Privacy Policy

1. What we collect

• Server logs. The site and its account service run on our own server (Oracle Cloud, Hyderabad, India). Its web server and account service keep standard, short-lived logs (IP address, browser type, requested URL, time) for security and abuse prevention, and to count which pages are requested (the path and the day; the address is not kept with the count). We do not use them to identify you.
• Reports and emails you send us — question-error reports (sent by email from the report control) and support emails, including any name or handle you add for public credit in the fix-log.
• If you sign in: account data — your email and/or mobile number and your name. Signing in is needed only to keep your progress in an account and for paid access.
• If you sign in: how you arrived — the short tag and the page of your first visit, if any (section 4), stored with your account.
• If you sign in: study data — your practice progress, mock attempts and scores, streaks, error notebook, review queue, target exam and display name, so they sync across your devices. Your practice progress includes a log of your answers, practice sittings, card reviews and the notes you read with their times, kept for 13 weeks, and the changes you make to your targets: your own progress pages read them for your minutes, the time of day you study, your reading time and how well your cards stay. The site's owner can open your account's page and read the same study data — your days, minutes and questions, your streak, your topic scores, your mock scores, your sittings, card reviews and notes read — to run and support the service (section 3); never your error notebook or which option you chose, and each such look is written to the account's audit trail. Nothing else reads them. Each synced record carries a random device tag so your devices do not overwrite each other; appearance settings stay on the device. We don't limit devices.
• If you sign in: question reports you send from the report control go straight to our triage queue with the page details you see in the form.
• If you pay: payment status — your plan and its validity date, plus the payment reference: the reference in your UPI payment note and the UPI transaction number (UTR) you tell us. We never receive or store your card details — a UPI payment happens in your own UPI app.
• If you send a payment screenshot — a picture of your UPI app's payment screen, which shows your name, your UPI ID or bank, sometimes your phone number, and the transaction IDs. We use it only to match that payment to your account; hidden details in the image, such as location, are removed when it reaches our server. It stays on our server until your claim is decided, and at most 30 days, then it is deleted; the copies in our database backups are overwritten within the next 14 days. A copy goes with the claim notice to our support mailbox at Zoho Mail (our email provider) and is kept there with our payment records. You can always type the UTR instead of sending a screenshot.

2. What we don't collect

No location, no contacts, no files other than a payment screenshot you choose to send, no advertising identifiers. We don't sell or rent personal data to anyone, ever.

3. How we use it

To run the service: sign you in and sync your progress if you have an account, answer support, fix reported errors and unlock what you paid for. The site's owner may read your account's study data (section 1) to see how the site is used and to help you when you write in — never to rank or compare you with anyone, never to show you anything different, and never to sell. Never for advertising. If you sign up with an email and have not confirmed it after a day, we send one reminder with a fresh link; nothing more.

4. Counting, not tracking

We run no tracker — no Google Analytics, no tracking pixels, no third-party scripts. Our own web server counts, for each day, which pages were opened and how many times, which website a visit came from (its address only, such as google.com), and which short tag a shared link carried (for example ?src=dq on a daily-quiz card). These are totals. They contain no name, no IP address, no device or browser detail, no account, and they are kept as totals on our own server. When you finish today's daily quiz while signed out, your browser sends us one count, at most once a day: it carries no score, no answers, no account and no identifier, and our server keeps only the day's total, not your IP address. We also count, from our own database, how many accounts sign up, confirm their email, come back and pay; a weekly summary of these totals goes to the site's owner. If you create an account, the tag and the page your first visit arrived on are stored on your account, so that we can count which channels bring people who stay; they are never used to show you anything different, and they are removed with the rest of your account when you delete it. There is no Google Analytics, no tracking pixel, no third-party script and no advertising identifier. Emails we send contain no tracking image. If we ever go beyond counting, this section will say so first. The Watch page embeds YouTube videos in privacy-enhanced mode (youtube-nocookie.com); YouTube's own policy applies while a video plays. Fonts are served from our own server; nothing is loaded from a font service.

5. Where data lives (processors)

Signed out, your study data lives only in your browser. Signed in, your account and everything it holds — sign-in, study progress, mock attempts, payment claims and access records, reports and requests — is stored in a database on our own server: Oracle Cloud Infrastructure, Hyderabad (ap-hyderabad-1) region, India, with its backups on the same server. Oracle provides the machine and does not access the data. Until September 2026 accounts and synced progress were held with Google Firebase (Mumbai, asia-south1); that service is closed. Payments go by UPI directly to our UPI ID — card details never touch NurseDrill. The emails we send (account verification, password reset, and the approval or rejection of a payment claim, which goes to your account's email) go through Zoho Mail, which also holds our support mailbox. If you switch on the weekly mail (five questions and what we fixed), at sign-up or on your Account page, it goes the same way, to your confirmed email only, with no tracking image and a one-tap unsubscribe link in every mail. These providers process data for us under their own security and privacy commitments. The daily page counts and the weekly summary we send ourselves are produced on this same server; nothing is sent to an analytics provider.

6. Retention and deletion

Signed out: your data is on your device — the Account page exports it as a file or clears it in one click, and clearing your browser storage does the same. Signed in: your data is kept while your account exists; "Delete my account" on the Account page permanently removes your sign-in record, every synced record and the data on that device, immediately and without contacting us. Our database backups keep a copy of deleted data for up to 14 days; after that it is gone from them too. Records of what was done on an account — access switched on or off, password resets, the reports and requests you sent — are kept for 2 years. Payment records are kept as accounting and tax law require.

7. Your rights and choices

You can see, export, correct and delete your data yourself, from the Account page, for this device and for your account. For anything else — including grievances under Indian law — write to support@nursedrill.in; the grievance process on the Contact page applies (acknowledgement within 48 hours, resolution within 30 days). You may also complain to the Data Protection Board of India under the Digital Personal Data Protection Act 2023, as its sections come into force.

8. Security

Connections are HTTPS everywhere. Your password is stored only as a salted hash (Argon2) on our server, never in the clear; a sign-in is a server-side session that account deletion or a password reset ends everywhere. The account service lets only your own sign-in write your records, and only your own sign-in and the site owner's (section 1; its second factor on) read them; paid content is served only to a signed-in, entitled account. We hold no payment instruments. No system is perfectly secure, but the attack surface is deliberately tiny.

9. Age

NurseDrill is intended for users 18 and over (the exams it prepares you for require it).

10. Changes

We may update this policy. When we do, the effective date at the top of this page changes. That date is how you can tell it has changed.

11. Contact

support@nursedrill.in · full details on the Contact page.

This policy is written to comply with the IT Act 2000 / SPDI Rules 2011 and to be ready for the DPDP Act 2023 as its rules take effect.