Privacy

Last updated 2026-09-12.

MockCert is operated by Gaurav Barwalia, an individual, not a registered company, based in India. This page describes exactly what the application does with your data. It is written to be checked against the software rather than to be reassuring.

The short version. Your study data is yours. It is never sold, never shared with advertisers, and never used to train anything. We use Google Analytics only if you explicitly accept analytics; rejecting it does not limit the study service. You can export everything, and you can delete everything, from Settings, without asking anyone.

What is collected

Only what the application needs to work:

Email address
Your identity. It is how you sign in, and how a password reset reaches you.
Display name
Shown to you in the interface. Never used for lookups.
Password
Stored only as a scrypt hash. The password itself is never written down and cannot be recovered from what is stored — not by anyone, including the operator.
Google account ID
Only if you sign in with Google, and only Google's stable identifier for you. Never your Google password.
Your study data
Practice and mock attempts and their scores, flashcard grades, checklist state, your study plan and your exam date.
Purchases
If you buy a paid mock exam: the amount charged, the billing country used for tax purposes, a reference to the payment at our payment provider, and any coupon code redeemed. Your card or UPI details are never sent to or stored by this application — see Terms.
Entitlements
What a paid unlock covers, when it was granted, and until when — used to decide what you can access.
Attempt and certificate records
A durable record of each mock attempt (score, pass/fail against the configured target, whether it was covered by a paid unlock) so it can be checked later if you choose to generate a certificate from it. If you generate a certificate, a snapshot of it — including your display name and, unless you opt out, your score — is stored and shown at its public verification link to anyone who has that link.

What is deliberately not collected. No location, no device fingerprint, no browsing history, no contact list, no behavioural profile. Your IP address is used, in memory only, to rate-limit sign-ups and sign-in attempts so the service cannot be flooded — it is never written to the database and does not survive a restart.

Why, and on what legal basis

Under the UK/EU GDPR the basis is performance of a contract: you asked for an account and the application cannot provide one without storing an identity and the progress attached to it. Security measures such as rate limiting rest on legitimate interests — keeping the service available for everyone. Under India's Digital Personal Data Protection Act the equivalent basis is the certain legitimate use of data you voluntarily provided for exactly this purpose.

No processing here relies on consent, which is why there is no consent banner. See cookies and local storage below.

How long it is kept

Your account
Until you delete it. There is no automatic expiry on a real account.
Sign-in sessions
400 days, then they expire on both the cookie and the server.
Password reset links
1 hour, then the token is void.
Demo (guest) accounts
Deleted automatically after 7 days of inactivity, by default.
Purchases and entitlements
Kept as long as your account exists, and for a period afterwards where the law requires it (for example tax and accounting records) — deletion of these specific records may be delayed for that reason even though the rest of your account is removed immediately.
Certificates
Kept until you delete your account, or until you or an operator revoke the certificate — whichever happens first. A revoked or deleted certificate's verification link stops working immediately.

Deletion is real deletion — the database rows are removed, not flagged as hidden. There is no archive and no backup copy the operator can restore from, which is the same reason deletion is irreversible for you.

Who else is involved

The service runs on infrastructure operated by other companies. They process data strictly to provide their service, and nothing here is sold or shared for any other purpose:

ProviderWhat they do
RailwayHosting and database storage for this application.
GoogleSign-in, and only if you choose “Continue with Google”. Google confirms your identity to us; we never receive your Google password.
RazorpayTaking payment, and only when you buy something. Razorpay receives your payment details directly — they are never sent to or stored by this application, which only ever learns that a payment succeeded.
BrevoDelivering transactional email — a welcome message and password-reset links. No marketing email is sent, ever.

Because the service is hosted in a single region, data may be processed outside your own country. If you are in the UK or EU that is an international transfer, made under the hosting provider's own standard contractual clauses.

Cookies and local storage

This is the complete list. Optional Google Analytics is present only after you accept it.

NameKindPurposeLifetime
mockcert_sessionCookieKeeps you signed in. HttpOnly, SameSite=Lax, and Secure over HTTPS, so it cannot be read by scripts or sent from another site.400 days
mockcert_oauth_stateCookieSet only during a Google sign-in, to prove the reply came back from the request you started (CSRF protection). Deleted the moment sign-in completes.10 minutes
mockcert.progressLocal storageYour progress, and your light/dark preference, when the app is used without a server account. On this site it is read to apply your theme before the page paints, so the interface does not flash.Until you clear it
mockcert.analytics-consentLocal storageRemembers whether you accepted or rejected optional Google Analytics. It does not identify you to us.Until you change it or clear it

Optional analytics. Google Analytics is loaded only after you select “Accept analytics” in the analytics preference prompt. It helps us understand aggregate site use. You can reject it without losing access, and you can reopen “Privacy choices” at any time to change your decision. Google may process analytics data under its own privacy terms; it is not used for advertising on this service.

Certificates you choose to share

Generating a certificate and sharing its link is something you choose to do, not something the application does on your behalf. Anyone with a certificate's verification link can see your display name and — unless you switch off score visibility for that certificate — your score. This is separate from the data described above, which the application processes for its own purposes: this is data you have actively decided to make public. You can turn off score visibility or revoke a certificate at any time from where you manage it.

Your rights, and how to actually use them

You do not need to ask permission or wait for a reply to exercise the two that matter most:

Access and portability
Settings → Export downloads your entire progress as one JSON file, immediately.
Erasure
Settings → Delete my account removes your account and everything in it, immediately and permanently. It asks for your password again first, because it cannot be undone.
Rectification
Change your display name or password in Settings at any time.

For anything else — a correction you cannot make yourself, a restriction or objection request, or a question about any of this — write to support@mockcert.com. Expect a reply within 30 days; in practice it will be much sooner. This is a personal project run by one person, not a support desk.

If you are in the UK or EU you have the right to complain to your national data protection authority. In India you may complain to the Data Protection Board. Raising it directly first is usually faster.

Children

This service is intended for people preparing for a professional certification and is not directed at children. If you are under 18, please do not create an account. If you believe a child has, write to the address above and it will be deleted.

Security

Passwords are hashed with scrypt. Sessions use HttpOnly cookies. Traffic is served over HTTPS with HSTS, and the application sets a Content Security Policy that forbids loading code from anywhere but itself. No system is perfectly secure, and this one is maintained by one person in their spare time — that is stated plainly rather than implied away. See Security to report a vulnerability.

Changes

Material changes will be reflected here with a new date at the top of the page. There is no mailing list to notify, because no marketing email is ever sent.