Privacy Policy

1. Summary

2. Who we are

RTO Exam Prep is operated by Saurabh Kumar ("we", "us"). We decide how and why your personal information is processed in the app. Under India's Digital Personal Data Protection Act, 2023 this makes us the "data fiduciary".

RTO Exam Prep is an independent study app. It is not a government service and is not affiliated with any Regional Transport Office, state transport department, the Ministry of Road Transport and Highways or Parivahan. We do not book tests or issue licences, and we receive no information from those bodies.

3. Information we collect

We collect only what the app needs to work. Specifically:

• Account information from Google: see Google Sign-In below.
• Your preferences: the state you're preparing for, your preferred language, and when you finished setting up the app.
• Your learning activity: the mock tests you start and finish (the questions you were given, your answers, skipped and timed-out questions, timings, score and pass or fail result); your practice sessions and answers; your progress by question and topic; questions you answered wrongly and whether you've reviewed them; and questions you bookmark.
• Learning events: a record of key actions, such as signing up, finishing setup, starting or completing a practice session or mock test, answering or skipping a question, and reviewing a mistake. Each event is stored with your internal account ID, your state and language and the item it refers to (for example the question or test). These events do not contain your name, email address, IP address or device information.
• Account and session records: when your account was created, when you last signed in and were last active, and a record of each sign-in session (a protected form of your sign-in token, its expiry, and the fixed label "Android app"; we do not record your device model or identifiers).
• Technical information: when the app talks to our servers, your IP address is processed to deliver the response and to limit abusive traffic, and our servers write request logs (which can include the IP address, the address of the request, its result and timing) to Google Cloud Logging for security and troubleshooting.

What we don't collect. The app does not ask for or collect your location, contacts, photos, camera, microphone, phone number, SMS, call logs, payment details or government ID numbers (such as Aadhaar or your licence application number). It does not read other apps or files on your phone.

4. Google Sign-In

RTO Exam Prep uses Google Sign-In as its only way to sign in. When you choose a Google account, Google confirms your identity to the app and our server verifies that confirmation. From it we keep:

• your Google account's unique ID (used to recognise you when you sign in again);
• your email address, only when Google reports it as verified;
• your name as shown on your Google account; and
• the web address of your Google profile photo.

We never see or store your Google password. We don't request access to your Gmail, Google Drive, contacts, calendar or any other Google data. Your use of Google Sign-In is also covered by Google's Privacy Policy.

5. Information stored on your device

• Sign-in token: a long-lived token that keeps you signed in is stored in Android's secure storage, which is protected by the Android Keystore and excluded from Android's automatic cloud backup. The short-lived token used for each request is kept only in memory.
• App settings: whether you've seen the introduction, the app language you picked, and the state and language you chose before signing in (until they are saved to your account).
• Temporary cache: while the app is open it keeps recently loaded screens in memory so it feels fast. This is not saved to storage.

Signing out removes the sign-in token from your device. Uninstalling the app removes everything the app stored on your device, but it does not delete your account or learning history on our servers. To do that, see Deleting your data.

6. Information sent to our servers

Yes, the app sends information to our backend. Your account, preferences, learning activity and learning events (Section 3) are stored on our servers so that your progress is saved, mock tests are timed and scored fairly on the server, and you can pick up where you left off. All communication between the app and our servers uses encrypted HTTPS connections.

Our backend API is hosted on Google Cloud Run in Delhi, India (asia-south2). Our PostgreSQL database is hosted on Supabase in Mumbai, India (ap-south-1).

7. Study content

Questions, answer explanations and road sign images are loaded from our servers when you need them. They are the same for every learner in a state and language and contain no personal information. Question and road sign images are stored in Cloudflare R2 and delivered over HTTPS from media.rtoexamprep.app. The app does not currently store study content for offline use.

8. How we use information

• to create your account, sign you in and keep you signed in;
• to show questions for your state in your chosen language;
• to run practice sessions and timed mock tests, score them and show your results;
• to show your history, progress, weak topics, mistakes and bookmarks;
• to understand, in aggregate, how the app is used (for example how many mock tests are completed and pass rates by state) so we can improve the questions and the app;
• to keep the service secure, prevent abuse and fix problems; and
• to reply when you contact us, and to meet our legal obligations.

We do not use your information for advertising, we do not build advertising profiles, and we do not make automated decisions about you that have legal or similarly significant effects.

We process your information on the basis of your consent, which you give when you sign in and use the app, and which you can withdraw at any time by asking us to delete your account.

9. Analytics, advertising and third-party tracking

• Advertising: none. The app contains no ad networks and does not access your device's advertising ID.
• Third-party analytics and tracking: none. The app includes no third-party analytics, attribution, crash-reporting or tracking software.
• Our own usage records: we keep the learning events described in Section 3 on our own servers. Our content management system shows them only as totals and rates (it has no screen for looking up an individual learner). They are not shared with or sold to anyone.
• This website: uses no cookies, analytics or tracking scripts. Fonts are served from this site itself. Our hosting provider may process your IP address to deliver pages and protect against attacks.

10. Sharing and service providers

We do not sell, rent or trade your personal information. We share it only:

• With service providers that run the app for us. They process information on our instructions and only to provide their service:
  • Google (Google Sign-In): confirms your identity when you sign in. See Google Sign-In.
  • Google Cloud: Cloud Run hosts our backend API in Delhi, India (asia-south2) and processes every request the app makes; Cloud Logging stores our application logs.
  • Supabase: hosts our PostgreSQL database in Mumbai, India (ap-south-1), which stores your account, preferences, learning activity and learning events. We use Supabase only as a database.
  • Cloudflare (R2): stores and delivers question and road sign images. These images are study content, not files uploaded by learners, and contain no personal information. As with any web request, Cloudflare receives your device's IP address when the app loads an image.
• When required by law: to comply with a valid legal request, or to protect the rights, safety and security of our users, the public or the app.
• In a business transfer: if the app is transferred to a new operator, your information may move with it, under this policy or one at least as protective, and we will tell you beforehand.

11. How long we keep information

• Account and learning data: for as long as your account exists, or until you ask us to delete it (see Deleting your data). We don't delete inactive accounts automatically.
• Sign-in sessions: expire automatically.
• Backups: copies of your information in our secure backups may remain for a limited time after it is deleted from our live systems, including after a deletion request. Backups are kept only as long as necessary for backup, recovery, security and legal purposes, and are then deleted or overwritten.
• Server logs (Google Cloud Logging): technical and security logs are kept only as long as necessary for operational, security and legal purposes, and are then deleted.
• Support emails: kept as long as needed to resolve your request and any follow-up.

12. Deleting your data

To ask us to delete your account and the personal data linked to it, email saurabhuxx@gmail.com from the email address on your Google account. Full instructions are on the Data Deletion page.

We may keep some information where we are legally required to, or where it is needed for legitimate security and operational purposes. Copies in backups and logs are removed as described in How long we keep information.

13. Security

We take reasonable technical and organisational measures to protect your information, including:

• encrypted HTTPS connections between the app and our servers;
• short-lived access tokens, sign-in tokens that are rotated on use and stored on our servers only in hashed form, and on-device storage in the Android Keystore-backed secure store;
• verification of every Google sign-in on our server;
• access to the content management system limited to authorised staff, with role-based permissions and an audit log of changes; and
• request rate limits and removal of passwords and tokens from server logs.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authorities as required by law.

14. Children's privacy

The app is intended for adults aged 18 and above. Users under 18 are not permitted to use the app. We do not knowingly collect personal information from anyone under 18.

The app does not currently ask for or verify your age.

If you believe someone under 18 has given us personal information, contact us at saurabhuxx@gmail.com and we will delete it.

15. Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you can:

• Access a summary of the personal information we hold about you and how we use it. Much of it is visible in the app itself (your profile, history, progress, mistakes and bookmarks).
• Correct it. You can change your state and language in the app. Your name, email and photo come from your Google account, so update them there.
• Erase it by asking us to delete your account (Section 12).
• Withdraw consent at any time by asking us to delete your account. This doesn't affect processing that happened before.
• Nominate another person to exercise these rights on your behalf if you die or become unable to.
• Raise a grievance with us. We will respond within the time required by law. If you are not satisfied, you may complain to the Data Protection Board of India.

To use any of these rights, email saurabhuxx@gmail.com. We may need to confirm that you own the account before acting on a request.

16. Changes to this policy

We may update this Privacy Policy from time to time, for example when the app or the law changes. When we make changes, we will publish the revised version on this page. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect. We encourage you to review this page periodically. The current version is always available at this address without signing in.

17. Contact us

For privacy questions, data requests or grievances:

• Privacy and grievances: saurabhuxx@gmail.com
• General support: saurabhuxx@gmail.com
• Operator: Saurabh Kumar