Privacy Policy
Effective 4 October 2026
This policy explains what thekadamapp collects when you use it, why, who else can see it, and what you can make us do about it. It is written to be read, not to be survived.
thekadamapp (“we”, “the Service”) is operated by thekadamapp and is available at thekadamapp.in. For the purposes of India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the information described below, and you are the Data Principal.
1. What you give us
- Your name. Used to address you in the app. A first name is enough; we do not verify it.
- Your email address. Used to sign you in, to send account emails such as verification and password resets, and to reach you if something goes wrong with your account.
- Your password — or nothing, if you continue with Google. See section 4 — we never see your password and cannot recover it.
- If you continue with Google. Google tells us your name and email address, and that Google has confirmed the email is yours. We use them exactly as above. We do not receive your Google password, contacts, files or anything else, and we never post or act on your Google account.
2. What using the Service creates
This is the part that makes the product work, and it is the part most privacy policies are vague about, so here it is in full. When you take a mock test or a practice set we record:
- which questions you were shown, and in which test;
- the option you selected for each question, and whether it was correct;
- every option you selected before that one — if you changed your answer, we keep the sequence;
- how long you spent on each question and each section;
- which questions you marked for review, and which you left unanswered;
- when you started, when you submitted, and whether the attempt expired;
- your resulting marks, accuracy, and per-topic performance over time.
We keep this because it is the entire product. An app that only stores your score cannot tell you that you lost eleven marks changing correct answers to wrong ones, or that your accuracy in one topic collapses under time pressure. If you would rather that were not recorded, this is not the right service for you, and we would rather say so plainly than bury it.
3. What is collected automatically
- Session cookies. Strictly necessary — they keep you signed in. They are HTTP-only, meaning code running on the page cannot read them.
- Advertising measurement — only if you clicked one of our Google ads. If you reached thekadamapp by clicking our ad on Google, Google’s ad-measurement tag loads on the public page you landed on, and again once, just after you create an account. Its only purpose is to tell us whether our ads lead to sign-ups. It sets Google cookies (named
_gcl_…) and we set a cookie that holds only the value “1” to remember that you came from an ad, for 30 days. Google is told the public page address and that an account was created — never your name, email, answers, scores or results, and never the address of any page inside your account. If you did not arrive from our ad, the tag never loads. You can block it with any ad blocker, or manage Google ads at adssettings.google.com. - Visit counts. We count page visits with Vercel Web Analytics, which sets no cookies and does not identify you.
- Google Analytics. We use Google Analytics to see which kinds of page students use and where visitors come from. It sets Google cookies (named
_ga…) and tells Google which kind of page you are on — for example “a results page”, never which result or whose — along with your device type, the site that sent you, and the campaign tag in the link you followed. It never receives your name, email, answers, scores or results, and admin pages send it nothing. You can turn it off for this device with the switch below; it stops immediately and its cookies are removed. - Engineering entrance exams are never tracked. Many students preparing for MHT CET are under 18. Once you choose an engineering entrance exam, open one of its papers or its exam page, or your account is set to one, neither Google Analytics nor Google’s ad tag runs on that device again — and anything already started stops. We remember this with a cookie that holds only the value “1”, for one year.
- Server logs. Our hosting and database providers record IP addresses, browser and device type, and request timestamps as part of operating the Service and protecting it from abuse. We do not use these to build a profile of you.
4. Your password, or signing in with Google
Your password is never stored. It is converted by an algorithm called bcrypt into a one-way value from which the original cannot be recovered, and only that value is kept. Nobody — including us, including anyone who obtained a full copy of our database — can read your password. If you forget it, the only route is a reset. There is no route by which we can tell you what it was.
If you choose “Continue with Google”, you have no password with us at all. Google signs you in and tells us only three things: your name, your email address, and that Google has confirmed the email is yours (the “openid”, “email” and “profile” permissions). We do not ask Google for, and do not receive, your Google password, contacts, files, calendar, location or anything else. The “Sign in with Google” button is drawn by Google’s own sign-in script, which loads only on our sign-in and account pages and only to sign you in.
- How we use it: only to create and sign in to your thekadamapp account and to address you by name — exactly as for an account made with email.
- Where it is kept: with the rest of your account, in our database (Pune region), under the same protections as section 11.
- Who it is shared with: no one. It is never sold, never used for advertising, and never used to train any AI model.
- Removing it: write to thekadamapp@gmail.com and we delete your account and everything in it. You can also remove thekadamapp’s access at any time from your Google Account → Security → Third-party connections.
thekadamapp’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. What we do not collect
- No payment card, bank, or UPI details. The Service is free and takes no payments.
- No government identity numbers. We will never ask for Aadhaar, PAN, or a roll number.
- No location data, contacts, photos, files, microphone, or camera access.
- No caste, religion, health, or any other special-category information.
- No advertising identifiers, and no third-party trackers or pixels other than the Google tools described in section 3 — which are only ever told the kind of page you are on, never your data, and Google Analytics can be switched off in one tap.
6. Why we use it
- To create and secure your account, and to sign you in.
- To deliver tests, mark them, and show you your results and analysis.
- To track your improvement across attempts, which is the point of the Service.
- To send account emails. We do not send marketing email.
- To keep the Service working and to investigate abuse or technical faults.
We do not sell your data. We do not share it with advertisers, coaching institutes, recruiters, or data brokers. There is no commercial arrangement under which anyone outside the providers listed below receives it.
7. Who else processes it
We use three service providers, each doing one job. They process your data on our instructions and are not permitted to use it for their own purposes.
- Supabase — database and authentication. Holds your account and all test data. Our database is hosted in the Pune region.
- Vercel — application hosting. Serves the pages and processes requests.
- Brevo — email delivery. Receives your email address in order to send verification and password-reset messages. Nothing else.
Google — only as described in section 3: Google Analytics (unless you switch it off), and ad measurement if you arrived from our ad. Google handles that information under its own privacy policy (policies.google.com/privacy). It receives no account or test data from us.
These providers operate infrastructure outside India, so your data may be stored or processed abroad. We rely on their contractual data-protection commitments for that transfer.
8. How long we keep it
- Your account and test history are kept for as long as your account exists — improvement over months is only visible if the history survives.
- If you delete your account, your profile, attempts, answers and results are deleted within 30 days.
- An account with no sign-in for 24 months may be deleted, after an email warning to the address on file.
- Server logs are retained on our providers’ standard schedules, typically under 90 days.
9. Your rights
Under the Digital Personal Data Protection Act, 2023, you may:
- ask what personal data we hold about you and how it is processed;
- have inaccurate or incomplete data corrected or completed;
- have your data erased, by deleting your account or by asking us;
- withdraw consent — note that withdrawing consent to hold your account data means the account cannot continue;
- nominate another person to exercise these rights if you are unable to;
- raise a grievance with us, and escalate to the Data Protection Board of India if we do not resolve it.
Write to thekadamapp@gmail.com from the address on your account. We aim to respond within 7 days and will not take longer than 30.
10. Students under 18
Some exams on thekadamapp, such as MHT CET, are taken mostly by students under 18. Anyone may sit a paper without an account. To create an account, you confirm that you are 18 or older, or that your parent or guardian agrees to you using thekadamapp. We record that you confirmed it and when — we do not ask for your age or date of birth.
For students under 18 we collect nothing beyond what the Service needs to mark your papers and show your analysis. We do not track you or show you targeted advertising: engineering entrance pages run no Google Analytics or Google ads (section 3). A parent or guardian may write to thekadamapp@gmail.com at any time to see, correct or delete a child’s account and everything in it, and we will act on it.
11. Security
All traffic is encrypted in transit. Passwords are hashed as described above. Access to your data in the database is enforced row by row, so one signed-in student cannot read another’s attempts or results. Correct answers are withheld from the data sent to your browser during a live test, so they cannot be read out of the page.
No system is perfectly secure. If a breach occurs that affects you, we will notify you and the Data Protection Board as the law requires.
12. Changes
If we change what we collect or why, we will update this page and change the effective date. Material changes will be notified by email before they take effect.
13. Contact
thekadamapp — thekadamapp@gmail.com. Governing law and jurisdiction: the courts of Maharashtra, India.