Privacy Policy

When you create an account we store:

• Your email address, and a hashed password (never the password itself).
• Your name and, if you provide it, your phone number.
• Your state and city — used only to build the state-wide and city-wide leaderboards described below. Leave them blank and you simply do not appear in those scopes.

If you sign in with Google, we receive your email address, name and profile picture from your Google account, and store a Google account identifier so we can recognise you on your next visit. We do not receive your Google password, and we do not retain Google's access or refresh tokens.

As you use the platform we also record:

• Your test attempts — answers given, score, time taken and submission time.
• Aggregate analytics derived from those attempts, such as accuracy by topic and difficulty.
• Your rank and percentile for each test you complete.
• A record of each purchase, including the amount, currency and the payment identifiers returned by our payment processor.

• To operate your account and keep you signed in.
• To deliver tests and e-books you have access to, and to record your results.
• To produce your analytics and your position on leaderboards.
• To process payments and grant the access you paid for.
• To send you transactional email, such as a purchase confirmation.

To confirmConfirm whether marketing or promotional email is sent, and how users opt out. The platform currently sends only purchase confirmations.

Leaderboards are a core feature, and they are visible to other users. A ranking entry ties your name to a score, time taken, rank and percentile for a given test, within an all-India, state or city scope.

To confirmDecide whether users can opt out of appearing on leaderboards, or display under a pseudonym. There is currently no opt-out.

We do not sell your personal information. We share it only with the service providers needed to run the platform:

• Razorpay — payment processing. Card and banking details are entered with Razorpay directly and never reach our servers; we retain only the payment and order identifiers they return.
• Google — only if you choose to sign in with Google.
• SendGrid — delivery of transactional email.
• Cloudflare — hosting of e-book files, and delivery of the site itself.
• Fly.io and Neon — application hosting and the database.

To confirmConfirm this list is complete and add each provider's own privacy policy link if required in your jurisdiction.

Our application servers and database run in Singapore, and e-book files are stored on Cloudflare's network. This means your information is processed outside India.

To confirmHave this reviewed against the DPDP Act's cross-border transfer rules before publishing.

To confirmSpecify a retention period for each category — account details, test attempts, analytics and payment records — and what happens to them when an account is deleted. Payment records typically carry a statutory minimum retention.

To confirmState how a user requests access to, correction of, or deletion of their data, and the timeframe for responding. Under the DPDP Act this also means naming a grievance-redressal contact.

Passwords are stored hashed, never in plain text. Sessions use short-lived access tokens that expire after 15 minutes, alongside refresh tokens valid for 7 days. Traffic to the platform is encrypted in transit, and e-book downloads are issued as short-lived links rather than public URLs.

No system is perfectly secure, and we cannot guarantee absolute security of information transmitted to us.

To confirmSet a minimum age and state how it is handled. This matters for an exam-prep audience, and the DPDP Act has specific requirements for users under 18.

We may update this policy from time to time. The date at the top reflects the most recent substantive change. To confirmDecide how users are notified.

Questions about this policy can go to hello@examgenius.in. To confirmConfirm this is the right address, and add a registered business name and postal address if one is required.