Privacy Policy & DPDP Act 2023 Notice

CivilsMock was built to provide honest diagnostic readiness assessment for UPSC Civil Services aspirants. We adhere strictly to the principle of purpose limitation:

• We collect only the bare minimum data required to evaluate your syllabus coverage, calculate your 0–100 Readiness Score, and build your prioritized weekly action plan.
• We never sell, lease, or monetize your personal data or test performance to coaching institutes, publishers, or third-party advertisers.
• We do not run behavioral advertising trackers or dark pattern marketing popups.

Under Section 4 and 5 of the DPDP Act 2023, notice is hereby given of the categories of data processed:

• Authentication Data: Email address and authentication tokens via Supabase Auth.
• Diagnostic Academic Data: Attempt timestamps, selected MCQ options, subjective answer text (for Mains self-evaluation), self-ratings per subject, and error tags.
• Study Profile Parameters: Target exam year, attempt count, daily study hours, working professional status, and optional subject.
• Data Storage Jurisdiction: All database storage (Supabase PostgreSQL) is strictly hosted in **Mumbai, India (`ap-south-1`)**, and serverless functions execute in **Mumbai (`bom1`)** to maintain full Indian data sovereignty and minimize latency.

You have full autonomy over your data:

• Right to Access & Portability: You can download a complete JSON export of all your diagnostic tests, responses, and topic stats from your account settings.
• Right to Erasure (Hard Deletion): When you choose to delete your account, our system initiates a server-only cascade deletion that purges all database records and calls the Supabase Admin API to permanently delete your `auth.users` authentication identity.
• Right of Correction: You can modify your self-ratings, attempt stage, and optional subject at any time from the Onboarding Profile page.

We implement stringent technical security controls including PostgreSQL Row Level Security (RLS) on all public tables, encrypted SSL/TLS data transmission in transit, AES-256 encryption at rest, and strict answer masking during active test sessions.