Privacy Policy

Last updated: October 3, 2026

1. Introduction

This Privacy Policy explains how UPSC Path collects, uses, shares, and safeguards your personal information when you use our website and services (the "Service"). For the purpose of this Policy, "we", "our", and "us" refer to UPSC Path. By using the Service, you agree to the practices described below.

2. Information We Collect

2.1 Information you provide

When you sign in or contact us, we collect:

  • Your name and email address (received via Google OAuth at sign-in)
  • Content you create on the Service — bookmarks, notes, syllabus progress, search queries
  • The contents of any messages or feedback you send to us

2.2 Information collected automatically

When you use the Service, we automatically collect:

  • IP address, browser type and version, operating system, and device type
  • Pages visited, time spent on pages, and click events
  • PDF viewer activity (which copies you opened, time on page, scroll depth)
  • Server-side logs of API requests and errors
  • What you search for on the Tracker Pro pages, with the filters and results shown, which Tracker Pro keeps to improve search

2.3 Device and security information

At sign-in, we generate and store a device fingerprint — a hashed signal derived from browser and device attributes. The fingerprint is used to enforce the browser limit described in our Terms of Service, and to detect anomalous or non-human activity for the purpose of account integrity (see Section 8).

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and improve the Service
  • Personalize your experience — for example, remembering your last-visited section and surfacing relevant PYQs
  • Understand which features matter and how the Service is used
  • Communicate with you about your account, support requests, and important updates
  • Detect, prevent, and respond to fraud, abuse, or security incidents
  • Comply with legal obligations

4. Cookies and Local Storage

We use cookies and similar technologies to:

  • Keep you signed in (authentication and refresh-token cookies — necessary for the Service to function)
  • Remember preferences such as your last-visited section
  • Measure usage via the analytics tools listed in Section 5

You can clear cookies through your browser settings, but doing so will sign you out and may break parts of the Service.

5. Third-Party Services and Sub-Processors

We rely on the following third-party services to operate the platform. Each receives only the data needed to perform its function and is bound by its own privacy policy and contractual obligations:

  • Google OAuth — authentication. Receives your email, name, and Google account identifier.
  • Google Analytics 4 — aggregate usage analytics. Receives IP address, page paths, and event data.
  • Google Ads / Google Tag Manager — conversion tracking for advertising campaigns. Receives page paths and conversion events.
  • PostHog — product analytics, feature flags, and session diagnostics. Receives a user identifier, IP, page paths, and event metadata.
  • Sentry — error tracking and diagnostics. Receives a user identifier, browser information, the URL where an error occurred, and a stack trace.
  • Railway — application and database hosting. All operational data (account records, content, logs) is stored here.
  • Google Cloud Storage — storage and delivery of topper PDF assets.

6. Data Retention

We retain personal information for as long as your account is active and for a reasonable period thereafter, or as required for legitimate operational purposes — including abuse detection, financial records, and legal compliance. Logs and event data may be retained longer in aggregated or anonymized form for analytics. You can request deletion of your account and personal data at any time as described in Section 9.

7. Data Security

We implement reasonable technical and organizational measures to protect your information — including encrypted transport (HTTPS), authentication-based access control, and secure credential storage. No system is perfectly secure, however, and we cannot guarantee absolute security.

8. Account Suspension and Abuse Detection

As described in our Terms of Service, we operate automated systems that monitor for abusive or non-human activity. When these systems flag an account, the account may be suspended automatically. Information collected for this purpose — including device fingerprints, IP addresses, and activity patterns — is processed under our legitimate interest in protecting the Service.

If you believe your account was suspended in error, you may submit an appeal by emailing [email protected].

9. Your Rights

Under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data:

  • Access — request a summary of the personal data we process about you
  • Correction and erasure — request that we correct inaccurate data or erase data that is no longer needed
  • Withdrawal of consent — withdraw your consent to processing where consent is the legal basis (this may affect your ability to use the Service)
  • Grievance redressal — raise a complaint about how your data is handled
  • Nomination — nominate another individual to exercise these rights on your behalf in case of incapacity

To exercise any of these rights or to raise a grievance, contact us at [email protected].

10. Children's Privacy

The Service is intended for adults preparing for the UPSC Civil Services Examination. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us at [email protected] and we will delete it.

11. International Data Transfers

The Service is hosted on Railway and Google Cloud Storage, which may store and process data on infrastructure located outside India. By using the Service, you consent to such transfers, subject to the protections required by applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated Policy.

13. Contact

For questions, requests, or grievances related to this Privacy Policy, email us at [email protected].