Privacy
Last updated 2026-11-02.
MockCert is operated by Barwalia Labs, based in India. This page describes exactly what the application does with your data. It is written to be checked against the software rather than to be reassuring.
The short version. Your study data is yours. It is never sold, never shared with advertisers, and never used to train anything. We use Google Analytics only if you explicitly accept analytics; rejecting it does not limit the study service. Cloudflare Web Analytics counts page views and loading speed for every visit without cookies. Settings describes progress export availability; Profile provides account deletion; scope and retention exceptions are explained below.
What is collected
Only what the application needs to work:
- Email address
- Your identity. It is how you sign in: there are no passwords, and we email you a one-time code each time.
- Display name
- Shown to you in the interface. Never used for lookups.
- Google account ID
- Only if you sign in with Google, and only Google's stable identifier for you. Never your Google password.
- GitHub account ID
- Only if you sign in with GitHub, and only GitHub's stable identifier for you and your verified primary email. Never your GitHub password, and GitHub's access token is not kept.
- Passkeys
- Only if you add one for two-step sign-in: the passkey's public key, a signature counter, the name you give it and when it was added and last used. Your fingerprint or face never leaves your device; MockCert never receives it.
- Security log
- To protect accounts, we record sign-ins, failed sign-ins, sign-ins from a device the account has not used before, and changes to two-step sign-in, passkeys or account roles, with the request's IP address and country and the kind of browser. A random device cookie (stored only as a hash) lets us tell you about a sign-in from a new device. Admins see this log; it is never used for analytics or marketing.
- Regional pricing
- We record the country of your first purchase as your account home country and keep country codes for sign-ins and mock exam starts for up to 90 days to review regional-price use; contact support to change your home country.
- Your study data
- Account-based quiz and mock exam attempts and their scores, flashcard grades, checklist state, study plan, exam date and selected certification paths. Signed-out quiz and flashcard previews are held in the browser only for that visit; they are not saved to an account.
- Purchases
- If you buy a paid mock exam: the amount charged, the billing country used for tax purposes, a reference to the payment at our payment provider, and any coupon code redeemed. Your card or UPI details are never sent to or stored by this application — see Terms.
- Entitlements
- What a paid unlock covers, when it was granted, and until when — used to decide what you can access.
- Attempt and MockCert certificate records
- A durable record of each mock attempt (score, pass/fail against the configured target, whether it was covered by a paid unlock) so it can be checked later if you choose to generate a certificate from it. If you generate a certificate, a snapshot of it — including your display name and, unless you opt out, your score — is stored and shown at its public verification link to anyone who has that link.
- Certification requests
- If you ask for a certification on /request-certification: its name, provider and exam code as you typed them, your country, and, only if you give it, an email address. The address is used once, to tell you when that certification opens, and is removed if you delete your account.
Optional analytics. When configured and accepted, Google Analytics receives sanitized public-page activity, approximate geography and browser/device information. We do not send learning answers, scores or account identifiers to it. We do not use device fingerprinting or session replay. Security rate limits and operational logs are separate from analytics and may retain limited request/account context to protect the service.
Cookieless measurement. Cloudflare, which delivers and protects this site, runs Cloudflare Web Analytics on every visit. It sets no cookies and stores nothing in your browser, so it is not part of the analytics choice above. It receives the page address, the referring page, browser and device type and page-loading timings, and Cloudflare derives an approximate country from your IP address. We see only aggregate counts.
Why, and on what legal basis
We process account and learning data to provide the features you request, and use limited operational data to protect the service. Optional analytics is processed only after you consent. The specific lawful basis depends on the purpose and the privacy law that applies to you; contact the operator for details about a particular processing activity.
Optional analytics relies on your consent. Rejecting it does not limit the service. See cookies and local storage below.
How long it is kept
- Your account
- Until you delete it. There is no automatic expiry on a real account.
- Sign-in sessions
- At most 30 days, with server expiry after 7 days of inactivity. Signing out revokes the current session. Two-step sign-in changes revoke other sessions and replace the current token.
- Sign-in codes
- 10 minutes, used once, stored only as a hash.
- Security log
- 400 days, then deleted automatically. The list of devices an account has signed in from is deleted with the account.
- Legacy demo accounts
- Guest access has ended. Any remaining guest accounts from the earlier feature are deleted after 7 days of inactivity, by default.
- Purchases and entitlements
- Kept as long as your account exists, and for a period afterwards where the law requires it (for example tax and accounting records) — deletion of these specific records may be delayed for that reason even though the rest of your account is removed immediately.
- MockCert certificates
- Internal certificate records remain with your account. Revoking a certificate stops its public verification link; revocation does not erase its historical record. Account deletion and any required retention limits apply.
- Certification requests
- Kept to count demand. An email address you gave is removed when you delete your account.
Account deletion removes the application records covered by that action. Required financial records may be retained. Infrastructure backups and provider copies may expire separately; contact the operator for the current retention and deletion schedule. We do not promise immediate deletion from every backup or provider system.
Who else is involved
The service runs on infrastructure operated by other companies. They process data strictly to provide their service, and nothing here is sold or shared for any other purpose:
| Provider | What they do |
|---|---|
| Railway | Hosting and database storage for this application. |
| Cloudflare | Network protection and delivery for this site, and cookieless page-view and loading-speed measurement (Cloudflare Web Analytics) for every visit. |
| Google Analytics | Optional, consented public-page and coarse acquisition measurement. Learning records remain in MockCert. |
| Sign-in, and only if you choose “Continue with Google”. Google confirms your identity to us; we never receive your Google password. | |
| GitHub | Sign-in, and only if you choose “Continue with GitHub”. GitHub confirms your identity and verified email to us; we never receive your GitHub password. |
| Razorpay | Processing your payment if you buy a paid mock exam. Razorpay receives your card/UPI/payment details directly — this application never sees or stores them. |
| Brevo | Delivering transactional email — sign-in codes, a welcome message and account notices. No marketing email is sent, ever. |
Providers may process data outside your country. The operator maintains the applicable processing terms, region, transfer safeguards and retention evidence; contact the operator for the current details. Sentry is not active.
Cookies and local storage
Guest accounts have ended. You can still try quizzes and flashcards without an account. If this browser still holds an existing guest session, you can delete your guest account without creating a new account.
The application-managed storage is listed below. Google Analytics loads only when configured and accepted. Cloudflare Web Analytics uses no cookies or browser storage. Google sign-in and hosted checkout may use their own provider-controlled cookies when you choose those services.
| Name | Kind | Purpose | Lifetime |
|---|---|---|---|
mc_device | Cookie | A random value that identifies this browser to your account, so a sign-in from a new device can be emailed to you. Stored on our side only as a hash. HttpOnly, SameSite=Lax. | 400 days |
mockcert_session | Cookie | Keeps you signed in. HttpOnly prevents script access; SameSite=Lax restricts cross-site sending and Secure requires HTTPS when configured for production. | 30 days maximum; 7-day server idle expiry |
mockcert_oauth_state | Cookie | Set only during a Google sign-in, to prove the reply came back from the request you started (CSRF protection). Deleted the moment sign-in completes. | 10 minutes |
mockcert_oauth_mfa | Cookie | Short-lived, HTTP-only proof that Google sign-in succeeded and the account still needs its MFA code. It is one-use and cannot sign in by itself. | 5 minutes, or until used |
mockcert.trackReturn | Session storage | Remembers an allowed study destination across sign-in, without an external URL or query string. Independent of analytics consent. | Accepted for 10 minutes; removed when consumed or the browser tab session ends |
mockcert.lastEmail | Local storage | The email address you last signed in with on this device, so the sign-in box is filled in for you. Written only after a sign-in succeeds; signing out removes it. Independent of analytics consent. | Until you sign out, sign in with another address or clear site data |
mockcert.theme | Local storage | Your selected light or dark appearance, independent of analytics consent. | Until changed or site data is cleared |
mockcert.filmCaptions | Local storage | Whether you turned captions on or off for the MockCert film, independent of analytics consent. | Until changed or site data is cleared |
mockcert.appBannerHiddenAt | Local storage | When you closed the "Get the MockCert app" bar on a phone, so it stays hidden for 30 days, independent of analytics consent. | 30 days, or until site data is cleared |
mockcert.progress | Legacy local storage | Older browser-only learning data. Hosted builds do not use or update it; Settings lets you save then remove an old copy. Explicit local development mode may still use it. | Until you remove it |
mockcert.analytics-consent | Local storage | Choice, policy version and decision/expiry times. No account identity is created for this preference. | 180 days, or until a material policy change |
_ga, _ga_<stream-id> | First-party analytics cookies set by Google | Pseudonymous browser/session measurement after acceptance. | Configured maximum 180 days; browser restrictions may shorten it. Known cookies are expired on withdrawal. |
Optional analytics. When analytics is available, you can select “Accept all cookies” in the prompt or enable “Allow optional analytics” and save in Cookie preferences. Google Analytics loads only after that choice. No automatic consent prompt is shown when analytics is unavailable. It helps us understand aggregate site use. You can reject it without losing access, and you can reopen “Cookie preferences” at any time to change your decision. Withdrawal immediately disables future sends and expires known analytics cookies; it does not undo earlier collection. Source configuration disables Google Signals and advertising personalization. External property settings and provider retention require operator verification before activation; contact the operator for current evidence. Google processes accepted analytics under its own privacy terms.
MockCert certificates you choose to share
Generating a certificate and sharing its link is something you choose to do, not something the application does on your behalf. Anyone with a certificate's verification link can see your display name and — unless you switch off score visibility for that certificate — your score. This is separate from the data described above, which the application processes for its own purposes: this is data you have actively decided to make public. You can turn off score visibility or revoke a certificate at any time from where you manage it.
Manage your account and make a data request
These controls are available in the application while signed in:
- Export
- Use Settings to check progress export availability. When enabled, Export downloads the selected track’s loaded learning progress as JSON, not a complete account archive. If unavailable, contact us to request a copy.
- Account deletion
- Use Profile → Delete my account to request deletion of your account and associated application records, subject to the financial, backup and provider-retention limits above. The application asks you to confirm before deletion.
- Update account details
- Use Settings for two-step sign-in and passkeys, and Profile for your phone number. A display name cannot currently be edited there; contact us if it needs correction.
For anything else — a correction you cannot make yourself, a restriction or objection request, or a question about any of this — write to [email protected]. We will handle requests under the privacy rules that apply to your location. You may also contact the relevant data protection authority in your jurisdiction.
Children
This service is intended for people preparing for a professional certification and is not directed at children. If you are under 18, please do not create an account. If you believe a child has, write to the address above and it will be deleted.
Security
There are no passwords: you sign in with a one-time code we email you (stored only as a hash and valid for 10 minutes), or with Google or GitHub. Sessions use HttpOnly cookies. Traffic is served over HTTPS with
HSTS, and the application sets a Content Security Policy that limits scripts to the application and explicitly
allowed analytics and checkout integrations. No system
is perfectly secure. See Security to report a vulnerability.
Changes
Material changes will be reflected here with a new date at the top of the page. There is no mailing list to notify, because no marketing email is ever sent.