Privacy policy

In short

Every question bank and notes deck works without an account. Signing in with Google is optional; it only exists so your practice can follow you from one device to another. We don’t sell your data, show you ads, or send you email, and we send browser notifications only to a browser that allows them.

Without an account

Your answers, the cards you mark in the notes decks, your streak, goal, badges and revision queue are saved only in your browser’s storage on your own device. They are never sent to us, and clearing your browser data removes them. The daily challenge and the weekly league need an account.

What we store when you sign in

• From Google: your name, email address, profile picture link and Google account ID, so we can recognise you when you sign in again.
• Your practice: the option you chose for each question you answered and how long it took, starred questions, your revision queue, mock test scores, how many questions you answered and notes cards you marked each day, your daily goal, streak, badges, and a progress summary for each subject.
• Your notes decks: which cards you marked as known or to review (and, on Polity’s PYQ cards, the option you picked), which cards you starred, when you did so, and how many cards you know in each deck.
• XP and the weekly league: your XP, the XP you earn each day and your daily quests. The league is public and lists every signed-in player who earned XP that week: it shows your username (we make one up for you; you can change it in Settings) with your level and this week’s XP. It never shows your name, email or photo.
• Your public profile: anyone can open bpscpyq.com/u/ followed by your username and see your username, the month you joined, your level and XP, your rank this week, your current and best streak, how many questions and cards you did each day over the last year, your badges, and your progress in each subject and notes deck. It never shows your name, email or photo. Profiles are kept out of search engines.
• Daily challenge: your answers, score and time for each day you play. That day’s leaderboard is public: anyone on the daily challenge page sees your username with your score and time, never your name, email, photo or answers.
• Notifications: when you sign in, we ask whether to turn them on; if your browser already allows notifications from bpscpyq.com, they turn on for your account without asking. For each browser, the address its push service gave it and the keys to encrypt messages for it, which browser it is (for example “Chrome on Android”) and when it was last used; the kinds of notification you turned off; and the notifications we sent you, kept for 30 days. Notifications need an account.
• A random device ID for each browser you use, so daily counts from your phone and laptop add up correctly.
• Problem reports: if you report a problem with a question, we keep the question, what you said was wrong and when. If you delete your account, reports you sent stay but are no longer linked to you.

Your browser also keeps your sign-in session so you stay signed in.

Each question page may show how everyone did on it (for example “64% of 120 people got this right”). Those figures are totals over signed-in players and appear only once at least 5 people have answered, so no one’s answer can be picked out.

Where it is kept

Accounts and synced progress are stored with Supabase in its Mumbai (India) region. The website is served by Cloudflare, and sign-in uses Google’s sign-in service. They process data only to run these parts of the site.

Notifications reach your device through your browser’s own push service (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). Each one is encrypted for your browser, so the push service can’t read it.

Encrypted backups of the database are made every night and kept in a private repository for up to 30 days, plus one a month for up to 12 months.

The site uses Google Analytics to count visits and see which pages are used. It isn’t linked to your account.

Your choices

• A copy of your data: message us from the Contact page, using the Google account you signed in with.
• Delete your account: message us from the Contact page, using the Google account you signed in with. Once we’ve confirmed the request is yours, your account, synced progress, XP, league entry and daily challenge results are erased from our database, and drop out of the backups as they expire. Progress saved in your browser stays until you clear it.
• Notifications: turn them off, or choose which kinds you get, in Settings. You can also block them in your browser’s settings for this site. Signing out turns them off in that browser.
• Sign out at any time. Syncing stops, and this device keeps its copy of your progress.

Questions

Message us on Telegram at @bpscpyqandnotes.