Privacy policy

1. Who we are

CUET Free Mock Test is an independent practice website. References to "we", "us" and "the site" mean this project. References to "you" mean a visitor, guest candidate or registered user. The site is not affiliated with the National Testing Agency or any university.

2. Data we collect

We collect only what the product needs to run:

• Account data: username, email address, a password hash if you sign up with email, or a Google account identifier and avatar URL if you use Google sign-in.
• Attempt data: which paper you started, your selected options, marked-for-review state, per-question time, start and deadline timestamps, score, correct/wrong/skipped counts, and whether the attempt is your first for that paper.
• Discussion data: comments, replies, votes, reports and moderation status. Comments are stored as plain text.
• Share data: when you share a question or mock, we store an aggregate event with the shared question's public id or the mock id, the surface, the channel and, if you are signed in, your user id. We do not store an IP address, attempt id, score or recipient in this event.
• Technical data: the IP address and request metadata processed by our hosting provider for security, rate limiting and abuse prevention. We do not build advertising profiles.
• Contact data: whatever you include when you email us about a correction, account or privacy request.

3. Guests, cookies and local storage

You can take a mock test without creating an account. Guest attempts are linked to a random token in a cookie so the same browser can resume and later claim the attempt. We use a small number of essential cookies:

The light/dark preference is stored in your browser's localStorage, not sent to the server. Our hosting provider may set strictly necessary security cookies at the edge. If Google AdSense is enabled on content pages, Google may set advertising or measurement cookies as described in section 11; the active test screen never loads the advertising script.

4. Why we use the data

• To create and secure your account, sign you in and let you reset a password.
• To run an attempt: hide answers before submit, autosave progress, enforce the deadline and calculate the score on the server.
• To show your dashboard, attempt history, solutions and site-relative rank.
• To operate discussions, moderation, reports and abuse controls.
• To investigate errors, protect the service and comply with legal obligations.

We do not sell personal data. We do not use your email to send marketing at launch. If an announcement or email feature is added, it will be described here before it is used.

5. Legal bases

Where data-protection law requires a legal basis, we rely on the performance of the service you asked for (running an attempt or account), your consent (creating an account, posting a comment), our legitimate interest in keeping the service secure and preventing abuse, and compliance with legal obligations. You can withdraw consent for optional features without losing access to the core practice tools.

6. Sharing and processors

The site runs on Cloudflare infrastructure. Cloudflare processes requests and stores the database and media objects on our behalf. If you choose Google sign-in, Google authenticates you and shares the basic profile data needed to create the account. We do not share your email or attempt history with advertisers.

We may disclose data if required by law, to respond to a valid legal request, or to protect the rights and safety of users. If the project is transferred, data may move to the successor entity under the same commitments.

7. Retention

• Account records are kept while the account exists. A deletion request removes or anonymises the profile and associated identifiers, subject to the attempt-integrity note below.
• Attempts and scores may be retained in an anonymised or pseudonymised form because leaderboard and historical-paper integrity depend on them.
• Session tokens expire automatically. Password-reset tokens are single-use and time-limited.
• Technical logs are kept only as long as needed for security and troubleshooting.
• Moderation records may be retained to enforce community rules and document decisions.

8. Security

Passwords are stored as PBKDF2-SHA256 hashes with a per-user salt, never as plain text. Session tokens are random, stored in HttpOnly cookies and kept as hashes in the database. Admin actions require an authorised account and are written to an audit log. No system is perfectly secure, so use a unique password and tell us promptly if you suspect unauthorised access.

9. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or restrict the processing of your personal data, to object to certain processing, or to receive a portable copy. To make a request, email privacy@cuetfreemocktest.com from the address on your account. We may need to verify that the account belongs to you before acting. You can also complain to your local data-protection authority.

10. Children

The site is intended for candidates preparing for undergraduate admissions and is not directed at children under 13. If you believe a child under 13 has created an account, contact us and we will review and delete the account.

11. Advertising and analytics

The site can run Cloudflare Web Analytics, which reports aggregate page views and performance without cookies or cross-site tracking. It can also run Google AdSense on selected content pages after approval. When AdSense is enabled, Google and its partners may use cookies or similar identifiers to serve and measure ads, including personalised ads where consent and local law allow it. You can review Google's advertising controls atMy Ad Center.

Ads are never placed on the active test screen, an in-progress result, a dashboard or any page with little publisher content. If neither integration is configured, the site loads no analytics beacon and no advertising script. Before enabling advertising in a region that requires consent, the operator must configure an approved consent mechanism; this policy will be updated if the integrations or providers change.

12. International processing

Cloudflare and Google operate globally, so data may be processed outside your state or country. Where required, transfers rely on the providers' contractual safeguards. The practice content itself is served from Cloudflare's edge network.

13. Changes to this policy

If the way we handle data changes, this page will be updated and the review date at the top will change. Material changes that affect your rights will be communicated on the site before they take effect.