Privacy Policy

Effective Date: 1 June 2026 | Last Updated: 28 October 2026

DDCET Prep ("we," "our," or "us") operates the website located at ddcetprep.com (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

1. Information We Collect

a) Information from Google Sign-In:

• Full name
• Email address
• Profile picture URL
• Google account unique identifier

b) Information you provide:

• College name and city (during onboarding)
• Referral codes entered
• Doubt/question submissions in the Doubt Box

c) Automatically collected data:

• Test attempt data: answers selected, time spent per question, scores, tab switch counts
• Activity data: login dates, streak information, XP earned
• Device information: browser type, screen resolution (via standard HTTP headers)
• IP address (for security and fraud prevention only)

d) Payment data:

• We do NOT store credit/debit card numbers or UPI PINs
• Payment processing is handled entirely by Razorpay
• We store: Razorpay order ID, payment ID, plan purchased, amount, and transaction status

2. How We Use Your Information

• Platform functionality: Display your dashboard, scores, leaderboard rank, and progress analytics
• Personalization: Show college-specific leaderboards, recommend tests based on weak areas
• Communication: Send in-app notifications (test reminders, streak alerts, badge achievements)
• Payment processing: Activate and manage your subscription plan
• Platform improvement: Analyze aggregate usage patterns to improve question quality and features
• Security: Detect multi-accounting, bot usage, and exam cheating through tab-switch monitoring

3. Data Storage & Security

• All data is stored on Supabase (PostgreSQL database hosted on AWS infrastructure)
• Data transmission uses HTTPS/TLS encryption
• Database access is protected by Row Level Security (RLS) policies
• API keys are stored server-side and never exposed to the browser
• We do NOT store your Google password — authentication is delegated to Google OAuth 2.0
• Session data is stored in server-side PHP sessions

4. Data Sharing & Third Parties

We share data ONLY with the following services, strictly for functionality:

• Google OAuth: For authentication (receives nothing beyond standard OAuth flow)
• Razorpay: For payment processing (receives your name, email, and payment amount)
• Supabase: For database hosting (data processor, not data controller)

We do NOT:

• Sell personal data to any third party
• Share data with advertisers or ad networks
• Use data for training AI models
• Share individual test scores with colleges or employers
• Display your email publicly anywhere on the platform

5. Public vs Private Data

Visible to other registered users:

• Name, profile picture, college, level, XP, streak (on leaderboards)
• Badge achievements

Private (visible only to you):

• Email address
• Individual test answers and question-level analytics
• Payment history and subscription details
• Bookmarked questions

6. Cookies & Local Storage

• Session cookie (PHPSESSID): Maintains your login state. Expires when browser closes or after inactivity.
• We do NOT use advertising cookies, tracking pixels, or analytics services like Google Analytics
• No data is stored in browser localStorage or IndexedDB

7. Data Retention

• Account data: Retained until you request deletion
• Test attempt data: Retained permanently for progress tracking (unless account deleted)
• Payment records: Retained for 7 years (legal/tax requirement)
• Deleted accounts: Data removed within 30 days of deletion request

8. Your Rights

• Access: View all your data via Profile, Analytics, and test history pages
• Correction: Update your name/college via Profile settings
• Deletion: Request complete account deletion by emailing us
• Export: Request a copy of your data in JSON format
• Withdraw consent: Logout and stop using the platform at any time

9. Children's Privacy

DDCET Prep is designed for diploma students (typically 18+ years). We do not knowingly collect data from children under 16. If we discover such data has been collected, we will delete it immediately.

10. International Data Transfers

Your data is stored on servers located in the Asia-Pacific region (AWS ap-south-1, Mumbai). Data may occasionally be processed in other regions by Supabase infrastructure for backup purposes.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by the "Last Updated" date. Continued use of the Platform after changes constitutes acceptance.

12. Contact Us

For any privacy-related concerns or data requests:

• Email: admin@ddcetprep.online
• Response time: Within 48 hours for privacy requests