What we hold, and why.

Astaris is operated by Harshit Tewari, a sole proprietor carrying on business as “Astaris”, having its principal place of business at L-6/45, Sector L, Aliganj, Lucknow, Uttar Pradesh 226024.

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act) we are the Data Fiduciary for the personal data described here — we decide why and how it is processed. You are the Data Principal.

Astaris is offered to users in India. It is not directed at, or offered to, people in the European Union or the United Kingdom, and this policy is not written to the GDPR.

Nothing here is aspirational. Each row corresponds to data that actually exists in our database today.

Account identity

Your email address, and a display name if you give us one. We never derive a name from your email address. If you sign in with Google we receive your Google account identifier, email address, and the name and profile picture on that Google account — nothing else from your Google account. If you use a password, it is hashed by Supabase Auth and is never visible to us.

Profile settings

Target exam, target year, whether your attempt history is private or visible on the leaderboard, your account tier (free or paid), and your referral code.

Exam background

If you fill in your exam profile: how many times you have sat CAT, your best percentile so far, the year you are targeting, and — only when that year is the current one — your CAT registration number. You choose whether to give us any of it. The registration number is used for one thing: checking that a scorecard you send us later is yours. We will never ask you for your CAT portal password, and we do not log in to any examination portal on your behalf. None of this is shown to other users, and none of it is used publicly unless we ask you separately and you agree.

Practice activity

One record per question you attempt: which question, the option you selected or the value you typed, whether it was correct, how long you took in milliseconds, and the option order you were shown (kept so a disputed question can be replayed exactly as you saw it).

Tests and mocks

One record per test: when it started, the server-issued section deadlines, its state, the blueprint used to assemble it, and your score once submitted.

Progress and game state

Experience-point events (what you earned, how much, and what it came from), your current and best streak, the date you were last active, and your progress through any lessons you open.

Referrals

If you were referred, a link between your account and the account that referred you, and the date it was created. If you refer people, the referral rewards you have earned (amount, date counted, date paid) and, only if you give it to us so we can pay you, your UPI ID. Your UPI ID is used for nothing else and is deleted with your account.

Study groups

Nothing is shared until you accept an invite or create a group. After that, the other members of that group, and only them, can see your display name (or “Member 2” if you have not set one), your position in the group's rankings (overall and by section, from your latest mock), how much your estimated percentile has improved since your first mock, and this week's practice count, streak and mocks. Members never see your marks, scores or band. Nor which paper you sat, the questions, the options you chose, or your Foundation drills. You can leave a group at any time and your data stops appearing straight away. A group owner can remove a member, and your membership record is deleted with your account.

How you found us

If the link you first arrived on carried a tag (for example ?src=reddit), that tag and any campaign name with it; the page you first landed on; and, when there was no tag, the name of the website that linked to us (for example www.reddit.com, never the full address of the page). Recorded once, when you create your account, so we know which places are worth our time.

Email preferences

Whether you have said yes or no to emails from us, when, and which version of the wording you answered (the version that mentions reminders, or the earlier one that did not); and, if you asked, that you want one email when Pro opens. For each reminder we send, a record of which one and the date, so we send no more than we should.

Payments

If you subscribe: the Razorpay order and payment identifiers, the plan, the amount, the currency, the state of the payment, and the dates. Card, UPI and bank details never reach our servers — they are handled entirely by Razorpay, our payment processor.

Starred questions

The questions you star for revision, and when you starred them.

Issue reports

If you report a problem with a question, the question and the note you wrote, linked to your account so we can come back to you.

Technical data

A session cookie that keeps you signed in; and, in server logs and error reports, your IP address, browser user-agent and the request path. We use these for security, abuse prevention and debugging.

This section describes processing that is invisible in the interface, which is exactly why it is spelled out here.

From your attempts we compute and store an internal, per-topic model of your performance. For each topic in our syllabus taxonomy it holds a performance tier, your rolling accuracy, how fast you answer relative to your own and other attempts, and a priority score that ranks the topic against every other topic for you. It also keeps the history of how those values moved from test to test.

The model exists to do three things:

• decide which questions and which difficulty to serve you next, and assemble your remediation, optimisation and personalised-mock tests;
• produce the analysis you see after a test; and
• avoid re-serving you questions you have recently answered.

The model is not shown to you, not shown to other users, and not published in any form. It is not used for advertising, is not sold or shared with advertisers or data brokers, and is not used to make any decision about you that has a legal effect or a similarly significant effect. It only decides what questions you get next.

It is nonetheless personal data about you, because it is derived entirely from your own activity. It is therefore included when you ask for a summary of your data, and it is destroyed along with everything else when you delete your account.

We process your personal data on the basis of the consent you give when you create an account and accept these terms, and — where they apply — the certain legitimate uses permitted by section 7 of the DPDP Act, such as complying with a legal obligation or responding to a court order.

• To run your account — identity, profile settings, session cookie.
• To deliver the product — attempts, tests, the learner model, lesson progress, streaks and experience points.
• To take payment and enforce free-tier limits — payment records and account tier.
• To improve the question bank — aggregate item statistics such as how often a question is answered correctly and how long it takes, which is how we recalibrate difficulty and find broken questions.
• To keep the service secure — logs, error reports, rate limiting and abuse detection.
• To contact you about your account, a payment, or a change to this policy.
• To send you study-tip and reminder emails — only if you said yes, which is asked separately and never assumed. Reminders are sent for three reasons: you signed up but have not yet sat your Mock; you have been away from practice for a while; or you have a streak that is about to break. We decide who gets one from your own activity on Astaris. Every reminder has a one-click link to stop all of these emails, which works without signing in; you can also stop them, or change your answer, at any time on your account page.
• To learn which places are worth our time — how you found us, counted across all learners.

You can withdraw your consent at any time. The simplest way to withdraw it completely is to delete your account, which is described in section 8. Withdrawing consent does not make past processing unlawful, and we may keep the records section 7 obliges us to keep.

We do not sell personal data and we do not share it for advertising. We use the following processors, each of which handles data only to provide its service to us:

Vercel

Application hosting and request logs, and cookieless analytics that count page views and referrers in aggregate. It does not store anything on your device and does not identify you. Processed in the United States.

Sentry

Error tracking — when something breaks, it receives the technical details of the failure so we can fix it. We have deliberately disabled the sending of personal data and session recording, so it receives diagnostics, not your answers or your identity. Processed in the European Union (EU).

Supabase

Database, authentication and file storage — this is where your account and activity live. Hosting region: ap-south-1 (Mumbai, India).

Google

Only if you choose to sign in with Google, and only to authenticate you.

Razorpay

Payment processing. Razorpay is the processor of record for your payment instrument and has its own privacy policy.

Apple iCloud

Our nightly backups of the database, kept for 30 days. Each one is encrypted (AES-256) before it leaves our computer, with a key only we hold, so Apple cannot read them.

Email delivery

Resend, for sign-in codes, password resets, account notices and, if you said yes, our study-tip and reminder emails.

Some of these providers store or process data on infrastructure outside India. The DPDP Act permits such transfers except to countries restricted by the Central Government, and we will stop using any provider that falls under such a restriction.

We will also disclose personal data where the law requires it — a valid order from a court or a competent authority, for example — and where it is necessary to establish or defend a legal claim.

• Account and activity data — for as long as your account exists. When you delete your account it is erased as described in section 8.
• Payment records — retained after account deletion, because Indian tax law requires us to keep our books of account. We keep only the transaction facts (amount, currency, plan, payment identifiers, dates). Your name, email and account identifier are not kept with them; in their place we store a reference derived from a secret key that exists only in our production systems and not in our source code, so the record cannot be traced back to you by anyone who does not hold that key. We hold it deliberately, so that a refund or a chargeback arriving after you have left can still be matched to the right transaction — which means this is pseudonymisation rather than anonymisation, and we would rather say so plainly. We keep them for as long as tax law requires us to keep our books, and no longer.
• Server and error logs — 30 days, after which they are discarded on a rolling basis.
• Item statistics — today, how hard a question proves to be is computed live from attempt records, so deleting your account also removes your contribution to it. If we later store those statistics separately, they will be aggregate counts that do not identify you.

• Access — a summary of the personal data we hold about you and how we process it, including the learner model, and the identities of anyone we shared it with.
• Correction and completion — to have inaccurate or incomplete data corrected or updated. You can change your name and profile settings yourself in the app.
• Erasure — to have your personal data deleted, subject only to what we are legally required to retain.
• Withdrawal of consent — at any time, as easily as you gave it.
• Nomination — to nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Grievance redressal — to complain to us first, and to the Data Protection Board of India if we do not resolve it.

To exercise any of these, use the controls in your account settings or write to support@astaris.in.

You can delete your account yourself from your account settings. It is a confirmed, deliberate action, and it is not reversible.

When you confirm, we immediately and permanently destroy:

• every attempt you have recorded, including timings;
• every test or mock, its blueprint and its score;
• your learner model — every per-topic tier, accuracy figure, speed figure and priority score derived from your attempts;
• your experience-point history and your streaks;
• your lesson progress;
• your starred questions and your issue reports;
• your referral links, in both directions — the record that you referred someone, and the record that someone referred you;
• your referral rewards, including any not yet paid, and your UPI ID;
• your name, referral code and profile settings, which are cleared at the same moment.

Your sign-in record itself — the row that holds your email address and password hash — is removed by a separate privileged process shortly afterwards, because deleting it requires a level of access the app deliberately does not have. Until it runs, that record holds nothing but your email address and the fact that deletion was requested. Target: 72 hours.

What survives, and only this: the transaction records described in section 6, held against a pseudonymous reference because tax law requires us to keep our books; and encrypted backups, which are deleted after 30 days and are never used to restore a deleted account.

• Row-level security is enabled on every table in our database, so a query can only ever reach your own rows. This is our security perimeter, not a convenience.
• Answer keys, scores, payment tier and experience points are server-computed and read-only to the browser — the interface cannot write them even on your own account.
• Passwords are hashed by Supabase Auth; we never see them.
• All traffic is encrypted in transit.

If a personal data breach occurs we will notify the Data Protection Board of India and every affected user in the manner and within the timelines required by the DPDP Act and its Rules. We maintain an internal runbook for this. In practice that means telling you without delay, and giving the Board an initial intimation without delay followed by full particulars within 72 hours.

Astaris is intended for users aged 18 and over. We do not knowingly create accounts for children, and we do not track, behaviourally monitor or advertise to children. If we learn that we hold a child's personal data without verifiable parental consent, we delete it.

We set our own cookies only. The session cookies keep you signed in and protect the sign-in flow. Before you have an account, two more may be set: one holds a friend's referral code if you followed their link, and one holds how you arrived (the link's tag, the page you landed on, or the name of the site that linked to us). They contain nothing about you, are never shared, last at most 30 days, and are deleted once you sign in and they have been recorded. We do not use advertising cookies and we do not run tracking pixels.

We do measure how the site is used, with cookieless analytics — it counts page views and where visits came from, without storing anything on your device and without building a profile of you. That is why you do not see a cookie banner here: nothing is stored on your device beyond keeping you signed in and remembering how you arrived until you sign up.

If we ever adopt analytics that do set cookies or track individuals, this policy will change first and we will ask for your consent before it starts.

If you are unhappy with how we have handled your personal data or a request, contact our Grievance Officer:

We will acknowledge your request within 2 business days and respond within 30 days — in no case later than the ninety days allowed by the DPDP Rules. If you are still not satisfied, you may complain to the Data Protection Board of India.

If we change how we process personal data in a way that affects you, we will update this page and tell you by email before the change takes effect. The version number and date at the top always describe the policy currently in force.