TL;DR
- Roughworks is built to be safe, private, and secure.
- Google sign-in only shares the basic profile information you consent to share.
- Roughworks cannot access your Gmail, Drive, Google Photos, contacts, Google password, or any Google data you did not authorize.
- User data stays within the servers and service infrastructure used to operate Roughworks. It is not sold, and Roughworks will never sell or leak user data.
- If anyone has a real security concern, they should share reproducible technical details through responsible disclosure.
Recently, unsupported claims have circulated in some online communities regarding Roughworks and how it was built. These claims mislead aspirants and distract from the actual product, its architecture, and the work that has gone into building it.
Some claims suggest Roughworks was built with a simple prompt “make a website” in ChatGPT. Reality is, I’ve spent months and over 1,50,000 Rs on the development and hundreds of millions of tokens. Had it not been sponsored by Y Combinator, I’d have to spend Lakhs of rupees from my own pocket. Anyone who’s even remotely knowledgeable and updated on AI knows that all the frontier models perform exceptionally well to generate high quality code that’s safe and secure.
I’ve used the most advanced top quality frontier AI models (Claude Opus 4.8, GPT 5.5, Deepseek V4 Pro [the best currently available models], all on xhigh intelligence). All features have been double and triple checked for security and any breakpoints.
- Authentication: Google OAuth through Supabase Auth for secure Google sign-in. Roughworks only receives the basic profile information you consent to share through Google sign-in, such as your email address, name, and profile picture. This data stays within the servers and service infrastructure used to operate Roughworks. It is not sold, and Roughworks will never sell or leak user data. Your Google account is safe.
- Storage: AWS S3 for highly secure file storage.
- Database: Postgres with Row Level Security (RLS) on Supabase, helping enforce account-level data isolation.
- Hosting: Vercel Pro for fast, secure, and reliable hosting.
What Roughworks Does Not Access
- Your Gmail inbox
- Your Google Drive
- Your Google Photos
- Your Google contacts
- Your Google password
- Any Google account data you did not authorize
As a solo builder going up against larger teams, I believe the product should speak for itself. Students deserve to judge platforms based on usefulness, transparency, and results, not unsupported rumours.
In the context of web development, using AI tools (like LLMs or coding assistants) to build features is a standard industry practice. It doesn't inherently make a platform "unsafe."
My priority is (and always will be) the students. I will never discourage you from using any reliable free resource available online. I highly encourage you to use everything freely available to maximize your prep.
Whenever you encounter baseless rumors online, I urge you to look at the source, the evidence provided, and whether the claim is backed by reproducible technical detail. Please also ask whether there may be a personal vendetta or financial motive behind it. This statement is to assure aspirants that Roughworks is and will always be privacy-and-security-first.
The Roughworks privacy policy is available at roughworks.in/privacy.
If anyone believes they have found a real security issue, I request them to share reproducible technical details with me at bhargab@roughworks.in so it can be investigated and fixed responsibly.
Keep pushing forward with your prep, and feel free to reach out to me directly if you have any questions about our architecture or security. I will not respond to rumours individually, but if there is ever a verified security issue, users will be informed transparently.