Privacy policy

1Who is responsible#

Birana TET is operated by the EaglesDigiTech team — founded and owned by Birbal Nag — from Sainthia, West Bengal, India, PIN 731234. EaglesDigiTech is the data controller for this site, and Birbal Nag answers for it personally. For anything in this policy, including a request to see or delete your data, that is where to write.

Write to support@birana.in.

2You can use most of the site without an account#

The syllabus, the exam pattern, study material, past papers and the official updates can all be read without signing in, and nothing on those pages identifies you.

An account is needed only for the things that have to remember you: practising, sitting a mock test, bookmarks, revision and your own performance figures.

3What we collect when you register#

• the name you enter, which is used to address you in the interface
• your email address, which identifies the account and receives the messages this site sends: email verification, password resets, a notice if your password is changed, and — if you buy a plan — a receipt confirming what was bought and until when
• your password, stored only as a hash — it is never kept in a readable form, so it cannot be looked up or sent back to you

4What we collect while you use it#

This is the data that makes the site useful to you, and it exists so that it can be shown back to you.

• the answers you choose, the questions you attempt, and how long you spend
• mock-test attempts, including the clock, and the marks awarded
• your accuracy by subject and topic, which is what the performance page reports
• bookmarks, revision items and how far you have read a study-material page
• how much of a plan allowance you have used in the current period

5Technical records kept for security#

Each sign-in session records the IP address and the browser identification string it was created from, so that a session can be recognised and revoked. Security events — signing in, a failed sign-in, registering, verifying an email, changing or resetting a password — are written to an audit log with the same two items and a request identifier.

These exist to protect the account. The site also counts failed sign-in attempts and locks an account temporarily after too many, which is why the count is stored.

6If you buy a plan#

The card, UPI or net-banking step happens on Razorpay’s own checkout, not on this site. Your card number, CVV, UPI PIN and bank password are entered there and are never sent here, so this site has never held one and has nothing of that kind to lose.

What is written down here is the record of the payment itself: which plan, the amount and currency, how many days it bought, the order and payment identifiers Razorpay issues, whether it succeeded, and if it failed the reason the gateway gave. The gateway’s own notification is stored alongside it as evidence that a term was granted for a payment that really happened — reduced, before it is saved, to the payment and order identifiers, the amount, the status, the method as a word such as “card” or “upi”, the gateway’s fee, and any error it reported.

That reduction is deliberate. A gateway notification arrives carrying more than that — the email address and phone number you typed into the checkout, the last four digits of the card with its network and issuing bank, the UPI handle — and none of it is needed to know that a payment was made, so none of it is kept. Razorpay holds the full record under its own privacy policy, and a payment can always be traced there by the identifier stored here.

When a payment succeeds, a receipt is sent to the account’s email address naming the plan, the amount, the length and the date the term ends, together with the gateway’s payment reference. It is sent once, on the payment being granted, and is not a marketing message: there is no mailing list on this site and nothing else is ever sent from a purchase.

Payment records are kept even if you later delete your account: a business has to be able to account for money it received. They are kept as the record of a transaction, detached from the deleted account.

7Advertising#

No advertising runs on this site today. There is no advertising script on any page, no advertising cookie is set, and nothing about you is sent to an advertising network.

What follows describes what would change if that stops being true. It is written in advance, rather than after the first advert appears, so that nobody has to take it on trust afterwards — and the sentence above changes on the same deploy as the first advert, because the page and the advertising are driven by the same setting.

If advertising is introduced it will be supplied by Google AdSense. Google would then be a third-party vendor on this site and would use cookies to serve adverts, which lets it and its partners show you adverts based on your visits to this site and to others. Those cookies would be set by Google, not by us: we would not see them, and we would not send Google your name, your email address, your answers or anything else from your account.

Even then, no advert would be placed inside a timed mock test or a practice run. An advert beside a running clock is a distraction a candidate never agreed to.

• You can turn personalised advertising off for your Google account at any time, at google.com/settings/ads. The adverts do not stop; the personalising does.
• You can opt out of other vendors’ use of cookies for personalised advertising at aboutads.info/choices, and in Europe at youronlinechoices.eu.
• In the EEA and the UK no advertising cookie is set, and no personalised advert shown, unless you have been asked and have agreed — and you can change that answer later.
• This is a site for adult candidates. No advertising here is aimed at children, and none is targeted at anyone under 18.

8Server logs#

Like every web server, the one serving this site records the requests it receives: the address asked for, the time, the response code, the IP address it came from and the browser identification string it sent. That is how a fault gets diagnosed and how abuse gets noticed.

These are ordinary operational records rather than a profile. They are not joined to your account, not used to work out who you are, and not given to anyone for marketing. The API also counts how often one address asks for pages and slows down anything pulling them faster than a reader would, which is what keeps the question bank from being taken wholesale.

9What we deliberately do not collect#

• no analytics of any kind — there is no Google Analytics, no tag manager, and no measurement script on any page
• no advertising, and no advertising identifiers
• no third-party trackers, social widgets or embedded pixels — the payment gateway’s checkout is the only outside script the site ever loads, it is fetched only when you ask to buy a plan, and it is not present on a page you are simply reading
• no card numbers, no CVV, no UPI PIN and no bank credentials — the payment step happens on the gateway’s own pages and none of it is sent here, so there is nothing of that kind to store
• no location, no contacts, no device identifiers, and no access to anything on your phone
• no files: there is nothing to upload here, so nothing of yours is stored or sent anywhere for processing

10Cookies#

The site sets one cookie, and only after you sign in. It holds a sign-in token, is marked HttpOnly so page scripts cannot read it, is marked Secure so it travels only over HTTPS, is set to SameSite=Strict so it is not sent from other sites, and is scoped to the sign-in endpoints so it is not attached to ordinary page requests. It is replaced with a new value each time it is used.

The short-lived token that authorises requests is held in the page’s memory only and disappears when the tab closes. The site stores nothing in local storage.

If you install the site as an app, it keeps an offline page, one icon and its own program files in the browser’s cache so that it can open without a connection. No page you visited and nothing about you is stored there.

If you ask to buy a plan, the payment gateway’s checkout opens over the page and may set cookies or storage of its own, for its own purposes and under its own policy. It is loaded at that moment and not before, so until you choose to pay there is nothing of it on any page.

There is no consent banner because there is nothing to consent to: the one cookie the site sets is what signs you in, and without it the account could not work.

11Why we are allowed to hold it#

Account and learning data are processed to provide the service you asked for when you registered — without them there is no account and no performance record. The security records are kept because an account system that cannot recognise or stop abuse is not safe to offer.

We do not rely on your data for any purpose beyond running the site, and we do not profile you for advertising, because there is no advertising.

12Who else can see it#

Three suppliers necessarily hold data in order to run the service, and no one else does:

• Supabase, which hosts the managed PostgreSQL database in which everything above is stored. The database is in the ap-south-1 region, which is Mumbai, India.
• Hostinger, which hosts the site and the API and carries the outgoing email for verification and password-reset messages.
• Razorpay, which takes the payment if you buy a plan. It runs the checkout, so it — and not this site — receives the card or UPI details and whatever contact details the checkout asks you for, and it holds them under its own privacy policy. Nothing is sent to Razorpay unless you start a payment.

Your data is not sold, rented, shared for marketing or passed to anyone else. It would be disclosed only if the law required it, and we would tell you unless prevented from doing so.

13How long it is kept#

Account and learning data are kept while the account exists, because their whole purpose is to be shown back to you over time.

A sign-in session expires after at most thirty days and is removed or revoked before that if you sign out. A password-reset link is valid for thirty minutes and an email-verification link for a limited period; both become useless once used.

Security audit entries are kept longer than sessions, because their value is in showing a pattern. If you delete your account, they are anonymised or removed with it.

14Your rights#

You can ask to see what is held about you, to have something corrected, or to have your account and its data deleted. Write from the address the account uses, or tell us enough to identify it safely.

Deletion is what it sounds like: the account, the answers, the attempts and the performance figures go, and they cannot be restored afterwards.

You can also change your name or password yourself from the account page at any time.

15Children#

This is a preparation site for a teaching eligibility examination, and it is meant for adult candidates. It is not directed at children, and accounts are not knowingly created for anyone under 18. If you believe a child has registered, write and the account will be removed.

16How it is protected#

• passwords are hashed, never stored in a readable form
• the sign-in cookie cannot be read by page scripts and is replaced every time it is used
• repeated failed sign-ins lock an account for a period
• the whole site is served over HTTPS, and browsers are told to refuse anything else

No system is beyond compromise. If one happened here that affected your data, you would be told what was affected and what to do.

17Changes to this policy#

If what the site does with data changes, this page changes with it and the date at the top moves. Where a change matters to you — a new supplier, a new category of data — it will be said plainly rather than absorbed into the wording.