Privacy Policy

What we collect

Roughworks is free to browse without an account. If you only use the public question bank and papers, we primarily collect anonymous usage analytics via Google Analytics (GA4) — pages visited, time spent, and general location (country/city). This data is aggregated and is not intended to identify you personally.

Accounts and sign-in (optional)

If you choose to create an account to use dashboard features (timed mock exams, saved progress, bookmarks, mock analytics, and practice sets), we use Supabase Auth to handle authentication. Sign-in is via Google OAuth. Google shares with Roughworks the profile information you consent to at sign-in (typically your name, email address, and profile picture URL as provided by Google). Roughworks cannot access your Gmail inbox, Google Drive, Google Photos, contacts, Google password, or any Google account data you did not authorize.

We store a profile record in our Supabase database when you complete onboarding or update settings — for example display name, username, optional phone number, and your target exam preferences. Phone is optional and only used for reminders or support if you provide it.

When you are signed in, we store learning activity in our database so the dashboard can show your progress — question attempts (including selected answers and correctness), timed mock session summaries and analytics, practice set results, bookmarks, and related timestamps. This data is tied to your account, is used to operate Roughworks, and is not sold to advertisers or data brokers.

When you register for a scheduled mock, we also collect the candidate details needed to operate that event, such as your full name, contact details, date of birth, Class XII passing year, home state, self-reported UCEED reservation category, and PwD status. Category and PwD status are kept in private registration records; they are not displayed on your public profile and Roughworks does not use them to certify official UCEED eligibility.

Your registration email address is the verified email connected to your Roughworks account and cannot be replaced with a different address in the event-registration form.

To request account deletion or removal of your data, email bhargab@roughworks.in.

Scheduled mock access

A confirmed registration is assigned a unique roll number. For the UCEED 2027 All India Mock, you must first sign in to the registered Roughworks account. The service then supplies your roll number and asks you to enter your date of birth in DDMMYYYY format as an additional exam-entry check.

The date-of-birth check happens on the server against the private registration record. After successful verification, we set a signed, HttpOnly, event-specific access cookie that expires when the event upload window closes. The cookie does not contain your date of birth.

Payments and transaction records

Razorpay processes event payments. Roughworks stores the records required to verify, reconcile, support, and refund transactions, including order and payment identifiers, amount, currency, payment status, timestamps, pass type, and provider mode. Provider webhook records may also include payment-method metadata such as a UPI identifier. We do not receive or store your UPI PIN, card PIN, OTP, or banking password.

Payment information for a Friend Pass belongs to the purchaser. The companion claimant does not receive the purchaser's payment instrument details.

Confirmation emails and admit cards

After registration is confirmed, we may send a transactional email through Amazon Simple Email Service. The email can include a personalized admit-card PDF containing your name, roll number, date of birth, category, mobile number, account email, Roughworks profile ID, Class XII passing year, pass details, payment reference, payment method, amount, issue time, exam instructions, and a roll-number QR code and barcode.

For paid registrations, payment details appear only on the payer's admit card. A companion claimant's card identifies the seat as prepaid and does not disclose the purchaser's payment instrument. Admit cards contain personal information and should not be posted publicly or forwarded to others.

What Roughworks does not access

Signing in with Google does not give Roughworks access to your Gmail inbox, Google Drive, Google Photos, contacts, Google password, or any Google account data you did not authorize. Google sign-in is used only to authenticate your account and receive the basic profile information you consent to share.

Community sketch gallery (optional)

On drawing-prompt pages, signed-in users may optionally upload a sketch to the public community gallery. When you do this, the image you upload and any optional description you add become publicly visible on the site. By default, we show your Roughworks display name or username with the sketch; if you choose Make me anonymous, your name and username are not shown publicly. Community sketches are stored in AWS S3.

Submission to the gallery is always opt-in and you can request removal of your submission at any time by emailing bhargab@roughworks.in.

Private uploads and mock submissions

If you upload sketches for review, premium mocks, or similar account features, those files are stored in AWS S3 and linked to your Roughworks account so the relevant feature can work. These uploads are not shown in the public community gallery unless you explicitly submit them there.

Roughworks administrators or reviewers may access private uploads only when needed to provide review, support, moderation, security, or abuse-prevention functions.

How we handle your data

Account, learning, and upload data is kept within the service infrastructure used to operate Roughworks, including Supabase, AWS S3, Amazon Simple Email Service, and Vercel. We do not sell user data, learning activity, uploaded files, or account information to advertisers, data brokers, or third parties, and Roughworks will never sell or leak user data.

We use established infrastructure providers and access controls, including Supabase Row Level Security where applicable, to help protect account-level data. No online service can honestly promise that incidents are impossible, but Roughworks treats preventing unauthorized access or leaks as a core responsibility.

Retention and deletion

We retain account, registration, payment, examination, evaluation, result, notification, and audit records for as long as reasonably necessary to deliver the event, resolve disputes and refunds, protect examination integrity, meet legal or accounting obligations, and maintain accurate results. Private Part B files may be removed under the event's storage-cleanup process after they are no longer required.

You may request deletion by contacting us. Some records may need to be retained where deletion would conflict with legal, financial, fraud-prevention, security, or examination-integrity obligations.

Your browser storage

When you attempt questions in paper mode, your progress (which questions you answered and whether they were correct) is saved locally in your browser's localStorage. This data never leaves your device and is not sent to any server. We also store a small key (rw-cookie-dismissed) to remember that you have acknowledged this cookie notice. You can clear all of this at any time by clearing your browser storage.

When you are signed in, Supabase Auth persists your session in the browser via localStorage. Signing out clears the session from the app's perspective; you can also clear site data in your browser settings.

During a scheduled mock, successful roll-number and date-of-birth verification sets a short-lived, signed, HttpOnly cookie. It is scoped to that event's API and expires when the upload window closes.

Third-party services

We use Google Analytics (GA4) to collect anonymous usage data, and Supabase for authentication, user accounts, and dashboard data you generate while signed in. We use AWS S3 for uploaded files and sketch images, and Vercel for hosting. We use Amazon Simple Email Service to deliver transactional messages and admit cards. The admit-card renderer may send only the assigned roll number to QR Server to create the QR image. If you make a payment, payment processing is handled by Razorpay. Roughworks stores limited transaction and payment-method metadata as described above, but does not store your card PIN, UPI PIN, OTP, or banking password. Google may set cookies in your browser as part of analytics. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on.

WhatsApp community

Joining the Roughworks WhatsApp community is optional and opens a service operated by WhatsApp. Your WhatsApp profile information and phone number may be visible to WhatsApp and, depending on the group settings, to other members. WhatsApp's own terms and privacy policy apply to your participation.

Cookies

We do not set Roughworks-specific first-party cookies for anonymous browsing. We use browser localStorage (not cookies) to remember paper-mode progress and your cookie notice acknowledgement. Google Analytics may set its own cookies to distinguish users and sessions. Supabase Auth uses browser storage to persist your signed-in session.

Changes to this policy

If we make significant changes to this policy, we will update the date at the top of this page. Continued use of the site after any changes constitutes acceptance.

Contact

Questions, data requests, or responsible security disclosures? Email us at bhargab@roughworks.in.