Privacy Policy

Account details. When you create an account we record your name, email address, and profile photo, as supplied by the sign-in method you choose. We also store the unique account identifier issued by our authentication provider.

Profile details you choose to add. Your phone number, college name, year of study, and the specialties you are targeting. These are optional and you can change or clear them at any time.

Referral information. A referral code issued to you, and the account that referred you, where applicable.

Things you submit. Feedback you send us about an exam or question, bookmarks you save, and any message you send to support.

You can sign in with Google, with Sign in with Apple (mobile app on iOS), or with an email address and password. Authentication is handled for us by Google Firebase Authentication. Where you sign in with an email and password, your password is held by Firebase Authentication and is never stored on our own servers in any form.

If you use Sign in with Apple, we store the refresh token Apple issues for your account. We use it for one purpose only: so that when you delete your Duramater account we can also tell Apple to revoke the connection between your Apple ID and Duramater. It is never used to access anything else.

Exam activity. Every exam attempt you start, the answers you select, whether you marked a question for review, how long you spent on each question and section, when you paused, and whether an attempt was submitted or abandoned.

Results and analytics. Your scores, section-wise breakdowns, percentile and rank relative to other candidates, and the progress analytics we derive from your attempts.

Access records. Which test series are in your account, when your account was created, and when you last signed in.

Test series are purchased on the Duramater website. Payments are processed by Razorpay. Your card, UPI, netbanking, and wallet details are entered on Razorpay's systems and handled under Razorpay's own privacy policy. We never receive or store your card number, CVV, UPI PIN, or banking credentials.

What we do store is the record of the transaction: the Razorpay order and payment reference, the amount and tax fields, which test series was bought, and the name and email address that appear on the resulting invoice.

Device information. In the mobile app we record your device model, manufacturer, operating system version, platform, and the app version you are running.

Push notification tokens. If you allow notifications, we store the push token issued to your device so we can send you notifications, together with whether that device is Android or iOS.

Crash and error reports. When the app or website encounters an error we record the error, a stack trace, the device and app state around it, and your account identifier so we can tell whether a problem is affecting one person or many.

Server logs. Our servers record IP addresses, timestamps, and request details as part of normal operation and security monitoring.

We do not use advertising identifiers, and we do not run advertising or cross-service tracking of any kind.

On the Duramater website we use Sentry Session Replay to diagnose faults. It records a reconstruction of a browsing session — the pages rendered, and the clicks, scrolls, and navigation within them. It is applied to a small sample of ordinary sessions and to sessions in which an error occurs.

These recordings can include the content displayed on screen during a session, including exam content and answers. They are used only to investigate faults, are retained for a limited period by Sentry, and are not used to assess, rank, or profile you.

Session replay is not used in the Duramater mobile app.

We use personal data to:

• create and maintain your account and sign you in;
• give you access to the test series in your account;
• run exams, save your progress, and let you resume an interrupted attempt;
• calculate your scores, percentile, rank, and analytics;
• issue invoices and meet our tax and accounting obligations;
• send you notifications about your account and test series, where you have allowed them;
• diagnose crashes and faults and improve the reliability of the Service;
• understand which features are used, in aggregate, so we can improve them;
• detect and prevent misuse, account sharing, and unauthorised access; and
• respond to you when you contact us.

We do not sell your personal data. We do not share it with advertisers or data brokers. We do not use your exam data to make automated decisions that produce legal or similarly significant effects for you.

We share personal data only with the service providers that operate the Service on our behalf. Each processes data on our instructions and for no independent purpose of their own.

We may also disclose personal data where we are required to by law, by a court, or by a regulator, or where it is necessary to establish or defend a legal claim. If Duramater is ever involved in a merger, acquisition, or sale of assets, personal data may transfer as part of that transaction; we will tell you before it does.

As the table above shows, some of our providers process data outside India. By using the Service you acknowledge that your personal data may be transferred to and processed in those countries, which may have different data protection rules from your own. We transfer only what each provider needs for the purpose stated, and we place contractual protections on those transfers.

The website uses cookies and browser storage to keep you signed in, to remember preferences such as your light or dark theme, and to keep the Service secure. The mobile app uses your device's secure storage for the same purposes.

The website also keeps a random identifier in browser storage so that our product analytics provider, Mixpanel, can measure how the site is used: which pages are visited, and where people leave sign-up or checkout. Once you sign in, this activity is linked to your account.

We do not use advertising or cross-site tracking cookies. Blocking essential cookies will prevent you from signing in.

We keep your account data for as long as your account exists. When you delete your account, the data described on our account deletion page is removed within 30 days of the request being approved.

Invoices are the exception. If you have ever bought a test series, Indian tax law requires an invoice to carry the buyer's name and requires us to retain those records for 8 years. We therefore keep your name and email address as they appear on those invoices, together with the payment records, for that period. They are held strictly as financial records: they cannot be used to sign in, and we do not use them to contact you or for any other purpose.

Crash reports, session recordings, and analytics data are kept for the limited retention periods applied by the providers named above, after which they are deleted automatically.

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• ask what personal data we hold about you and how we have processed it;
• have inaccurate or incomplete data corrected or updated;
• have your data erased, subject to the invoice retention described in section 11;
• nominate another person to exercise these rights if you die or become incapacitated;
• withdraw a consent you have given, at any time; and
• raise a grievance with us, and escalate it to the Data Protection Board of India.

You can update most profile data yourself from within the Service. For anything else, email support@duramater.in and we will respond within 30 days.

You can request deletion of your account at any time, either from within the mobile app under Profile, or on the web at duramater.in/delete-account. That page lists exactly what is deleted and what is retained, and lets you check the status of a request. You do not need the app installed to use it.

We protect personal data with encryption in transit, access controls that limit staff access to what their role requires, and authentication handled by Google Firebase so that we never hold your password. No system can be guaranteed completely secure, but we take reasonable steps appropriate to the sensitivity of the data we hold.

If a personal data breach occurs that affects you, we will notify you and the Data Protection Board of India as the law requires.

The Service prepares candidates for postgraduate and super-specialty medical entrance examinations and is intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email support@duramater.in and we will delete it.

We may update this policy as the Service changes or the law requires. The effective date at the top of this page always reflects the current version. Where a change materially affects how we use your data, we will tell you through the Service or by email before it takes effect.

For any question about this policy, or to raise a grievance about how we have handled your personal data, contact our Grievance Officer:

We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. You can also read our Terms and Conditions.