Privacy Policy

This policy explains what [Registered Legal Entity Name] does with your personal data on Aptitude Arena (the Platform). It covers the website, practice, mock tests, contests, the community and everything around them. "Personal data" just means information that can identify you.

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act) we are what the law calls a Data Fiduciary - the people responsible for looking after your data. We also follow the Information Technology Act, 2000.

Read this together with our Terms of Service.

Section 14 has more, including how a parent or guardian can see or delete a child's data.

a. What you tell us

• Account: your name, email, and your mobile number if you sign in or verify with it, plus whether each one has been verified.
• Profile: your username and whether you would rather show that than your full name, your profile photo, and your gender if you choose to add it.
• Study details: which exam or exams you are targeting, the year, how far along you are, your education level, city and state, the subjects you picked, and how you heard about us.
• Messages: anything you send to support, and any question you report or challenge.

b. What you do on the Platform

This is what makes your analytics, streaks and smart practice work.

• the attempts you start and finish in practice, mocks and contests; the answers you give and whether each was right, partly right, wrong or skipped; the marks and the time you took on each question;
• your scores, accuracy, section-wise results, number of attempts, and rank where there is a leaderboard; and
• what we work out from all that: accuracy and average time per chapter, how much you practised each day, experience points, streaks, weak and rusty topics, bookmarks, and your coin balance and history.

c. What you post

Your posts, replies and votes, and whether a post was anonymous. Other students cannot see who wrote an anonymous post, but it is still linked to your account on our side so we can moderate and follow the law.

d. Payments

If you ever buy a plan, the payment gateway handles your payment details directly. All we keep is which plan you bought, the order and payment reference, the amount and whether it went through. We never see or store your full card number, UPI PIN, CVV or netbanking login.

e. Technical and usage data

Your IP address, browser and device type, operating system, approximate region derived from your IP, server log records including timestamps and error traces, and sign-in and session information from our authentication provider.

f. Files you upload

Images you upload, such as a profile photo, are stored with our media hosting partner. Do not upload documents containing sensitive personal information such as identity documents or marksheets - the Platform does not ask for them.

Mock tests and contests are scored, and sometimes ranked against other students. To keep those ranks worth something, the test window notes a few browser events while a timed test is running, along with when each one happened and a running count for that attempt.

Here is the full list of what gets noted:

• going into or coming out of full screen;
• the test tab being hidden or shown again, for example if you switch tabs;
• clicking away from the test window and coming back;
• copy, paste and right-click inside the test window; and
• signs that browser developer tools have been opened.

We use these only to score and check that one attempt, warn you during the test, submit it automatically if you pass the limit, and look into anything that seems off. They belong to that attempt. We do not use them to build a profile of you, and we never sell them or hand them over for advertising.

• To run the Platform: set up and sign you in, show the right question bank for your exam, save your progress, and let you pick up an attempt where you left off.
• To make practice fit you: spot your weak and rusty topics, build smart and custom practice sets, and fill in your dashboard, streaks and heatmap.
• To score, rank and keep tests fair: check your answers, produce results and solutions, build leaderboards, and validate attempts as described in section 4.
• To handle payments and any subscription, invoice or refund.
• To stay in touch: verification codes, account and payment notices, replies to your support messages, and - unless you opt out - the occasional update about new features and content.
• To improve things and keep them safe: find and fix bugs, check how good our questions are, plan new content, stop abuse, fraud and scraping, moderate posts, enforce our Terms, and do what the law requires.

We do not sell your personal data, and we do not hand it to advertisers or data brokers.

Mostly because you said yes: you give consent when you create an account and use the Platform. The DPDP Act also allows some uses without separate consent - for instance when you have handed us information for an obvious purpose and not objected, or when a law or a court tells us we have to.

You can take that consent back at any time - section 11 explains how. Doing so does not undo what we did before, and some things will stop working. We cannot keep your progress analytics going, for example, without the attempt data behind them.

We only use cookies and browser storage for things the Platform genuinely needs. No advertising cookies, and no third-party ad or social-media tracking pixels.

You can clear or block cookies in your browser settings. Blocking the essential ones will sign you out and can stop timed tests working properly.

We share your data only where it is needed to run the Platform, and only with companies that are contracted to use it on our instructions and keep it safe. These are the main ones:

We may also hand over data:

• to a court, regulator or the police, where the law requires it or where we need it to defend a legal claim;
• to our auditors and lawyers, who are bound to keep it confidential; and
• to a buyer, if the company is ever sold or merged - and we will tell you before your data comes under a different privacy policy.

Other students can see your display name (your full name or username, whichever you chose), your profile photo, any post you did not make anonymously, and your score and position on a leaderboard for a test you took.

Some parts of the Platform use AI models from outside providers:

• Building content. When our team loads in a question paper, an AI reads it and turns it into proper questions, options, answers and passages. Our team checks the result before anything goes live. That is our content, not your data.
• Checking written answers. For questions where you type an answer in your own words, what you write may go to an AI provider to be marked against a model answer. Put only your answer in that box - no personal details.
• Helping us write. Our team may use AI to draft edits or explanations for a question, and a person reviews it before it is published.

We use these providers on business terms that stop them training their models on what we send. AI gets things wrong sometimes, so read explanations and auto-marked answers with a critical eye - and report anything that looks off using the option on the question.

No decision that seriously affects you is left to a machine alone. If an answer was scored automatically, or a violation counted during a timed test, you can ask us to look at it again.

• Account and profile - while your account is open, plus a short grace period after deletion in case it was a mistake.
• Your practice history and analytics - while your account is open, since your progress is the whole point. It is deleted or permanently anonymised when your account goes.
• Test-integrity signals - stored with the attempt they came from, and deleted with it.
• Posts - up until you or we take them down. If you delete your account we remove them or strip your name from them, unless the law says we must keep them.
• Payment, tax and security records - payment and tax records stay as long as Indian tax and company law requires, even after you leave. Server and security logs are kept only briefly, for fixing problems and stopping abuse.

As a Data Principal under the DPDP Act, you have the right to:

• See a summary of what personal data we hold about you and what we do with it;
• Fix, complete, update or delete it - a lot of this you can do yourself from your profile;
• Take back your consent, which applies going forward;
• Name someone to use these rights for you if you die or cannot act for yourself; and
• Have a complaint sorted out by us, before you take it to the Data Protection Board of India.

To use any of these, email privacy@aptitudearena.example from your registered address. Section 16 has our reply times. We may need to check who you are first, and there are cases where the law lets us say no - for instance when we are required to keep something.

The DPDP Act also asks a few things of you: do not pretend to be someone else, and do not file false or time-wasting complaints.

• Everything between your browser and our servers travels encrypted over HTTPS.
• Our sign-in provider handles credentials - we never store your password, one-time codes expire quickly, and payment details never reach our servers.
• Only staff who need access to live data have it, and admin tools are kept separate from student accounts.

No system is perfectly safe. If there is ever a breach, we will tell the Data Protection Board of India and the people affected, as the DPDP Act requires. If you spot a security hole or think your account has been broken into, email privacy@aptitudearena.example.

Some of our providers - for the database, hosting, payments, messaging and AI - keep data on servers outside India. The DPDP Act allows this, except for countries the government has blocked, and our contracts require each provider to protect the data and use it only as we tell them.

A large share of exam aspirants are school students under 18, so we treat data from an under-18 user as a child's data under the DPDP Act.

• An account for someone under 18 should be set up and supervised by a parent or guardian, who gives consent on the child's behalf.
• We do not track or profile children for advertising, and we do not show targeted ads to anyone.
• A parent or guardian can ask to see, correct or delete their child's data, or take back consent, by emailing privacy@aptitudearena.example. We may ask for proof of the relationship first.
• If we find we have used a child's data without the consent we needed, we delete it straight away.

We will update this policy as the Platform, our providers or the law change. The current version always sits on this page with its "last updated" date. If a change really affects how we use your data, we will tell you in the app or by email, and ask for your consent again where the law requires it.

For anything about this policy, or to use one of the rights in section 11, get in touch with:

We will confirm we have got your request within 24 hours and give you a proper answer within 15 days, sooner if the law says so. If you are not happy with our answer, you can take it to the Data Protection Board of India.