Toprank Mantra ("we", "us", "the app") is an Android app for UPSC Civil Services exam preparation. This policy explains what data we collect, why we collect it, where it lives, and what choices you have.
1. Data we collect
Google account email + display name — collected when you sign in via Google Sign-In. Used to identify your account and personalise your progress.
Phone number (E.164 format) — collected when you link a phone before a paid purchase. We store an encrypted form using AES-256-GCM; the raw number never leaves our database in plaintext. Used to issue subscription receipts, recover your account if you lose Google sign-in access, and verify identity at purchase time. We never use it for marketing or calls.
Practice progress — which UPSC questions you've attempted, the options you selected, and whether the answer was correct. Used to compute your stats and personalise the experience.
Payment metadata — order IDs, amounts, status, and the Razorpay payment ID for each purchase. We do not store card numbers, CVV, UPI PINs, or bank credentials — those are handled directly by Razorpay.
Device identifiers — an Android-ID-derived hash is used once at trial start to prevent multiple free trials from the same device. The hash is non-reversible.
Diagnostic logs — anonymous error and crash information to fix bugs.
2. Where your data is stored
Neon Postgres (managed cloud Postgres, AWS region ap-southeast-1 Singapore). Primary store for user accounts, progress, and payment metadata. Encrypted at rest by Neon. The phone_hash column stores the AES-256-GCM ciphertext of your phone number; the encryption key lives only on our application server.
Fly.io (Mumbai region bom). Hosts the backend API. Logs are retained for 30 days for debugging.
Firebase Authentication. Used as the OAuth + phone OTP provider. Firebase stores your Google sign-in identifier and (if you've linked one) your phone number, separately under our Firebase project topper-mantra-100.
Razorpay. Processes payments. Razorpay's privacy policy applies during checkout: razorpay.com/privacy.
Google AdMob. Serves ads to free-tier and trial users. AdMob's privacy practices: policies.google.com/privacy.
3. How we use your data
Authenticate you and keep you logged in.
Sync your practice progress across devices when you sign in on a new device.
Process the one-shot Buy Full Access payment and the optional 24-hour free trial.
Detect duplicate trial signups from the same device.
Settle the referral program (10 % off for first-time buyers using a referrer code, 100 points reward to the referrer on first verified payment).
Show ads to free-tier users (we don't show ads to paid users).
Send transactional emails (subscription receipts and feedback acknowledgements).
4. Data we do not collect
Card numbers, CVV, UPI PINs, bank login credentials — these are entered into Razorpay's checkout sheet, never touch our servers.
Contacts, SMS, call logs, microphone, camera, fine location, photos. The app does not request any of these permissions.
Marketing profile data. We do not sell your information.
5. Third-party SDKs in the app
Firebase Authentication / App Check / Play Integrity — Google.
Google AdMob — Google. Personalised vs non-personalised ad consent is handled by Google's UMP SDK in jurisdictions that require it.
Razorpay Checkout — Razorpay Software Pvt. Ltd.
Android Credential Manager — Google, for the Google Sign-In flow.
6. Your rights
Access / export. Email us at toppermantrafeedback@gmail.com from your registered Google account to receive a copy of your data within 30 days.
Deletion. Email us the same way to delete your account. We will purge your user record, progress, and phone-hash within 30 days, except records we are legally required to retain (e.g. payment receipts under Indian tax law — 8 years).
Opt-out of personalised ads. Use your Android device's Ad Settings to reset / opt out of the Advertising ID.
7. Children
Toprank Mantra is intended for users 18 years and older. We do not knowingly collect data from children under 13. If we learn that we have, we will delete it.
8. Security
All API traffic uses HTTPS with TLS 1.2+. Phone numbers are stored as AES-256-GCM ciphertext. JWTs are HMAC-SHA-256 signed. Razorpay HMAC signatures are verified server-side on every payment confirmation.
9. Changes to this policy
If we change this policy materially, we will update the "Last updated" date above and notify you in the app on next launch. Continued use of the app after such notice constitutes acceptance.
Toprank Mantra is an independent exam-preparation app. It is not affiliated with, endorsed by, authorized by, or representing the Union Public Service Commission (UPSC), the Government of India, or any government body. "UPSC" and exam names are used only to identify the examinations this app helps you prepare for. There is exactly one source of official information in this app: every previous-year question paper shown (Preliminary General Studies Paper I and CSAT Paper II, Mains General Studies Papers I–IV, and the Essay paper) is reproduced from a single official source — the UPSC Previous Year Question Papers page, upsc.gov.in/examinations/previous-question-papers. No other government or official source is used. The indication of the correct option, all answer explanations, topic insights, takeaways, and "Wormhole" links are our own independent editorial content and are not official UPSC material.