Privacy Policy

Crackmate · Effective 6 August 2026 · Last updated 6 August 2026

This Privacy Policy explains how Crackmate ("Crackmate", "we", "us", "our") collects, uses, discloses, retains, and protects personal data when you use our website at crackmate.io, our installable web application, our WhatsApp sign-in, and any related services (together, the "Platform"). Please read it together with our Terms of Use. By creating an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy.

1. Scope and role

Crackmate is an examination-preparation platform for candidates preparing for engineering entrance examinations. In respect of the personal data described here, Crackmate acts as the data fiduciary (also described in some laws as the data controller) and determines the purposes and means of processing. This Policy applies to all users of the Platform.

2. Personal data we collect

We collect the categories of data set out below. Some you provide directly; some is generated automatically as you use the Platform; some is received from third parties whose sign-in services you choose to use.

2.1 Data you provide

• Account identifiers — your email address and/or mobile telephone number, depending on the sign-in method you choose.
• Profile data — your name or display name, class or year of study, target examination, study goals and target scores, and optionally your city, coaching institute, avatar, and preferences such as daily study time.
• Content you submit — answers, responses, notes, feedback, support requests, survey responses, and any other content you enter into the Platform.
• Transaction data — where you purchase a paid plan, records of that purchase, coupon or referral codes used, and entitlement status. Card and banking details are handled by our payment processor and are not stored by us.

2.2 Data generated automatically

• Learning and assessment data — questions served and attempted, options selected, correctness, time taken per question and per session, hints and solutions viewed, retries, practice and mock-test sessions, contest participation, streaks, and scores.
• Derived and inferred data — proficiency, difficulty and readiness estimates, chapter- and concept-level strength and weakness, misconception patterns, error patterns, pace and accuracy trends, revision scheduling, and similar analytical outputs generated from your activity.
• Usage and behavioural data — pages and screens viewed, features used, elements clicked or tapped, navigation paths, referring pages, session start and end, time active on a page, scroll and interaction events, and frequency and duration of use.
• Device and technical data — device type, operating system family, browser family, screen characteristics, language, time zone, application version, and a randomly generated device or session identifier.
• Network and approximate location data — a truncated form of your internet protocol address and an approximate location (country, region, and city) derived from it. We do not collect satellite positioning (GPS) data or precise coordinates.
• Communications data — records of email and other messages we send you and whether they were delivered, opened, or acted upon, and your subscription preferences.

2.3 Data received from third parties

• Google Sign-In — where you sign in with Google, we receive from Google a signed identity token containing your email address, name, profile picture where available, and a Google account identifier. We do not receive or have access to your Google password.
• WhatsApp — where you sign in with WhatsApp, we receive your mobile telephone number and the verification message you send us. See section 5.
• Service providers — analytics, infrastructure, communications, and payment providers may supply us with data relating to your use of the Platform.

3. Cookies, local storage, and similar technologies

We and our service providers use cookies, browser local storage, service workers, software development kits, pixels, tags, and similar technologies to operate the Platform and to collect the data described in section 2.2. These are used to:

• keep you signed in and maintain the security and integrity of your session;
• remember your settings and preferences;
• enable offline and installable application functionality;
• measure, analyse, and improve how the Platform is used; and
• detect, prevent, and investigate fraud, abuse, and technical faults.

Most browsers allow you to block or delete cookies and clear local storage. Doing so may prevent you from signing in or may degrade parts of the Platform.

4. Behavioural analytics, profiling, and personalisation

The Platform is adaptive. This means we analyse your learning, usage, and behavioural data to build and continuously update a profile of your performance, and we use that profile to determine what the Platform shows you. Specifically, we may:

• analyse your answers, timing, and interaction patterns to estimate your ability, confidence, and likely misconceptions;
• select, sequence, rank, and schedule questions, revision items, tests, videos, and other content on the basis of that analysis;
• generate progress reports, readiness indicators, rankings, comparative statistics, and recommendations;
• determine the timing, frequency, and content of reminders, nudges, and other product communications;
• measure engagement and retention, conduct product research, and run experiments, including A/B tests in which different users are shown different versions of a feature; and
• produce aggregated and de-identified statistics and insights about usage of the Platform.

These activities constitute profiling and automated processing. They are integral to the service and are carried out for the purpose of delivering the personalised learning experience you sign up for. They do not produce legal effects concerning you. We do not use this profile for advertising, and we do not sell it. If you object to this processing, the appropriate course is to discontinue use of the Platform, as it cannot function without it.

5. WhatsApp sign-in

If you choose to sign in using WhatsApp, we display a link that opens WhatsApp with a short, single-use verification code pre-filled. You send that message to our registered business number. Because the message originates from your number, its receipt is what confirms the number belongs to you.

• We record your mobile number and the fact that it has been verified.
• The verification code is stored only until it is used or expires, whichever is earlier.
• We do not access your WhatsApp chats, contacts, groups, profile photograph, or status, and we do not read or store WhatsApp messages other than the verification message you send us for this purpose.
• Sign-in is inbound only: you message us. We may, where you have consented or where otherwise permitted by law, send you service or transactional messages on WhatsApp in future; if we do, each will identify us and offer a means to stop them.
• WhatsApp and Meta process the message you send under their own terms and privacy policy, over which we have no control.

6. Purposes of processing

Where the law requires a specified basis for processing, we rely on your consent, on the necessity of processing for the performance of our contract with you, on compliance with a legal obligation, and on our legitimate interests in operating, securing, and improving the Platform, as applicable.

7. Disclosure of personal data

We do not sell your personal data. We disclose personal data only as follows:

• Service providers and processors — hosting, database, content delivery, analytics, authentication, communications, customer support, and payment providers who process data on our instructions and are bound to protect it. Current categories are listed below.
• Other users — where you take part in contests, leaderboards, challenges, or other social features, limited information such as your display name, avatar, and score may be visible to other participants.
• Business transfers — in connection with a merger, acquisition, reorganisation, financing, or sale of assets, subject to this Policy continuing to apply.
• Legal and protective disclosures — where required by applicable law or by a competent authority, or where we reasonably believe disclosure is necessary to enforce our terms, to investigate fraud or abuse, or to protect the rights, property, or safety of any person.

8. Storage location and transfers

The Platform is operated using infrastructure that may be located in, and personal data may be stored in or accessed from, countries other than the one in which you reside. Where we transfer personal data across borders, we do so in accordance with applicable law and take reasonable steps to ensure it remains protected to the standard described in this Policy.

9. Retention

We retain personal data for as long as your account remains active, because your study history is what the adaptive features are built on, and thereafter for as long as necessary for the purposes described in this Policy, including to comply with legal, accounting, regulatory, or reporting obligations, to resolve disputes, and to enforce our agreements. Single-use verification codes are deleted on use or on expiry. We may retain aggregated or de-identified data, which cannot reasonably be used to identify you, for an unlimited period.

10. Security

We implement reasonable technical and organisational security safeguards appropriate to the nature of the data we hold. These include encryption of traffic in transit, signed session cookies that are not readable by scripts running in the page, storage of passwords only in salted and hashed form, access controls limiting who within our organisation can access personal data, and truncation of network identifiers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your sign-in credentials and devices secure and for activity carried out under your account.

11. Your rights and choices

Subject to applicable law and to verification of your identity, you may:

• Access a summary of the personal data we process about you and the identities of recipients with whom it has been shared.
• Correct, complete, or update your data. Your name, email address, telephone number, and profile details can be edited from your account settings at any time.
• Erase your personal data and close your account, save where we are required or permitted by law to retain it.
• Withdraw consent where processing is based on consent. Withdrawal does not affect processing carried out before withdrawal and may prevent us from continuing to provide the Platform.
• Opt out of non-essential communications using the unsubscribe link in any product email or the preferences in your account. Essential service and security messages will continue.
• Nominate an individual to exercise your rights in the event of your death or incapacity, where applicable law provides for this.
• Complain to us using the details in section 15, and thereafter to the relevant supervisory or data protection authority.

To exercise any of these rights, contact us using the details in section 15. We will respond within the period required by applicable law.

12. Children and parental consent

The Platform is intended for use by candidates preparing for engineering entrance examinations. We recognise that a substantial number of such candidates are below the age of eighteen years.

• If you are below the age of eighteen, you may use the Platform only with the consent, knowledge, and supervision of your parent or lawful guardian, who must accept our Terms of Use and this Policy on your behalf.
• By creating an account, you confirm that you are either aged eighteen years or above, or that your parent or lawful guardian has consented to your use of the Platform and to the processing of your personal data as described in this Policy.
• We do not knowingly process the personal data of a child in a manner likely to cause any detrimental effect on the well-being of the child.
• Any processing of a child's personal data for the purposes described in section 4 is carried out solely to deliver the educational and examination-preparation services requested, and not for advertising or commercial targeting.
• A parent or lawful guardian may contact us using the details in section 15 to review, correct, or request erasure of their child's personal data, or to withdraw consent, and we will act on such a request.

13. Third-party services and links

The Platform may contain links to, or embed content from, third-party websites and services, including video hosting platforms. Those services are governed by their own privacy policies and we are not responsible for their practices. We encourage you to read them.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, the Platform, or applicable law. We will revise the "Last updated" date at the top of this page, and where changes are significant we will provide additional notice within the Platform or by email. Your continued use of the Platform after a change takes effect constitutes acceptance of the revised Policy.

15. Contact and grievance redressal

For any question, request, or complaint concerning this Policy or your personal data, including to exercise the rights in section 11, contact our Grievance Officer:

Grievance Officer, Crackmate
Email: yourcrackmate@gmail.com

We will acknowledge and respond to complaints within the timeframes required by applicable law. If you are not satisfied with our response, you may escalate the matter to the competent data protection authority in your jurisdiction.