Privacy Policy

Abhyas360 is an online practice platform for Indian government and competitive exams, available as a website and as an installable app. It is operated by Abhyas360 ("we", "us"). For personal data processed through Abhyas360, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Abhyas360 is independent. It is not affiliated with any government body or exam conducting authority.

• Account details: your name and email address. Your password is stored only as a one-way hash, never as plain text. If you use Google sign-in, Google shares your name and verified email address with us. We do not receive your Google password or contacts.
• Phone number (optional): only if you sign in with your mobile number or add one in Settings. It is saved only after you confirm a one-time code.
• Preparation profile: your language, the state you choose (we never use GPS or device location), target exam, exam date and daily study time.
• Practice activity: tests you start, the answers you select, time per question, questions marked for review, answer changes, results, mistake tags, your revision and flashcard schedule, daily streaks and badges, current-affairs reading progress and the practice sets you create.
• Writing and speaking practice: mains answer drafts, essays and typing-test text you submit, and — only if you use interview practice — the transcript and the audio recording you choose to send for feedback. Interview recordings are sent for evaluation and are not stored by us.
• Question reports: the category and message you write when you report a problem with a question.
• Alerts and notifications: your in-app inbox, the exams and states you follow, your channel choices (push, email, WhatsApp), the time you opted in to WhatsApp, and — if you allow push — your browser's push address, its encryption keys and the browser name/version.
• Invites and first visit: your invite code; if you joined through a friend's invite link, the link between your account and theirs; and coarse facts about your first visit — campaign tags (source, medium, campaign), the referring website's domain, the landing page path and whether an ad-click identifier was present (never its value).
• Institutes (only if you join one by invite): your membership, role, batches, assignments, the name shown to the institute, and your choice to appear in a private ranking under an alias.
• Usage events: a small set of product events (sign-up, mock completed, revision reviewed, mistake tagged, repair test started) linked to your internal account ID, and the time you were last active. We use them to measure whether the product helps students.
• Technical data: your IP address is used briefly to limit abusive traffic, and our hosting provider keeps routine request logs.
• Guest practice: if you practise before creating an account, we keep that progress on a guest record tied to a session cookie. If you then sign up, it moves into your new account.

We do not ask for Aadhaar or any government ID, precise location, your contacts, or webcam access. No payments are taken today, so we hold no payment details.

• To run the service: sign you in, keep the server-side test timer, save and score your answers, show solutions, schedule revision and show your progress.
• To personalise your preparation: exam recommendations, study plans, weekly reports and percentiles. Percentiles compare scores on the same test without revealing who took it.
• To send the alerts you asked for, only on the channels you switched on.
• To keep accounts and the service safe: rate limits, abuse prevention, sign-in codes and signing out other devices.
• To improve questions and the product: fixing reported questions and understanding, in aggregate, which features help.
• To meet legal obligations and respond to lawful requests.

We do not sell your personal data, we do not show advertising, and we do not share your data with anyone for their advertising.

We process your personal data for the purposes above with your consent, which you give when you create an account or switch on an optional feature, and for the limited legitimate uses the DPDP Act allows (for example, complying with a law or a court order).

Optional features stay off until you turn them on:

• Email alerts — need a verified email address and your opt-in.
• WhatsApp alerts — need a verified phone number and your opt-in.
• Push notifications — need your browser's permission.
• Analytics cookies — only if you accept them in the cookie banner.
• AI feedback — only sent when you ask for it.

You can withdraw consent at any time by turning a feature off, changing your notification settings, or deleting your account in Settings. Withdrawal does not affect processing that happened before it.

We use these service providers (data processors). Each receives only what its task needs:

• Vercel — hosts the website and runs our server code.
• Supabase — our PostgreSQL database, hosted in the Mumbai, India region (ap-south-1).
• Upstash (when enabled) — short-lived rate-limit counters keyed by account ID or IP address.
• Resend — sends emails such as password resets, email verification and the email alerts you switch on.
• Google — Google sign-in (if you choose it); the Gemini API for AI explanations and feedback (see below); and Google Analytics, only if you accept analytics cookies.
• An SMS provider (MSG91, Fast2SMS or Twilio, whichever is configured) — sends one-time sign-in codes to your phone number.
• Meta (WhatsApp Cloud API) — sends approved alert messages to your phone, only if you opt in to WhatsApp alerts.
• Browser push services (run by your browser's maker, such as Google, Mozilla or Apple) — deliver push notifications if you allow them.
• Text-to-speech providers (Sarvam AI or ElevenLabs, when studio audio is enabled) — receive only the study text to be read aloud.

Other people see your data only in these cases:

• Institutes you join: their staff can see the name shown to them, your membership and your assignment progress and results. Rankings show only an alias, and only if you opt in.
• Share links you create (score cards, weekly reports) can be opened by anyone who has the link until it expires or you revoke it. A score card shows your first name only if you choose.
• Invites: if you joined through a friend's invite link, your friend is notified with your first name when you finish your first mock. People you invite are shown to you only as counts.
• Study desks show other students an anonymous desk label, your study goal, focus status and reaction — not your name.
• When the law requires it, or to protect the safety and rights of students and the service.

When AI features are switched on and you use them, we send the following to Google's Gemini API:

• AI tutor: the question, its options, the reviewed solution and correct answer, the question's source label, and the messages you type in the tutor chat.
• Mains and essay feedback: the question or topic, the word limit and the answer text you submit.
• Interview practice: the question, your transcript and, if you attach it, your audio recording.

We do not send your name, email address, phone number or account ID with these requests. Your preferred feedback language is included. AI tutor answers are cached on our servers for 7 days so the same request does not go out twice.

Anything you type into your own answers or the chat is sent as written, so please do not include personal or sensitive information. AI output can be wrong — reviewed solutions remain the reference.

First-party cookies we set:

• abhyas_session — keeps you signed in (30 days; not readable by page scripts).
• lang — remembers your language (1 year).
• abhyas_ref — the invite code from a link you opened, so the invite counts if you sign up (30 days).
• abhyas_attr — first-visit facts described above (campaign tags, referring domain, landing page) (30 days).
• abhyas_oauth_state and abhyas_oauth_next — protect Google sign-in and return you to the right page (10 minutes).

Optional analytics cookies: if this site has Google Analytics enabled, it runs with analytics storage denied by default. Analytics cookies are set only after you accept them in the cookie banner; if you decline, they are not set. Analytics helps us understand page visits in aggregate.

Browser storage: your theme and test-screen theme, a backup of answers for a test in progress (removed when you finish), unsent writing drafts, recent exam searches, audio and install-prompt preferences, and your vacancy watchlist are kept in your browser. Offline revision packs are kept in your browser's database and are cleared when you sign out from the sign-out screen. Our service worker caches only public files such as the offline page and icons — never your account pages or answers. You can clear all of this from your browser settings.

• Your account, profile and practice history: while your account is active, until you delete it.
• Sign-in codes: stored only as a hash, expire after 10 minutes, allow at most 5 tries, and expired code records are cleaned up routinely.
• Password reset links: single use, expire after 15 minutes.
• Share links: stop working after the period you choose (score cards 7, 30 or 90 days; weekly reports 1, 7 or 30 days) or when you revoke them.
• Offline revision packs expire after 7 days; mains drafts after 180 days without edits; the flashcard schedule after a year without use; AI tutor answers after 7 days.
• Notifications: kept in your inbox while your account is active; you can delete them one by one.
• Push subscriptions: removed when you turn push off, when the push service reports the device is gone, or after repeated delivery failures.
• Rate-limit counters: from one minute to one day.

When you delete your account, your personal data is deleted immediately, except for the few records described on the account deletion page. Copies may remain in our providers' backups and logs for a limited period before they are overwritten.

• Access and a copy: download your data as a JSON file from Settings (Download my data), or write to us for a summary of what we process and who we share it with.
• Correction: update your name, language, state, exam and study time in Settings; write to us to correct anything else.
• Erasure: delete your account at any time — see how to delete your account.
• Withdraw consent: switch optional features off at any time (see section 4).
• Grievance redressal: contact our Grievance Officer (below). If you are not satisfied with our response, you may complain to the Data Protection Board of India.
• Nomination: you may nominate another person to exercise these rights for you in case of death or incapacity, by writing to us.

To protect your account we may ask you to confirm the request from the email address or phone number registered to it. Never send us your password or sign-in codes.

Abhyas360 is intended for exam aspirants aged 18 and over. If you are under 18, use it only with the consent and supervision of a parent or guardian. We do not show advertising and we do not track anyone, including minors, for advertising. If a parent or guardian believes a child's data should be removed, write to us and we will help.

Passwords are hashed with bcrypt. Sessions are signed and stored in a cookie that page scripts cannot read, and when you sign out you can also sign out of all your other devices. Sign-in codes are hashed and attempt-limited. All traffic uses HTTPS, the database is reachable only from our servers, and answer keys are never sent to your browser before you submit.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will inform you and the Data Protection Board as the law requires. If you find a security issue, please write to us.

Our database is hosted in India (Mumbai). Some of the providers listed above — for hosting, email, AI, SMS, messaging and analytics — may process data outside India, as permitted under Indian law.

When we change this policy we update the date at the top. If a change materially affects how we use your personal data, we will tell you in the app or by email, and ask for fresh consent where the law requires it.

For privacy questions, data requests or complaints, write to our Grievance Officer at Aksahmax661@gmail.com. Please include the email address or phone number registered to your account.