Privacy Policy

1. Introduction

This Privacy Policy describes how UnderPrep ("we", "us", "our"), accessible at underprep.com, collects, uses, stores, and protects your personal data when you use our free JEE & NEET exam preparation platform.

This policy applies to all users of our website and services. By using UnderPrep, you agree to the practices described in this policy. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), UnderPrep acts as a "Data Fiduciary" and you are the "Data Principal."

2. Information We Collect

a) Information you provide directly

• Full name (first and last name)
• Email address
• Password (stored in hashed form, never in plain text)
• Exam type (JEE Mains, JEE Advanced, or NEET)
• Class level (11th, 12th, or Dropper)
• Target exam year
• Coaching status (Self Study, Allen, PW, Unacademy, or Other)

b) Information collected automatically

• IP address, browser type, and device information
• Pages visited, time spent, and navigation patterns
• Test attempt data: answers, scores, time per question, error classifications, visit counts
• Progress analytics: score trends, subject accuracy, error type breakdowns

c) Information from third parties

• Google OAuth: name, email address, and profile picture (when you sign in with Google)

3. How We Use Your Data

• To create and manage your account
• To provide personalized test preparation, analytics, and error classification
• To track your progress, scores, and weak areas over time
• To improve platform content, question quality, and user experience
• To display contextual advertisements via Google AdSense (on browsing pages only, never during active tests)
• To communicate platform updates and important notices
• To maintain platform security and prevent abuse
• To comply with applicable legal obligations

4. Cookies & Tracking Technologies

We use the following cookies and similar technologies:

• Session cookies (essential): Used for authentication via NextAuth.js. Required for login functionality.
• Test session cache (essential): Temporary server-side caching via Redis to auto-save your test progress every 30 seconds. This data is deleted after test submission.
• Google AdSense cookies (third-party): Used to display advertisements. For users under 18, only contextual (non-personalized) ads are served.

You can manage cookies through your browser settings. Disabling essential cookies may prevent you from logging in or taking tests.

5. Data Sharing

We do not sell your personal data to any third party.

We share data only with the following service providers who help operate the platform:

• Google — OAuth authentication and AdSense advertising
• Supabase — Database hosting (PostgreSQL)
• Amazon Web Services (AWS) — File storage for study material PDFs
• Upstash — Redis caching for test sessions
• Vercel — Application hosting and deployment

Sponsoring coaching institutes see only their sponsorship placement on the platform. They receive no personal data about students.

We may disclose your information if required by law, court order, or government authority.

6. Data Storage & Security

Your data is stored securely using industry-standard measures:

• All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Passwords are hashed and never stored in plain text
• Database access is restricted with role-based access controls
• Study material PDFs are served via signed URLs that expire after 1 hour
• Test session data in Redis is temporary and auto-expires

7. Data Retention

• Account data: Retained as long as your account is active
• Test attempts and analytics: Retained as long as your account is active to power progress tracking
• Redis session cache: Temporary, automatically deleted after test submission
• After account deletion: All personal data is erased within 90 days. Anonymized aggregate data (e.g., total test count) may be retained for platform improvement

8. Children's Privacy

UnderPrep is primarily used by students aged 16–19. Under India's Digital Personal Data Protection Act, 2023, users under 18 years of age are considered children.

• Before processing any personal data of a user under 18, we require verifiable consent from a parent or legal guardian
• Parents or guardians may contact us to review, modify, or request deletion of their child's data
• We do not serve targeted or behavioral advertising to users identified as minors. Google AdSense ads displayed to minor users are contextual only
• We do not track, profile, or behaviorally monitor minor users beyond what is necessary to provide the educational service

9. Your Rights

Under the Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

• Right to Access — You may request a summary of your personal data being processed and our processing activities
• Right to Correction & Erasure — You may request correction of inaccurate data or complete erasure of your personal data
• Right to Grievance Redressal — You may raise concerns with our Grievance Officer. If unsatisfied, you may file a complaint with the Data Protection Board of India
• Right to Withdraw Consent — You may withdraw consent at any time by deleting your account or contacting us. Upon withdrawal, we will cease processing and erase your data within 90 days
• Right to Nominate — You may nominate another individual to exercise your rights in the event of your death or incapacity

To exercise any of these rights, contact our Grievance Officer at the details below.

10. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer:

Any complaints or concerns regarding your data may be directed to the Grievance Officer, who will address your concern within 30 days of receipt. If you remain unsatisfied, you may file a complaint with the Data Protection Board of India.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For significant changes, we will notify you via email or a prominent notice on the platform. Continued use of UnderPrep after changes constitutes acceptance of the updated policy.