Privacy Policy

1. Scope and operator

This policy covers prep.topall.app, TopAll’s NEET and JEE study website. Other TopAll products and external services may have their own notices.

Operator: VVT Solutions Pvt Ltd. Contact office: Ali Center, 4th Floor, No. 18, Greams Road, Thousand Lights, Chennai 600006, India.

For account, privacy or content questions and complaints, email support@topall.app or call +91 44 48552505.

Grievance Officer: Aditya. Contact the officer at support@topall.app, with “Privacy grievance” in the subject.

Personal-information grievances must be addressed promptly and within one month of receipt, as required by the applicable Information Technology (Sensitive Personal Data or Information) Rules, 2011.

2. Information used by this website

• Account details: email address, display name, chosen exam, account identifier, sign-in provider and account creation date. New registrations also store the age group and policy declarations described below.
• Sign-in: the email and password you submit are processed to create or verify your account. The hosted service uses Google Firebase Authentication / Identity Platform. The application stores the provider’s account identifier; local development accounts use a salted password hash.
• Learning records: signed-in question answers, correctness, quiz settings, question snapshots, answers, review flags, start and completion times, scores and earned XP. These support saved progress, quiz results and your dashboard.
• Request and security information: session identifiers and anti-forgery tokens support sign-in and forms. Sign-in rate limiting uses a hashed combination of the request IP address and email. Hosting and external services receive request information needed to deliver their services.

3. Why information is used

Account information is used to sign you in, show your profile, save and retrieve your learning history, and protect account actions. Practice and quiz data are used to mark answers and show your own results. The signup declarations record the choices made during registration. This website does not ask for payment-card details, precise GPS location, a school grade or identity documents to create a student account.

4. Browser storage and cookies

Necessary cookies keep a signed-in session or protect forms against forged requests. The application’s session cookie expires after 24 hours unless replaced by a new sign-in; signing out removes the current session.

Your browser may keep practice answers, theme preference, daily warm-up exam choice, resource-view counts, PDF reading progress and saved college choices in local storage. These can remain on a shared device after sign-out. Clear this site’s browser data to remove them; clearing local data does not delete learning records already saved to an account.

You can read public study pages without creating an account. Account features need the account information described above. Blocking browser storage can affect sign-in, forms and saved local progress.

5. Service providers and external content

Google Cloud and Google Firebase Authentication / Identity Platform support the hosted website and sign-in. Pages request fonts from Google Fonts. Video pages load YouTube players or thumbnails; PDF rendering may request character maps from the jsDelivr content delivery network. These requests can disclose information such as your IP address, browser details and the page or media requested to those providers, and their services may use their own storage.

External services are governed by their own notices, including Google’s Privacy Policy and jsDelivr’s Privacy Policy. Provider processing may occur outside India; this policy does not promise that every copy of data stays in one city or country.

Account and learning records are held in the application’s account storage and are not included in the public study catalogue. Information may also need to be disclosed where required by applicable law.

6. Students under 18 and parents or guardians

Students under 18 may create an account with permission from a parent or legal guardian. Before registration, the parent or guardian should review these Terms of Use and the Privacy Policy with the student.

Registration asks whether the student is under 18 and, if so, asks them to declare that they have that permission. It also records agreement to the terms, consent to the described account-data use, the policy versions and the date. We do not collect a date of birth or parent identity documents in this flow, and this declaration is not independent verification of a parent’s identity or consent.

A parent or guardian can contact support@topall.app about their child’s account. Please do not email a password, an identity document or sensitive personal information unless a specific, necessary verification step has been explained.

7. Retention and account choices

Personal information must not be kept longer than needed for its lawful purpose or an applicable legal requirement. Account and learning records support your account, saved progress and results. Retention and deletion requests need manual review, including any records that must be kept by law; the website does not currently run a fixed automatic account-deletion schedule.

Signing out or clearing browser data does not erase server records. A retention requirement is not permission to keep information indefinitely after its lawful purpose has ended.

You can change your display name and target exam, change your password and sign out in Account settings. Self-service export and permanent account deletion are not available there.

To ask to review or correct information, withdraw consent, request a copy, or request account closure and deletion, email support@topall.app from the account’s email address where possible and explain the request. A parent or guardian can explain their relationship to an under-18 account holder. Do not include your password. A request may need proportionate identity verification; legal retention requirements and service-provider copies may affect what can be removed. Withdrawal may mean the related account features can no longer be provided.

8. Security and changes

The application restricts account actions to the signed-in account, checks forms against cross-site forgery, limits repeated sign-in attempts and uses protected session cookies. These measures reduce risk; this policy does not promise that a service is immune to security incidents.

The date and version below identify this notice. Material changes to how account information is used require an updated notice and, where needed, a further choice from the account holder. A privacy notice does not replace any rights available under applicable law.