PrepKar, by Compete India · version 2026-09-21 · last updated 21 September 2026
Privacy notice
This is the whole of what PrepKar keeps about you, written for students rather than lawyers. Everything below is a real table in our database — the same list your data export is built from and the same list account deletion erases.
1. Who we are
PrepKar is built and run by Swathi Ganti, Visakhapatnam, India. We are the data fiduciary for everything on this page. Write to support@prepkar.in for anything about your data; the grievance officer is named in section 8.
2. What we store, and why
One row per real thing. The right-hand column names the table so you can find it in your export.
| What | Why | Table |
|---|---|---|
| Your email address | To sign you in and to send you sign-in and account codes. It is the only identifier we require. | user |
| Your name and profile picture, if you give them | To greet you. If you sign in with Google, Google supplies both; you can leave them blank otherwise. | user, user_ext |
| Your exam choice, target exam date and, if you enter it, year of birth | To pace your plan and count down to the exam. We never ask for a full date of birth. | user_ext |
| Your answers | Which question, what you chose or typed, whether it was right, how long you took, and whether you knew it, eliminated or guessed. This is the raw material of every mastery estimate. | answer_event, attempt_answer |
| Your test attempts and reports | The set of questions, the clock, your score and the report we wrote for it. | attempt, daily_quiz_attempt |
| Your mastery estimates | A per-subject and per-topic estimate computed from your answers, and its weekly history for trends. | topic_mastery, topic_mastery_weekly |
| Your flashcard schedule | When each card is next due and how you rated it, so spaced repetition works. | card_state, card_review |
| Your bookmarks and notes | The questions you marked and anything you wrote against them. | bookmark, user_note |
| What you say to the app, as text | If you use Talk or answer out loud, the words your phone recognised are stored as text, along with what the app understood you to mean. We never receive, record or keep any audio. But your browser has to send the audio somewhere to turn it into text: on most Android phones Chrome streams it to Google's speech service, on servers outside India (section 4). Some newer phones can do it on the device instead, and we cannot promise which one yours will use. Only the resulting text reaches us. We read it to find the things we fail to understand, and we delete it after 90 days. | voice_utterance |
| Photographs of your handwritten Mains answers, and what we made of them | Only if you submit a Mains answer to be marked: the photograph of each page you took, a transcript of what the marker read on it, the bands and the feedback it wrote, and any line where you told us the transcript was wrong. A page is a picture of your handwriting and of everything on it, so if you wrote your name or a roll number at the top, that is in the picture too. To be marked, the photographs leave this server (section 4). They are deleted 30 days after the feedback is delivered, or 60 days after you submitted them if they were never marked (section 6), and you can delete them sooner from the copy itself; the transcript and the feedback stay with your account. We do not use them to train anything of ours, and we never publish them as anyone's model answer. A copy of each photograph is also kept in a storage service we rent, in India (section 4), so that a failure of our own server cannot lose it; it is deleted on the same clock, and within the hour of your deleting it. | mains_submission, mains_page, mains_page_s3, mains_evaluation, mains_transcript_correction |
| Your daily activity and streak | Questions, cards, tests and minutes per day — the streak calendar on Today. | user_daily_activity |
| Usage counters | How much of a daily or monthly allowance you have used. For a Mains answer there is also one row each time you send a copy to be marked, or appeal one: that it counted against your allowance for that month, and whether we gave it back to you — because the pages could not be read, because the page was blank, or because we never managed to mark it. | usage_counter, entitlement_override, mains_unit |
| Saarathi's notes for you | Where a written coaching opinion would be kept, and where the messages of a chat with Saarathi would be kept. Neither exists for you today (section 5), so on a real account both are empty. | ai_profile, coach_message |
| Problem reports about a question | Where a report that a question or explanation is wrong is kept until it is resolved. Today only our own reviewers can raise one, so no row here is yours. A button that lets you report a question yourself is written but not yet released; when it is, your reports are kept here and are yours to export and delete like everything else. | error_report |
| Product events | Which screens you opened and which actions you took — no free text, no addresses — kept 90 days, then deleted. Daily totals survive as counts only. | event |
| Your consent record | That you confirmed you are 18 or older and accepted the terms, which version, and when. | consent |
| Sign-in sessions | For each signed-in device: a session token, the IP address and browser identifier it was created from, until you sign out or it expires after 30 days. | session, account |
| A record that we emailed you | Every email we send — a sign-in code, a verification code, an account-deletion code — is logged: who it went to, when, what kind of message it was, its subject in a fixed form that never carries a sign-in code, and whether it was sent, refused or failed. If it failed or was refused we log a short reason code; if it was sent we log our email provider's own reference for it. We never store the message itself. Kept 90 days. | mail_log |
| Plan and purchase records, if any | Your plan, any order and any waitlist entry. There is nothing to buy today (section 6). | subscription, payment_order, waitlist |
Cookies and browser storage. One cookie keeps you signed in. Your browser also remembers a couple of preferences for itself (whether the navigation panel is collapsed, your theme); those never leave your device. There are no advertising or tracking cookies.
Web server logs. The server that answers every request writes one line per request: your IP address, the time, the method and path, the response status and size, how long it took, and the browser identifier your browser sends. Cookies and sign-in headers are stripped before the line is written, and no sign-in code, password or mail body ever reaches a log. Those lines are kept 14 days and then deleted. They are how we find errors and abuse. They are not in your export, because they record requests to the server rather than anything about your account.
3. What we never do
- No advertising, anywhere in the product.
- No sale of personal data, and no sharing with data brokers.
- No third-party analytics kit. The counters we keep are our own rows in our own database, listed above.
- No profiling for anything other than your own preparation: the mastery estimates exist to choose your next question, nothing else.
4. Who else sees anything
Six parties at most, each for one reason — the fourth only if you choose to speak to the app, and the fifth and sixth only if you submit a handwritten Mains answer to be marked. The fifth is an AI provider; section 5 says exactly what it is given and what it is not. The sixth only holds a copy of the photographs.
- Google — only if you choose Continue with Google, and only your email, name and profile picture, to prove the address is yours. Google's own privacy policy applies to that step.
- Our email provider — your address and the message, to deliver sign-in, verification and account-deletion codes.
- Google Fonts — every page asks your browser to fetch three typefaces: the stylesheet from fonts.googleapis.com and the font files themselves from fonts.gstatic.com. Both requests disclose your IP address to Google, as loading any web font does. Nothing about your account travels with either.
- Google's speech service — only if you use Talk or answer a question out loud. To turn speech into text, your browser sends the audio it captured to Google, on servers outside India. We never receive that audio and never store it; what reaches us is the text, which section 2 describes. Newer Android phones can do the same work on the device without sending anything, but we cannot promise yours will.
- Anthropic — only if you submit a Mains answer to be marked. The photographs of your pages are sent to Anthropic's model, Claude, which reads the handwriting, transcribes it and writes the feedback; its servers are outside India. Nothing from your account travels with them — not your name, your email address or your account id — but the page is a picture of everything you wrote on it. Anthropic's own privacy policy applies to that step. The queue is worked in batches from a computer of ours in India, which holds a copy of the pages only for as long as that run takes and deletes it afterwards.
- Amazon Web Services — only if you submit a Mains answer to be marked. A copy of the photographs of your pages is stored in its Mumbai data centre, in India, under a key that carries no name or address. Amazon does not read them; it stores them.
Our own staff. An administrator (today, one account — the founder's) can open the photographs of your pages and the marking, to check the marker's work and to answer a complaint. A subject-matter expert can read the transcript and the marking but not the photographs, and can delete or change nothing. Every such access is by a named staff account and every change is logged.
Our database lives on a server we rent in India. Apart from the two cases above that you choose — speaking to the app, and submitting a Mains answer to be marked — we do not transfer your data anywhere else.
5. Saarathi, the AI coach
Everything Saarathi shows you today is worked out on our own server, by our own code, from your own answers. The mastery percentages, the areas where marks are leaking, the memory forecast, the streak and the pace are arithmetic over the rows in section 2. No model is involved in any of that, and nothing about you is sent to anyone to produce it. They are still only estimates from the answers you have given so far, so they can be wrong about you — treat them as a study partner's opinion, not a verdict.
The one thing on this site a model does do is mark a handwritten Mains answer, and only when you submit one. Section 4 names the provider. It is given the photographs of your pages and the question you answered, and nothing else — no digest of your practice record, and nothing from your account — though the page itself shows whatever you wrote on it. What comes back is a transcript of what it could read, bands rather than marks, and feedback anchored to lines of that transcript; every line is shown to you so you can say where it misread you. You are asked for a separate consent the first time, and the photographs are deleted on the clock in section 6.
Two more parts of Saarathi are planned, and both would need a large language model run by a third-party AI provider, so neither is running. A chat you could ask questions in is written but switched off. A written opinion on your preparation, refreshed in batches, is not built at all yet. If we turn either on, the model would be given a digest of your practice record — your target exam, how many days you have been active, questions attempted and answered correctly, and your weakest topics — and, for the chat, what you type to it and the recent turns of that conversation. It would not be given your name, email address or account id, and we will not use a provider that trains on it. Before that day we will name the provider on this page, change the version and date at the top, and tell you in the app (section 10).
Anything Saarathi writes for you is in your export and goes when you delete your account. If something it says is wrong, unhelpful or inappropriate, tell us at support@prepkar.in and we will look at it and at the numbers behind it.
6. How long we keep it
Until you delete your account, with five exceptions:
- Product events and the record that we emailed you (section 2) are deleted after 90 days by a nightly job, whether or not you are still with us.
- Photographs of your Mains answer pages (section 2) are deleted by a nightly job 30 days after the feedback on them is delivered — or 60 days after you submitted them, if they were never marked — whether or not you are still with us. The transcript and the feedback are not on that clock: they stay until you delete your account. You can delete the photographs sooner from the copy itself. The copy in the storage service goes on the same clock, and within the hour when you delete the photographs yourself.
- Purchase records, if any, are kept for tax law but detached from you: after deletion the record no longer names an account. There is nothing to buy today, so for most students this row is empty.
- Staff audit entries — a record that an administrator edited a question or resolved a report — are about the administrator's action, not about you, and are kept.
- Web server logs (section 2) are kept 14 days and then deleted, whether or not you are still with us.
Audio is never retained, by us or for us. We hold no recording of your voice at any point, and there is nothing of the kind to export or delete. What we hold is the text (section 2), on the same 90-day clock as product events.
7. Deleting everything
Two routes, both yours, neither needing our help. Signed in, open your profile and use Delete your account. Not signed in, or the app is long uninstalled: open /account/delete in any browser, confirm your address with a code we email you, and the account is erased on the spot. Both remove every table in section 2 that names you, delete the photographs of any Mains pages from our disk and, within the hour, their copy in the storage service, sign out every device, and cannot be undone.
8. Your rights, and how to complain
- Access — /me/export gives you a machine-readable copy of everything above, on demand, while signed in.
- Correction — your name, exam, exam date and year of birth are editable on your profile; for anything else, write to us.
- Erasure — section 7.
- Withdrawing consent — deleting your account withdraws it in full; the service cannot run without an account, so there is no narrower switch for the account itself. Marking a Mains answer asks for its own consent, the first time you submit one; you withdraw that by not submitting another, and you can delete the photographs from any copy you have already sent.
Under the Digital Personal Data Protection Act, 2023, our grievance officer is Swathi Ganti, grievance@prepkar.in. We reply within 30 days. If you are not satisfied with the answer, you may escalate the grievance to the Data Protection Board of India.
9. Age
PrepKar is for users aged 18 and over — the sign-in page says so, and you confirm it when you create an account. We do not knowingly collect data from anyone younger; if you believe we have, tell us and we will delete it.
10. Changes
The version and date at the top change whenever this notice changes materially, and your consent record names the version you accepted. We will tell you in the app before a change that affects what we collect or who sees it.
See also the terms of use and how to reach us.