notifications by email, and keep the service secure and working. That is all.

What we never do

We never sell personal data, and never rent or trade it.
We never show ads, and never use student data for targeted advertising.
We never build profiles of students for any purpose other than the school's own use of MegaExams.
We never use student answers or personal data to train AI models, and OpenAI does not train on data sent through its API.

Where your data is stored

All application data and uploaded files are stored on one server run by DigitalOcean in Bangalore, India (the BLR1 region). If you are outside India, your data is transferred to and stored in India. Schools whose policy or board requires US hosting can ask us, and we will arrange it.

Who else handles data

We use a small number of service providers (subprocessors): DigitalOcean for hosting, OpenAI for AI features, Resend for email, Microsoft Clarity for usage analytics, Google for fonts, sign-up spam protection and optional Google Classroom, and public CDNs for page assets. Each one, with exactly what it receives and where, is listed on our subprocessors page.

Analytics and cookies

We use Microsoft Clarity to see how people use the site (clicks, scrolls, page layout) so we can fix confusing screens. On every teacher and student page, Clarity runs with all text and inputs masked: it never sees names, answers, scores or images. On our public marketing pages, which hold no student data, it is not masked. Clarity sets its own cookies. We also use essential cookies to keep you signed in. We do not use advertising cookies.

How long we keep it

Accounts, exams and results: while the account is active.
Items a teacher deletes: kept in Trash for 30 days so mistakes can be undone, then permanently deleted.
Webcam snapshots: deleted automatically after the number of days the school sets (new schools start at 90 days).
Server logs: about 14 days.
Database backups: nightly, kept for 7 days, on the same server.
When a school's contract ends or it asks us to, we delete its data within 30 days and confirm in writing.

Security

All traffic uses HTTPS. The database is not reachable from the internet. Proctoring photos and answer photos are shown only to signed-in teachers of the owning school. We do not hold a SOC 2 or ISO 27001 certification. Our security page lists exactly what we do.

Your rights

You can ask to see, correct, export or delete your personal data. Email prasanth@megaexams.com and we will respond within 30 days. If you are a student whose school uses MegaExams, we will usually pass your request to your school, because the school controls that data; we will tell you when we do. School owners and admins can download their school's data as a ZIP of CSV files from their settings.

Children

Students under 13 should use MegaExams only through a school or teacher. In that case the school provides consent on behalf of parents, as US COPPA allows for school use, and the data is used only for the school's educational purpose. If you believe we hold data about a child under 13 without that consent, email us and we will delete it.

Changes

If we make a material change to how we handle personal data, we will update this page and email school account owners before it takes effect.

IP geolocation by DB-IP (https://db-ip.com).