Privacy policy

Short version: your practice history never leaves your browser. The only things that reach a server are what you deliberately send — an email address if you sign up, and a score if you post one to the leaderboard. There is no advertising, no third-party analytics, no tracking pixels, and nothing here is sold or shared for marketing.

1. What stays on your device

Your answers, scores, streaks, attempt history, topic mastery, subject preference, theme, and companion settings are kept in your browser's local storage. They are not uploaded, not backed up, and not visible to us.

The consequence is worth stating plainly: clearing your browser data, using private browsing, or switching to another device loses that history, and we cannot restore it because we never had it.

2. What we collect, and why

If you never create an account

Nothing that identifies you. You can take the daily test, review it, and keep a streak without ever telling us who you are.

If you create an account

• Your email address — so the account can be recovered and so we can reach you about it. It is stored, and it is also indexed under a one-way SHA-256 hash so the list of accounts cannot be read back into a list of addresses.
• A username, if you set one — this is public on the leaderboard. If you set none, the leaderboard shows your email masked (for example s••••@gmail.com) rather than in full.
• A session cookie named cds_sid. It is httpOnly — script on the page cannot read it — and its only job is to keep you signed in. It is not an advertising or tracking cookie, and there are no others.
• The account creation date.

If you post a score to the leaderboard

• Your score for that day and subject, and the display name described above. Both are publicly visible to anyone who opens the leaderboard.
• A marker recording that your account has completed that day's test, so one attempt cannot be posted twice.
• Answers are sent to the server to be scored there rather than in your browser. They are used for that and are not kept as a per-question record against your name.

Automatically, on any request

• Your IP address, used transiently for rate limiting — to stop one client hammering an endpoint. It is not built into a profile and is not used to identify you. Standard web-server request logs on our host may also record it, as they do for any website.
• Error reports, if a page crashes: the error message, the stack trace, the route it happened on, and a coarse timestamp. These carry no email, no cookie, and no test answers, and they are deleted automatically after three days.

3. Payments

No payment data is collected at all today. Billing is not live on CDS Prep: no card, UPI, or bank details are requested anywhere in the app. When payments do go live they will be handled by a third-party gateway and those details will never reach our servers — we will receive only the fact of a successful payment, its amount, and a reference number. This page will be updated on the day that changes.

4. Who else can see it

• Anyone, for the leaderboard — display name and score, by design. Nothing else on it is public.
• Upstash, which provides the Redis database that holds accounts, sessions, leaderboard entries, and error reports.
• Our hosting provider, which serves the site and keeps ordinary access logs.
• A payment gateway, once billing is live, for payments only.

That is the whole list. We do not sell personal data, we do not share it with advertisers or data brokers, and we have no analytics or tracking scripts on any page. We would disclose data if a law or a valid court order required it, and not otherwise.

5. How long it is kept

• Account and email: until you ask us to delete it.
• Sessions: until they expire or you sign out.
• Leaderboard entries: they are per-day, and old days are not the public board.
• Error reports: three days, then deleted automatically.
• Payment records, once billing is live: as long as Indian tax and accounting law requires.

6. Your choices

• Delete everything on your device — clear site data for prepcadet.in in your browser. That removes all of it at once, is immediate, and does not involve us. Settings can reset your topic history on its own if that is all you want gone.
• Delete your account — email support@prepcadet.in from the address you signed up with and we will remove the account, its email, and its leaderboard entries.
• See a copy, or correct something — same address, same way.
• Stay off the leaderboard — simply do not create an account. The daily test works without one.

7. Security

The site is served over HTTPS. Session cookies are httpOnly and SameSite-restricted, sessions are stored as hashes rather than as the token itself, and API endpoints are rate limited. Email ownership is not yet verified at sign-up — we say so rather than implying an address has been confirmed when it has not. No system is perfectly secure, and we do not claim otherwise.

8. Children

CDS Prep is meant for candidates aged 18 and over and is not directed at children. If you believe a child has created an account, write to support@prepcadet.in and we will remove it.

9. Changes

If this policy changes, the date at the top of the page changes with it. A change that materially affects what we collect will be announced in the app rather than made quietly.

10. Contact

Privacy questions and deletion requests: support@prepcadet.in. Full details on the contact page.