Privacy Policy

What we collect

Roughworks is free to browse without an account. If you only use the public question bank and papers, we primarily collect anonymous usage analytics via Google Analytics (GA4) — pages visited, time spent, and general location (country/city). This data is aggregated and is not intended to identify you personally.

Accounts and sign-in (optional)

If you choose to create an account to use dashboard features (timed mock exams, saved progress, bookmarks, mock analytics, and practice sets), we use Supabase Auth to handle authentication. Sign-in is via Google OAuth. Google shares with Roughworks the profile information you consent to at sign-in (typically your name, email address, and profile picture URL as provided by Google). Roughworks cannot access your Gmail inbox, Google Drive, Google Photos, contacts, Google password, or any Google account data you did not authorize.

We store a profile record in our Supabase database when you complete onboarding or update settings — for example display name, username, optional phone number, and your target exam preferences. Phone is optional and only used for reminders or support if you provide it.

When you are signed in, we store learning activity in our database so the dashboard can show your progress — question attempts (including selected answers and correctness), timed mock session summaries and analytics, practice set results, bookmarks, and related timestamps. This data is tied to your account, is used to operate Roughworks, and is not sold to advertisers or data brokers.

To request account deletion or removal of your data, email bhargab@roughworks.in.

What Roughworks does not access

Signing in with Google does not give Roughworks access to your Gmail inbox, Google Drive, Google Photos, contacts, Google password, or any Google account data you did not authorize. Google sign-in is used only to authenticate your account and receive the basic profile information you consent to share.

Community sketch gallery (optional)

On drawing-prompt pages, signed-in users may optionally upload a sketch to the public community gallery. When you do this, the image you upload and any optional description you add become publicly visible on the site. By default, we show your Roughworks display name or username with the sketch; if you choose Make me anonymous, your name and username are not shown publicly. Community sketches are stored in AWS S3.

Submission to the gallery is always opt-in and you can request removal of your submission at any time by emailing bhargab@roughworks.in.

Private uploads and mock submissions

If you upload sketches for review, premium mocks, or similar account features, those files are stored in AWS S3 and linked to your Roughworks account so the relevant feature can work. These uploads are not shown in the public community gallery unless you explicitly submit them there.

Roughworks administrators or reviewers may access private uploads only when needed to provide review, support, moderation, security, or abuse-prevention functions.

How we handle your data

Account, learning, and upload data is kept within the service infrastructure used to operate Roughworks, including Supabase, AWS S3, and Vercel. We do not sell user data, learning activity, uploaded files, or account information to advertisers, data brokers, or third parties, and Roughworks will never sell or leak user data.

We use established infrastructure providers and access controls, including Supabase Row Level Security where applicable, to help protect account-level data. No online service can honestly promise that incidents are impossible, but Roughworks treats preventing unauthorized access or leaks as a core responsibility.

Your browser storage

When you attempt questions in paper mode, your progress (which questions you answered and whether they were correct) is saved locally in your browser's localStorage. This data never leaves your device and is not sent to any server. We also store a small key (rw-cookie-dismissed) to remember that you have acknowledged this cookie notice. You can clear all of this at any time by clearing your browser storage.

When you are signed in, Supabase Auth persists your session in the browser via localStorage. Signing out clears the session from the app's perspective; you can also clear site data in your browser settings.

Third-party services

We use Google Analytics (GA4) to collect anonymous usage data, and Supabase for authentication, user accounts, and dashboard data you generate while signed in. We use AWS S3 for uploaded files and sketch images, and Vercel for hosting. If you make a payment, payment processing is handled by Razorpay; Roughworks does not store your card, UPI, or banking credentials. Google may set cookies in your browser as part of analytics. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on.

Cookies

We do not set Roughworks-specific first-party cookies for anonymous browsing. We use browser localStorage (not cookies) to remember paper-mode progress and your cookie notice acknowledgement. Google Analytics may set its own cookies to distinguish users and sessions. Supabase Auth uses browser storage to persist your signed-in session.

Changes to this policy

If we make significant changes to this policy, we will update the date at the top of this page. Continued use of the site after any changes constitutes acceptance.

Contact

Questions, data requests, or responsible security disclosures? Email us at bhargab@roughworks.in.