Last updated 2026-09-12.
MockCert is operated by Gaurav Barwalia, an individual, not a registered company, based in India. This page describes exactly what the application does with your data. It is written to be checked against the software rather than to be reassuring.
The short version. Your study data is yours. It is never sold, never shared with advertisers, and never used to train anything. We use Google Analytics only if you explicitly accept analytics; rejecting it does not limit the study service. You can export everything, and you can delete everything, from Settings, without asking anyone.
Only what the application needs to work:
What is deliberately not collected. No location, no device fingerprint, no browsing history, no contact list, no behavioural profile. Your IP address is used, in memory only, to rate-limit sign-ups and sign-in attempts so the service cannot be flooded — it is never written to the database and does not survive a restart.
Under the UK/EU GDPR the basis is performance of a contract: you asked for an account and the application cannot provide one without storing an identity and the progress attached to it. Security measures such as rate limiting rest on legitimate interests — keeping the service available for everyone. Under India's Digital Personal Data Protection Act the equivalent basis is the certain legitimate use of data you voluntarily provided for exactly this purpose.
No processing here relies on consent, which is why there is no consent banner. See cookies and local storage below.
Deletion is real deletion — the database rows are removed, not flagged as hidden. There is no archive and no backup copy the operator can restore from, which is the same reason deletion is irreversible for you.
The service runs on infrastructure operated by other companies. They process data strictly to provide their service, and nothing here is sold or shared for any other purpose:
| Provider | What they do |
|---|---|
| Railway | Hosting and database storage for this application. |
| Sign-in, and only if you choose “Continue with Google”. Google confirms your identity to us; we never receive your Google password. | |
| Razorpay | Taking payment, and only when you buy something. Razorpay receives your payment details directly — they are never sent to or stored by this application, which only ever learns that a payment succeeded. |
| Brevo | Delivering transactional email — a welcome message and password-reset links. No marketing email is sent, ever. |
Because the service is hosted in a single region, data may be processed outside your own country. If you are in the UK or EU that is an international transfer, made under the hosting provider's own standard contractual clauses.
This is the complete list. Optional Google Analytics is present only after you accept it.
| Name | Kind | Purpose | Lifetime |
|---|---|---|---|
mockcert_session | Cookie | Keeps you signed in. HttpOnly, SameSite=Lax, and Secure over HTTPS, so it cannot be read by scripts or sent from another site. | 400 days |
mockcert_oauth_state | Cookie | Set only during a Google sign-in, to prove the reply came back from the request you started (CSRF protection). Deleted the moment sign-in completes. | 10 minutes |
mockcert.progress | Local storage | Your progress, and your light/dark preference, when the app is used without a server account. On this site it is read to apply your theme before the page paints, so the interface does not flash. | Until you clear it |
mockcert.analytics-consent | Local storage | Remembers whether you accepted or rejected optional Google Analytics. It does not identify you to us. | Until you change it or clear it |
Optional analytics. Google Analytics is loaded only after you select “Accept analytics” in the analytics preference prompt. It helps us understand aggregate site use. You can reject it without losing access, and you can reopen “Privacy choices” at any time to change your decision. Google may process analytics data under its own privacy terms; it is not used for advertising on this service.
Generating a certificate and sharing its link is something you choose to do, not something the application does on your behalf. Anyone with a certificate's verification link can see your display name and — unless you switch off score visibility for that certificate — your score. This is separate from the data described above, which the application processes for its own purposes: this is data you have actively decided to make public. You can turn off score visibility or revoke a certificate at any time from where you manage it.
You do not need to ask permission or wait for a reply to exercise the two that matter most:
For anything else — a correction you cannot make yourself, a restriction or objection request, or a question about any of this — write to support@mockcert.com. Expect a reply within 30 days; in practice it will be much sooner. This is a personal project run by one person, not a support desk.
If you are in the UK or EU you have the right to complain to your national data protection authority. In India you may complain to the Data Protection Board. Raising it directly first is usually faster.
This service is intended for people preparing for a professional certification and is not directed at children. If you are under 18, please do not create an account. If you believe a child has, write to the address above and it will be deleted.
Passwords are hashed with scrypt. Sessions use HttpOnly cookies. Traffic is served over HTTPS with
HSTS, and the application sets a Content Security Policy that forbids loading code from anywhere but itself. No system
is perfectly secure, and this one is maintained by one person in their spare time — that is stated plainly rather than
implied away. See Security to report a vulnerability.
Material changes will be reflected here with a new date at the top of the page. There is no mailing list to notify, because no marketing email is ever sent.