Privacy Policy

1. Who we are

PrepPortal (“PrepPortal”, “we”, “us”) operates the PrepPortal exam-preparation app and this website. We are based in India and, for the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below. You are the Data Principal.

Questions about this policy, or about your data, go to [email protected].

2. What we collect

Account and identity

You sign in with Google. From your Google account we receive your name, email address, profile picture URL and the Google account identifier. We do not receive, and never ask for, your Google password.

Study data

As you use the app we record the questions you attempt, the options you chose, whether each attempt was correct, the marks it carried, when you attempted it, the chapters and papers you worked on, your selected exam, and your practice streak. This is the data the app exists to produce: without it there is no progress view and no revision that responds to how you are doing.

Doubt-board content

If you post on the doubt board, we store the title and description of the doubt, any photo you attach, any answers you write, which answers were accepted, and the chapter or paper the post was filed under. Your display name is shown alongside your posts to other signed-in users of the same exam. Your email address is never shown.

Support requests

If you raise a support request in the app, or a deletion request on this website, we store what you send us — including the email address you give on the deletion form — for as long as it takes to deal with it, and a record of how it was dealt with.

Technical data

Our servers process the technical information any internet request carries — IP address, timestamp, the endpoint called — in order to serve the request, apply rate limits and investigate abuse or errors. We do not use this to build an advertising profile of you.

What we do not collect

• Payment or financial information. There is nothing to pay for in the app, so none is collected.
• Precise location, contacts, call logs, SMS or device identifiers used for cross-app tracking.
• Any special category of data — health, biometric, caste, religion or the like. Please do not put such information into a doubt post.

3. Why we use it, and on what basis

• To give you an account — so your progress follows you across sessions and devices. Processed to perform the service you asked us for.
• To run practice and revision — recording attempts, computing streaks and working out which chapters to steer you back to.
• To run the doubt board — showing your posts and answers to other students on the same exam, which is the point of posting them.
• To keep the service working and safe — rate limiting, abuse investigation, debugging, and moderating content under our Terms of Use.
• To answer you — handling support and deletion requests.

We do not sell personal data, we do not share it with advertisers, and we do not use it for advertising or for automated decisions that produce legal effects for you.

4. Who else processes it

We keep the list of third parties deliberately short. Each of these processes data on our instructions, for the purpose stated, and for no purpose of their own beyond their own service terms:

• Google (Google LLC, including Firebase) — Google Sign-In authenticates you and supplies the identity fields in section 2. Signing in is a transaction between you and Google under Google’s own privacy policy; we receive only the fields listed above.
• Cloudflare (Cloudflare, Inc.) — hosts our API, database and this website, and handles the network layer in front of them. Your study data and doubt posts are stored on Cloudflare infrastructure.

We will also disclose data where we are legally required to — a valid order from a court or a competent authority — and, if PrepPortal is ever acquired or merged, to the acquiring entity, which would remain bound by this policy until it tells you otherwise.

5. Where it is stored

Google and Cloudflare are global providers and may process and store data on servers outside India. By using PrepPortal you accept that your data may be processed outside India on this basis, subject to those providers’ own safeguards and to any restrictions the Government of India notifies.

6. How long we keep it

• Account and study data — for as long as your account exists. Delete the account and it goes with it.
• Doubt-board posts — see section 8 on what happens to posts when an account is deleted.
• Support and deletion requests — up to 12 months after the request is closed, as the record that we acted on it.
• Technical and rate-limit records — short-lived, and retained no longer than they are useful for security and debugging.

7. Children and students under 18

PrepPortal is exam-preparation software, so some of our users are school students under 18. If you are under 18, use PrepPortal with the knowledge and consent of a parent or guardian; where the law requires verifiable parental consent for a user of your age, that consent is required before the account is used. We do not knowingly profile children for advertising or serve them targeted advertising — we do not serve advertising at all. A parent or guardian can write to [email protected] to see what we hold about their child or to have it deleted.

8. Deleting your account

You can delete your account from within the app, or — if you have already uninstalled it — by raising a request on our account deletion page. Either route is free and neither requires a reason.

Deletion removes your account record and the study data attached to it: your profile fields, your attempts and scores, your streak, your progress and your selected exam. Requests raised on the web are verified against the email on the account before anything is deleted, and are actioned within 30 days.

Doubt-board posts are the one exception, because other students may have relied on the answers. Your posts and answers are disassociated from you — your name is removed and the content is shown without an author — rather than being taken down along with everything else. If you want specific posts removed outright, say so in your deletion request and we will remove them.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• ask what personal data of yours we hold, and get a summary of it;
• have inaccurate or incomplete data about you corrected or updated;
• have your data erased, as described in section 8;
• nominate another person to exercise these rights on your behalf if you die or become incapacitated;
• raise a grievance with us, and escalate to the Data Protection Board of India if we do not resolve it.

Write to [email protected] to exercise any of these. We answer within 30 days.

10. Security

Access to the app’s API requires a valid session token; requests are rate limited; and server errors are never returned to the app with internal detail attached. No system is perfectly secure, but we hold no passwords and no payment data, which removes the two things most worth stealing.

11. Changes to this policy

If we change this policy we will update the date at the top of this page. Where a change materially affects how we use your data, we will say so in the app rather than relying on you to re-read the page.

12. Grievance contact

Grievance officer: [email protected]. For anything that is not a privacy matter, write to [email protected].