Privacy Policy

Last updated 11 September 2026

This page explains exactly what Calibrate Physics stores about you, why, who else can see it, and how to get rid of it. It describes what the site actually does today, not what a template says a website might do. If something here is unclear, write to us and ask.

1. Who we are

Calibrate Physics is operated by Pratik Prahladka, an individual educator based in India. It is not a registered company. For anything about your data, including deletion, write to support@calibratephysics.com.

2. What we collect, and why

Your account

Your email address, and your name if you give one or if Google supplies it when you sign in. We record whether your email has been verified, when the account was created, and whether it has been disabled.

If you set a password, we never store the password itself. We store a one-way PBKDF2 hash of it with a random salt. That hash cannot be turned back into your password, which is also why nobody here — not even an administrator — can ever tell you what your password is. If you are locked out, use “Forgot password”.

Signing in with Google

If you use “Continue with Google”, Google tells us your Google account identifier, your email address, whether Google has verified that address, and your name. We store the identifier so we recognise you next time. We never receive your Google password, and we do not keep the access token Google issues — it is used once, in memory, to read those few details and is then discarded. We ask Google for nothing beyond sign-in: no Drive, no Gmail, no contacts.

Keeping you signed in

When you sign in we put a random token in a cookie and store only its SHA-256 hash. If our database were ever exposed, the stored value could not be used to sign in as you. Sessions last 30 days.

Verification and password-reset emails

We create short-lived, single-use tokens for verifying your email and resetting your password, and store only their hashes. They expire, and are deleted once used.

Your tests

When you submit a test we save your answers, which questions you got right, your score and when you took it, so you can see your history and your weak areas. While a test is in progress we also record which question you are on, so you can resume if your connection drops.

Test-integrity events

Timed tests detect when the test window loses focus. We record how many such events happened in a sitting and on what date — nothing more. After three, the attempt is marked disqualified.

We deliberately do not keep the moment you left, the moment you came back, how long you were away, or which question you were on when it happened. We used to. It was never read by anything, and a count and a date are all that an appeal against a disqualification needs, so the rest is no longer collected and the records already gathered were discarded.

Protecting sign-in from abuse

To stop someone guessing passwords or flooding signups, we count recent attempts per email address and per network address. We do not store the email address or the IP address to do it: each is passed through a keyed one-way digest first, so the stored value cannot be turned back into an address. These records are swept every hour, and none survives longer than about three hours.

Administrative records

When an administrator takes an action on the site — disabling an account, assigning a test, deleting an account — we log what was done and when. This is how we can answer “what happened to my account?”. These records hold an action name, a target and a timestamp.

Classes and assigned tests

If your teacher puts you in a group or assigns you a test, we store that membership and that assignment, and your teacher can see your results for tests they assigned you.

3. Cookies

The site sets exactly two cookies, both strictly necessary:

• cp_session — keeps you signed in. 30 days.
• cp_oauth_state — a one-off security value that protects the Google sign-in flow from being hijacked. It lasts ten minutes and is deleted the moment sign-in completes.

There are no analytics cookies, no advertising cookies and no third-party tracking scripts of any kind. This is not a promise about intent — there is no such code on the site.

4. Who else is involved

Three companies handle parts of this service, and only for that purpose:

• Google — only if you choose “Continue with Google”, to confirm who you are.
• Resend — delivers verification and password-reset emails. It necessarily handles your email address and the contents of those messages.
• Cloudflare — hosts the site and stores the database. Your data lives on Cloudflare infrastructure.

Each of these has its own privacy policy. We do not sell your personal data, we do not share it with advertisers or data brokers, and we do not use it to profile you for advertising.

5. How long we keep things

• Your account and test history — until you ask us to delete it.
• Sign-in sessions — 30 days, or until you sign out.
• Verification and reset tokens — minutes to hours; deleted once used.
• Rate-limiting records — about three hours at most, swept hourly.
• Administrative records — kept, with the person no longer identified once their account is deleted.

6. Deleting your account

Email support@calibratephysics.com from the address on your account and ask us to delete it. We will remove your account, your name and email, every test attempt and score, your sign-in sessions, any Google sign-in link, your group memberships and your assigned tests. The deletion is verified afterwards, so “deleted” means the rows are actually gone rather than assumed gone.

Two honest limits:

• Administrative log entries are kept, but you are no longer named in them — they become a record that something happened, not a record about you.
• Emails already sent to you sit in your own inbox, and copies may remain with Resend under their retention policy. We cannot reach into either.

7. Security

Passwords are hashed with PBKDF2 and a per-user salt. Session tokens are stored only as hashes. The site is served over HTTPS and the session cookie is marked secure and HTTP-only, so scripts in your browser cannot read it. Administrative pages check your role on the server, never in the browser.

No system is perfectly secure, and we would rather say so than imply otherwise. If you find a security problem, please tell us at support@calibratephysics.com before telling anyone else.

8. Students under 18

Most people preparing for JEE, NEET and MHT-CET are school students, and many are under 18. India’s Digital Personal Data Protection Act, 2023 treats anyone under 18 as a child. It requires a data fiduciary to obtain verifiable consent from a parent or lawful guardian before processing a child’s personal data (section 9), and it prohibits tracking and behavioural monitoring of children, subject to exemptions that may be prescribed (section 9(3)). The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, with different provisions commencing on different timelines.

We are telling you plainly where this stands rather than claiming more than we can support:

• What we have done. We reviewed everything the site records and removed what it did not need. In particular, the test-integrity system used to keep detailed records of when a student left a test window and which question they were on. That is precisely the kind of behavioural detail the Act singles out, it served no purpose the site actually used, and it is gone.
• What we are not claiming. We are not asserting that counting test-window events falls within any exemption for children. That is a question for a qualified lawyer, and we would rather flag it than paper over it.
• What is not built yet. We do not currently operate a verifiable parental-consent mechanism. If you are a parent or guardian and want to know what we hold about your child, or want it deleted, email support@calibratephysics.com and we will act on it.

This policy is written to describe our practices accurately and with Indian data-protection requirements in mind. It is not a legal opinion, and it is not a claim of certified compliance.

9. Your choices

• See what we hold — your account page shows your details and your test history.
• Correct something that is wrong — email support@calibratephysics.com and we will fix it. There is no self-service edit for your name yet.
• Ask for a copy of your data, or for it to be deleted, by emailing support@calibratephysics.com. We will respond as quickly as we reasonably can.
• Stop using Google sign-in at any time by setting a password instead.

If you are unhappy with how we have handled your data, write to support@calibratephysics.com and say so directly. We would much rather hear it.

10. Changes

If we change what we collect, we will update this page and change the date at the top. Where a change is significant, we will say so rather than leave you to spot it.

Questions about any of this? Contact us. See also our Terms of Service.