Privacy Policy
Last updated 7 October 2026
This policy explains what personal data crackin.co.in collects, why, and the choices you have. It is written for the Digital Personal Data Protection Act, 2023 and the IT Act, 2000. The data fiduciary is [OPERATOR NAME], [CITY, STATE].
What we collect
- Account — from your Google sign-in: your email address, name and profile picture.
- Practice activity — the questions you attempt, the options you choose, scores, time spent, bookmarks, notes progress, flashcard marks and sittings of mocks and daily sets.
- Things you send us — suggestions and messages, and our replies.
- Plans and payments — which plan you hold, and the Razorpay order and payment reference. Card, UPI and bank details are handled by Razorpay; we never see or store them.
- Technical — your IP address, used briefly to rate-limit sign-in and protect the site; anonymous page-view counts (Vercel Web Analytics, no cookies).
- On your device — an essential sign-in cookie, and browser storage for things like your last position in a chapter and unsaved answers. We use no advertising cookies.
Why we use it
- To run your account, save your progress and open the plans you hold.
- To show your analytics, and — only in aggregate, never by name — cohort averages and percentiles to other students.
- To show your display name and points on the leaderboard.
- To answer your suggestions, keep the site secure and fix problems.
We do not sell your data, and we do not use it for targeted advertising or behavioural tracking of children.
Students under 18
Many IPMAT aspirants are under 18. If you are, please use crackin with your parent or guardian’s consent; by letting you create an account they consent to the processing described here. A parent or guardian can write to [GRIEVANCE EMAIL] at any time to see or delete a minor’s data.
Who processes it for us
- Supabase — database and sign-in.
- Vercel — hosting and anonymous analytics.
- Upstash — short-lived rate-limit counters.
- Google — sign-in.
- Razorpay — payments.
These providers may store data on servers outside India, under their own security and privacy commitments.
How long we keep it
We keep your data while your account is active. If you ask us to delete your account, we delete your personal data within 30 days, except what the law requires us to keep (for example payment records).
Your rights
You can ask to access, correct or erase your data, withdraw consent, nominate someone to act for you, or raise a grievance. Write to [GRIEVANCE EMAIL]; we reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Grievance Officer
[GRIEVANCE OFFICER NAME], [GRIEVANCE EMAIL].
Changes
We will update the date at the top when this policy changes, and tell signed-in users about significant changes on the site.