This policy applies to www.upscgeeks.in and blog.upscgeeks.in. It explains what UPSC Geeks processes when you use the learning platform, blog, account features and AI tools. We do not sell personal data and we do not use advertising technology or Google AdSense.

India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 are being brought into force in phases. This policy is intended to provide clear notice and sensible privacy controls; it is not a claim of blanket legal compliance.

1. Information we process

Account and profile information

• email address, authentication identifier and sign-in provider;
• username and profile metadata supplied through email sign-up or Google sign-in;
• optional preparation preferences: target exam, attempt year, optional subject and daily study hours.

Learning and participation information

• question and quiz attempts, selected answers, correctness, marks, time and hint use;
• daily-challenge completion, streaks, XP, badges, review schedules and review history;
• contest registration, submissions, scores, rank and rating history;
• flashcards and flashcard progress, collections, bookmarks, votes, notes and submitted resources;
• resource reviews, comments and issue reports.

AI submissions

The Answer Evaluator receives the category, question and complete answer you submit. The content summariser receives the URL you provide, fetches readable article text on our server and sends that text for AI summarisation. Flashcard generation receives the subject, topic, difficulty and requested count. Do not include personal or sensitive information in these inputs.

Communications and blog subscriptions

• name, email, subject, category and message sent through Contact;
• the report and limited page/resource context submitted through Report an issue;
• email address submitted to the blog newsletter, which is sent to Buttondown.

Technical information

Hosting, security and API infrastructure can process IP address, request time, browser/device information, requested URL, response status and diagnostic logs. Rate limits use IP addresses or account identifiers transiently. We have removed submitted answer text and contact identifiers from application error logging, but infrastructure providers may maintain their own operational logs.

2. Why we use this information

• authenticate accounts and secure access;
• provide requested learning, AI, quiz, contest, review and revision features;
• save history and calculate progress, streaks, XP, ratings and leaderboards;
• respond to support, privacy and correction requests;
• prevent abuse, diagnose failures and improve reliability;
• measure site usage only when analytics consent is granted; and
• meet applicable legal and safety obligations.

3. AI data flow and persistence

For answer evaluation, the flow is: your browser → UPSC Geeks backend → Groq's AI API → UPSC Geeks backend → your browser. Groq receives the question, category and answer text needed to generate the result; UPSC Geeks does not add your name, email or user ID to the AI prompt. The current model identifier is openai/gpt-oss-120b, served through Groq. Provider handling is governed by the provider's terms.

• If you are signed in, the question, full answer, scores, feedback and model answer are saved in Supabase for your history and progress.
• If you are not signed in, UPSC Geeks does not save an evaluation row in its database, although the AI and hosting providers still process the request and may keep operational logs under their own policies.
• UPSC Geeks does not train its own model on submitted answers.

4. Public information

Public visibility is part of the current account implementation and is not yet controlled by a profile-visibility toggle. A public profile can display your username, joined month, solved count, accuracy, XP, rating, activity history and badges. Contest and league boards can display your username and performance. Resource reviews display the review, rating, date and username. OAuth metadata may supply a display name or avatar.

Choose a username with this in mind. Contact us to change or remove public information. A private-by-default visibility control is listed as an outstanding improvement in our audit.

5. Cookies and browser storage

We do not use advertising or marketing cookies. Google Analytics is optional and its script remains unloaded until you choose “Accept all” or enable Analytics in Cookie Settings. Rejecting non-essential storage does not affect sign-in or learning features.

No application use of sessionStorage or IndexedDB was found in this audit. You can reopen choices at any time through Cookie Settings in the footer. Turning Analytics off disables the tag and removes the first-party Google Analytics cookies visible to the site.

6. Providers and disclosures

• Supabase — authentication, database and account sessions.
• Vercel — hosting, delivery and operational request logs.
• Groq — AI evaluation, summaries and generated flashcards.
• Google — optional Analytics and Google OAuth when you choose that sign-in method.
• Buttondown — blog newsletter subscription email and delivery.
• External websites — receive a normal browser request when you follow a resource, social, share or affiliate link.

Google Serper is used in an operator-facing resource discovery tool for search queries, not as visitor analytics. The application includes no payment processor, ad network, CAPTCHA, end-user file upload, Sentry, PostHog, Microsoft Clarity, Mixpanel or Meta Pixel in the audited code.

7. Retention

The repository does not encode one fixed retention period for account, learning, contact or issue data. Account and learning records are kept while needed to provide the account and history. Contact and issue records are kept while they remain useful for response, correction, security or dispute handling. Provider logs and backups follow the relevant provider's schedules. Establishing documented deletion schedules for legacy tables is an outstanding operational action.

8. Your choices and account deletion

• Change your username and preparation preferences in Profile Settings.
• Accept, reject or change analytics through Cookie Settings.
• Ask for access, correction, export or deletion through Contact.
• Unsubscribe from a newsletter using the link in a newsletter email.

Signed-in users can submit an account-and-data deletion request from Profile Settings. This currently creates a pending request for manual review; it does not instantly delete the account. We must verify the request, review legacy records and then delete or anonymise data unless retention is necessary for security, legal or dispute reasons. Browser-local preferences remain on the device until you clear site data. You can also email support@upscgeeks.in from the account address.

9. Security

We use managed authentication, row-level database controls where versioned, server-side API credentials, validation, rate limits and transport security headers. No online system is completely secure. Several legacy database schemas are not represented in repository migrations, so their deletion and row-level policies require an operational review.

10. Children

The account service is intended for people aged 18 and above. We do not knowingly seek children's personal data. If a parent or guardian believes a child has created an account or submitted personal data, contact us so the matter can be reviewed. The current application does not implement age verification, which remains a readiness action if the service is offered to minors.

11. International processing

Some providers may process information outside India. Their processing is subject to their infrastructure, contracts and applicable law.

12. Changes and contact

Material changes will be reflected by updating the date above and, when appropriate, renewing the consent record. Privacy, correction and deletion requests can be sent through Contact or to support@upscgeeks.in. We may verify identity before providing or changing account data.