Last updated: 23 October 2026
Strat101 is operated by Ravi Boorla, an individual based in India ("Strat101", "we", "us"). This Privacy Policy explains what personal data we collect, why, where it is kept and the choices you have, across strat101.com and these products (together, the "Services"):
Several products are built so that we never receive your data at all; section 3 says exactly which. Where a product shows its own privacy notice, that notice adds to this policy. We follow India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules, and we respect equivalent rights for users elsewhere.
For your own account details, and for products you use as an individual (SimVest, Rise, CiFort, Casper), we decide how your data is processed and act as the data fiduciary. For content an organisation or housing society keeps in StratFi, StratOS or finOra, that organisation or society decides what is recorded and why. We process it on their behalf and on their instructions. Requests about such records, for example a resident asking a society to correct a ledger entry, should go first to that organisation or society. We will help them respond.
strat101.com (this website). No account and no forms that collect personal data. We use Google Analytics, which sets cookies and records pages visited, approximate location, device and browser, to understand aggregate traffic. Fonts load from Google Fonts, which receives your IP address. See section 11.
StratFi and StratOS.
Hosted on Vercel and Supabase; transactional email is sent through Resend.
CiFort. CiFort has no server and no database. Your vault is encrypted on your device with a key derived from your master password, and the encrypted file is stored where you choose: your own Google Drive, your own iCloud, or your device. Signing in with Google only lets CiFort read and write that file in your own Drive. We never receive your vault, your passwords or your master password, and we cannot recover them.
Casper. Casper is a desktop app with no account and no telemetry: no analytics, no crash reporting, no usage metrics. Browsing sessions are ephemeral and history is not written to disk. If you add an AI provider key, it is stored only on your device and sent only to that provider. With a local model (for example Ollama), nothing leaves your machine. In AI Research Mode, searches go to the search endpoint you configure and pages are fetched anonymously on your behalf. Installers are downloaded from GitHub, which sees your IP address like any download host. The Casper website does not collect email addresses or any other personal data.
SimVest. SimVest has no account and no database. Your income, expenses, investments, loans, goals and tax inputs stay in your browser's local storage.
finOra.
Each society's records sit in their own isolated database on Cloudflare; email is sent through Resend; Cloudflare Turnstile checks sign-ins for bots. finOra does not process payments: amounts paid by UPI, NEFT or cheque are only recorded.
Rise. Rise works fully without signing in, and then your progress, bookmarks and streaks stay only on your device. Signing in with Google is optional. If you sign in, we receive your name, email address and profile picture from Google, and we store your progress, bookmarks and streaks so they sync across devices. We also store any family links (a parent or guardian invited by email, and assignments they set) and any challenge or practice rooms you join. Sign-in and sync run on Google Firebase. Rise shows no ads and does no behavioural tracking.
Where a product lets you connect your own AI provider (Anthropic, OpenAI, Google, Azure, Mistral, Groq, a self-hosted model and others), your prompts and the content you send with them go to that provider under your own account and agreement. We do not route them through an AI account of ours and do not use them for anything else.
We use personal data only to:
We do not sell personal data, do not show advertising in our products, and do not use your private content to train AI models.
We process data with your consent, which you give by signing up or connecting a service, or where the law allows it without consent, such as providing a service you asked for, meeting legal obligations, or responding to emergencies. You can withdraw consent at any time (section 10). Withdrawal does not affect processing already done, and may mean we can no longer provide that Service.
Only with service providers needed to run the Services, each limited to that purpose:
We also share data with third-party platforms you connect (AI providers and cloud storage), only as you authorise, and with authorities when Indian law or a valid legal order requires it. If Strat101 or a product is transferred to a new owner, personal data would move with it under this policy, and we would tell you first.
Our providers run infrastructure outside India, including the United States and Cloudflare's global network. Where we transfer personal data outside India, we do so only as the DPDP Act permits and with providers that protect it under their contracts with us.
All Services use encryption in transit (HTTPS). Third-party credentials and API keys are encrypted before they are stored and are never sent back to your browser. Organisation data in StratFi and StratOS is separated by row-level security and role-based access. Each finOra society has its own database. CiFort, SimVest and Casper are designed so your data never reaches us. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as the law requires.
Under the DPDP Act, and similar laws where they apply to you, you can:
Many of these you can do yourself: finOra residents can download their data, StratFi and StratOS admins can export and delete organisation data, and you can disconnect any connected platform. For anything else, write to privacy@strat101.com.
strat101.com uses Google Analytics cookies (such as _ga) to measure aggregate traffic. You can block them in your browser settings or with Google's opt-out browser add-on. The product apps use only what they need to work: sign-in and session cookies or tokens, and local storage for your settings and, in SimVest and Rise, your own data. Vercel Web Analytics in StratFi and StratOS does not use cookies.
StratFi, StratOS, CiFort, Casper, SimVest and finOra are meant for adults (18+), and we do not knowingly collect personal data from children through them. Rise is made for Class X and XII students, most of whom are under 18:
If we learn that we hold a child's data without such consent, we will delete it.
We will post any update on this page with a new date. For material changes, we will also notify account holders by email or in the product before the change takes effect.
Privacy questions and requests: privacy@strat101.com. Product-specific contacts: finOra at finora@strat101.com, Rise at rise@strat101.com.
Grievance Officer, Strat101 — privacy@strat101.com. We acknowledge grievances within 24 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.