Privacy Policy
Last updated: 29 October 2026
Topical Vault (“we”, “us”) is a free, non-commercial revision resource for Cambridge International past papers, run from India. This policy explains what personal data we collect, why, who processes it, how long we keep it and how you can control it. It is written to meet India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), under which we are the Data Fiduciary for your account data.
The short version
- You can use the 2025–2026 questions without an account. We collect nothing personal from you in that case.
- If you create a free account, we store only your email, a username and your revision progress.
- No advertising, no analytics or tracking, no selling or sharing of your data, and no marketing emails.
- You can download or delete your data yourself at any time.
What we collect and why
| Data | When | Why we need it |
|---|---|---|
| Email address | You create an account | To sign you in, confirm the address, and send password-reset emails. Never used for marketing. |
| Username | You create an account | To show which account you’re signed in to. Only you see it. |
| Password | Email sign-up only | To sign you in. Stored only as a salted one-way hash by our sign-in provider; nobody (including us) can read it. |
| Revision progress: questions marked “done” and your custom practice paper | You use the site while signed in | To sync your progress across your devices. |
| Social sign-in details: email, name, profile-picture link, account ID | Only if you choose to sign in with a social account | Your social account provider shares these with our sign-in provider to create your login. We only use the email address. |
| Sign-in records: time of sign-in, IP address, browser | When you sign in | Kept by our sign-in provider to secure your account and detect abuse. |
| Short-lived security counters | Each request to our sign-in and question servers | To stop floods and abuse (rate limiting). Stored as a one-way hash of your IP address, not the address itself, and deleted within minutes (database) or 24 hours (web server). |
| Web server logs: IP address, page requested, time | Any visit | Kept by our web host and content delivery network for security and troubleshooting, as with any website. |
We do not ask for your real name, date of birth, school, phone number, location or any payment details. The legal basis for account data is your consent, given when you sign up (section 6, DPDP Act). Security logs and counters fall under legitimate uses (section 7) needed to keep the service safe.
Who processes your data
We use these service providers (“Data Processors”) and don’t share your data with anyone else:
- Authentication and database provider: accounts, sign-in and the progress database. Data is stored in Mumbai, India.
- Web hosting provider: hosts the website and keeps standard web-server logs.
- Content delivery and security network: every visit passes through it on the way to our server, to speed up the site and block attacks and abusive traffic. It processes your IP address and the pages you request for that purpose only. It also gives us anonymous visit statistics (pages viewed, referring site, country, browser and device type, and page-load speed) without cookies or any other storage on your device, and without following you across sites.
- Bot-protection service: the “are you human?” check on the sign-up, sign-in and password-reset forms. It is only loaded on those pages and doesn’t track you across sites.
- Social sign-in provider: only if you choose to sign in with a social account.
The site’s fonts and code are served from our own server and delivered through the network above; browsing the site doesn’t send your data to anyone else.
How long we keep it
- Account data and progress: until you delete your account. Deletion is immediate and permanent in our database; copies in our providers’ routine backups are overwritten within their normal backup cycle.
- Accounts you stop using: kept until you delete them. If we ever start removing long-inactive accounts, we’ll email you first.
- Security counters: minutes to 24 hours. Server and sign-in logs: as long as our providers keep them for security, typically days to weeks.
Cookies and browser storage
We don’t use advertising, analytics or tracking cookies (our visit statistics don’t use any). Everything below is strictly necessary for a feature you’re using, so no cookie consent banner is needed. You can clear all of it at any time through your browser’s “clear site data” option.
| Name | Type | Purpose | Lasts |
|---|---|---|---|
tv_at | Cookie (secure, HttpOnly) | Only set when you’re signed in. Proves to our server that you may view pre-2025 papers. | Up to 1 hour, renewed while you use the site; removed on sign-out |
sb-…-auth-token | Local storage | Keeps you signed in (set by our sign-in provider). | Until you sign out |
easyace:…:done, easyace:…:paper, easyace:…:sync | Local storage | Your “done” questions, your practice paper, and sync bookkeeping. Kept on your device even without an account. | Until you clear it |
tv:gate, tv:auth-fails, tv:signup-tries, tv:reset-sent | Local storage | Sign-in housekeeping and brakes on repeated failed attempts. | Minutes to 1 hour |
tv:ws:… | Local storage | The question list of a large worksheet you generated, so its page can open (and reopen). Only your 10 most recent are kept. | Until you make 10 newer ones or clear it |
tv:next, tv:google, tv:banner-closed | Session storage | Returning you to the right page after sign-in; a one-time security check while you sign in with Google; remembering that you closed the sign-in banner. | Until you close the tab |
Our bot-protection service may use its own strictly necessary storage to run the human check on the sign-in forms.
If our content delivery network needs to check that a visitor is a real browser (for example during an attack),
it may set a strictly necessary security cookie (cf_clearance or __cf_bm) that lasts
up to a few hours.
Your rights
Under the DPDP Act you have the right to:
- Access your data: use Download my data on your account page.
- Correction and completion: email us to correct your email address or username.
- Erasure and withdrawing consent: use Delete my account. It’s immediate, and as easy as signing up.
- Grievance redressal: email us and we’ll reply within 30 days. If you’re not satisfied, you can complain to the Data Protection Board of India.
- Nominate someone to exercise these rights for you if you die or become unable to.
Can’t sign in? Email us from the address on the account and we’ll handle the request for you.
Children and students
Many of our visitors are secondary-school students. We deliberately collect only the minimum needed to run an account, never real names, ages, schools or contact details beyond an email address. We don’t profile, track or advertise to anyone. If you’re under 18, please ask a parent or guardian before creating an account. A parent or guardian can ask us to delete a child’s account at any time by emailing us.
How we protect it
Data is encrypted in transit (HTTPS everywhere) and at rest by our providers. Database rules mean each account can only ever read or change its own data. Passwords are hashed. Sign-in forms have bot protection and rate limits, and we never store secret keys in the website’s code.
Changes to this policy
If what we collect or how we use it changes, we’ll update this page and the date at the top first. For significant changes, we’ll also tell signed-in users on the site.
Contact and grievance officer
Topical Vault, India. Email: topicalvault@gmail.com. We aim to reply within 7 days, and within 30 days at most.