AP.LK App Privacy Policy

Who we are

The AP.LK apps for Android, iPhone and iPad, Wear OS and Apple Watch (with their widgets) are owned by Anuradha Perera, the teacher of every AP.LK class, and operated by his company, AP Education (Pvt) Ltd, a private limited company incorporated in Sri Lanka on 20 March 2025 under the Companies Act No. 7 of 2007 (registered as AP EDUCATION (PVT) LTD). In these pages, "AP Education", "we", "us" and "our" mean AP Education (Pvt) Ltd.

AP Education (Pvt) Ltd is the controller of the personal data described here. This policy covers the AP.LK apps only. Our website has its own privacy policy.

1. Who can use the apps

The apps are for AP.LK students preparing for the G.C.E. Advanced Level examination. You must be at least 16 years old to create an AP.LK account. We do not knowingly collect data from anyone younger; if you believe a younger child has an account, contact us and we will delete it.

2. What the apps collect and why

• Your account. You sign in through AP.LK accounts (accounts.ap.lk) with Google or Apple. We receive your name, email address, the account's ID and, from Google, your profile picture. We use them only to sign you in and to show who is signed in.
• Your AP.LK student profile. Your student ID, exam year, institute, medium, district and school, as you entered them on the AP.LK website, so the apps can show your classes and Smart ID.
• Your learning. The classes you hold, recordings you watch and how far you got, PDFs you open, homework you mark as done, the study time you log (also from your watch), your paper marks and ranks, your tute deliveries and the notices for your classes.
• Smart ID. Your Smart ID QR code, and the times and places it was used at AP.LK doors. On Android you can also tap your phone at the door: the phone makes a key for this that stays in its secure hardware; only its public part is sent to us.
• Your device. The phone's model, operating system and app version, and a security key made in the phone's secure hardware that signs every request, so only the real app on your phone can use your account. We may ask Google Play or Apple to confirm the app is genuine.
• Notifications. If you allow them, a notification token from Google or Apple, and which kinds of notifications you want (live classes, marks, homework and others).
• How the app is used. With Google Analytics for Firebase we count which screens and features are used, which notifications are opened and similar events, with an app-instance ID and an approximate region worked out from the network. It is never linked to your name or account, never used for advertising, and the apps use no advertising ID. You can turn it off in Settings → Share app usage.
• LearniX. If you ask LearniX, AP.LK's AI study assistant, your questions and its answers are processed by our own AI model hosted in the cloud and kept securely, to answer you and to improve LearniX for AP.LK students.

The apps do not read your contacts, photos, files, microphone, camera or precise location, and they do not sell anything: there are no payments in the apps.

3. Google and Apple sign-in data

When you sign in with Google, the apps (through accounts.ap.lk) receive only your name, email address, profile picture and Google account ID. We use them to create and sign in to your AP.LK account and to show your name and picture in the apps and on the website. We do not use Google user data for advertising, we do not sell it, and we share it with no one except the service providers that run AP.LK for us (section 5). Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. With Sign in with Apple you can hide your email; we then use the address Apple relays.

4. What stays on your phone

So the app opens quickly, it keeps a copy of what you last saw (your classes, marks, timetable and similar) on your phone for up to a week. It is not included in backups, and it is deleted when you sign out. Your sign-in is kept encrypted with a key in the phone's secure hardware. The watch and the home-screen widgets show data your phone sends them.

5. Who we share data with

• Our cloud hosting and storage providers, which run AP.LK's servers for us.
• Google (Firebase Cloud Messaging and Google Analytics for Firebase) and Apple (push notifications), to deliver notifications and count app usage as described above.
• Google and Apple, when you choose them to sign in.
• Authorities, when Sri Lankan law requires it (section 6).

We do not sell your personal data, and we do not track you across other companies' apps or websites.

6. Requests from government and law enforcement

We give personal data to a court, the Sri Lanka Police or another government authority only when Sri Lankan law requires it, for example under a court order or a lawful request in a criminal investigation. We check that each request is lawful, give only the data it covers and, where the law allows, tell you. We may also share data when it is needed to protect someone's safety, or to establish or defend a legal claim.

7. Data stored outside Sri Lanka

Some of our service providers (cloud storage, push notifications, analytics) keep data on servers outside Sri Lanka. We only transfer personal data abroad where it stays protected as the Personal Data Protection Act requires, under binding commitments from the provider.

8. How we protect it

Everything the apps send travels encrypted (HTTPS). Every request is signed by your phone's security key, access to personal data is limited to authorised staff, and your account can be used on one app device at a time.

9. Keeping and deleting your data

We keep your account while you use AP.LK. You can delete it in the app (Settings → Delete account) or on the web at ap.lk/app/delete-account. Your account is closed and you are signed out everywhere at once; after 30 days your name, contact details, address, NIC and profile are erased for good. Your paper marks stay in the rankings without your name, and records the law requires us to keep are kept without your personal details. Within those 30 days you can ask us to restore the account.

10. Your rights

Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you can ask to see the personal data we hold about you, to correct it, to delete it, to object to its use, and to withdraw consent you gave (for example, by turning off notifications or app usage sharing). Contact us using the details below; we may ask you to confirm your identity, and we answer within the time the Act sets. If you are not satisfied, you can complain to the Data Protection Authority of Sri Lanka.

11. Data breaches

If a breach of security affects your personal data, we act at once to contain it and inform the Data Protection Authority and the students affected as the law requires.

12. Changes to this policy

If we change this policy we will update this page and its date, and tell you in the app when the change matters to you.

Contact us

Questions or requests about this policy or your data: