Privacy

CollectorX is built and run by one person in India. For the purposes of the Digital Personal Data Protection Act 2023, that person is the Data Fiduciary — the party who decides what is collected and why — and is reachable at support@collectorx.app. The same address is the grievance route described further down.

Your account. Sign-in is handled by Clerk. Depending on how you sign in, that means your email address, your name, and a profile image if your provider supplies one. A username, if you choose one, is stored by us and is public — it is the name shown to opponents and on the leaderboard.

What you do in the product. Every answer you submit, which option you picked, whether you skipped, how long you took, the marks awarded, and the questions you have already been served. From those: your rating, your tier, your streak, your subject accuracy, and the record of each match — who played, what was asked, and how it ended. Bookmarks you save, and whether you opened a match review.

Technical records. Our servers log requests in the ordinary way, which includes IP address, browser and timestamps. These are operational records used to keep the service running and to investigate abuse.

The waitlist. If you joined the waitlist on this site, we hold your email address and the one description of your preparation you selected.

Visits. Page views on this site and in the app are counted with Vercel Web Analytics. It sets no cookies and stores no persistent identifier: a visit is counted against a value derived from your request and a salt that is rotated daily, so it cannot be linked to you across days or followed to other sites. It tells us how many people arrived and which screens they reached, not who they were.

Your account data exists so you can sign in and so an opponent has a name to see. Your answers and timings exist because they are the product: they are what the rating is computed from, what your review screen shows you, and what decides which questions you are served next — questions you have recently seen are deliberately excluded.

Under the DPDP Act the basis is your consent, given when you create an account and use the service for the purposes described here. Where the Act permits processing for specified legitimate uses — keeping the service secure, preventing abuse, meeting a legal obligation — we rely on that. Your data is not used for advertising, is not sold, and is not shared with data brokers. There is no such arrangement to disclose, and there is not going to be one.

Running this needs a handful of services. Each processes data on our instruction and for no purpose of its own.

• Clerk — authentication and account management.
• Supabase — the Postgres database holding your account, answers, matches and ratings. Hosted in Mumbai.
• Upstash — the Redis store holding live match state while a duel is being played. Hosted in Mumbai.
• Google Cloud Run — the realtime server, in Google’s Mumbai region.
• Vercel — hosting and content delivery for this site and the app, and the cookieless, aggregate visit counts described above.

The database, the live match store and the realtime server are all in India. Clerk and Vercel operate globally, so some processing — authentication in particular — happens outside India.

The app sets a session cookie so that you stay signed in. That is necessary for the product to work at all and there is no version of it without one. There are no advertising cookies, no tracking pixels and no third-party cookies. Analytics sets nothing, here or in the app.

Account data is kept while your account exists. Waitlist entries are kept until you ask for removal.

Match records are the exception worth explaining. A duel is two people, so the record of it is also your opponent’s history, and their archive and rating are computed from it. When an account is deleted we clear the name, email and profile image and disconnect the account from the person, but the matches themselves are retained in anonymised form. Erasing them outright would silently corrupt somebody else’s record of a game they played.

The DPDP Act gives you the right to know what is held about you, to have it corrected or completed, to have it erased, to nominate someone to act for you, and to have a grievance heard. All of these go to the same place: support@collectorx.app. Say what you want and we will do it.

One honest limit: this is handled by a person, not a button. There is no automated “delete my account” flow in the product yet. A request is carried out by hand, and the aim is within seven days and no longer than thirty. Saying so is better than implying an instant mechanism that does not exist — and building the button is on the list.

If a grievance is not resolved to your satisfaction, the Act gives you the right to escalate to the Data Protection Board of India.

Traffic is encrypted in transit. We never see or store your password — Clerk handles credentials, and if you sign in with Google we never receive one at all. Access to the production database is limited to the one person who runs the service, and secrets are held in a managed secret store rather than in the codebase.

If a breach affects your personal data, we will tell you and the Data Protection Board, as the Act requires — describing what happened and what to do about it, rather than a notice written to say as little as possible.

CollectorX is built for candidates preparing for the Civil Services Examination, who are adults. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has created an account, write to us and it will be removed.

When this policy changes materially, the date at the top changes and the change will be announced in the product. Continuing to use CollectorX after that means the updated policy applies.

This policy describes what the software genuinely does — it was written against the code, not adapted from a template. It has not been reviewed by a lawyer. If you are relying on it for something consequential, that is worth knowing, and if you think something here is wrong or missing, tell us and it will be fixed.