Last updated 2026-09-05.
SnowPro Core Prep is operated by Gaurav Barwalia, an individual, not a registered company, based in India. This page describes exactly what the application does with your data. It is written to be checked against the software rather than to be reassuring.
The short version. Your study data is yours. It is never sold, never shared with advertisers, and never used to train anything. There is no analytics, no advertising, and no third-party tracking of any kind in this application. You can export everything, and you can delete everything, from Settings, without asking anyone.
Only what the application needs to work:
What is deliberately not collected. No location, no device fingerprint, no browsing history, no contact list, no behavioural profile. Your IP address is used, in memory only, to rate-limit sign-ups and sign-in attempts so the service cannot be flooded — it is never written to the database and does not survive a restart.
Under the UK/EU GDPR the basis is performance of a contract: you asked for an account and the application cannot provide one without storing an identity and the progress attached to it. Security measures such as rate limiting rest on legitimate interests — keeping the service available for everyone. Under India's Digital Personal Data Protection Act the equivalent basis is the certain legitimate use of data you voluntarily provided for exactly this purpose.
No processing here relies on consent, which is why there is no consent banner. See cookies and local storage below.
Deletion is real deletion — the database rows are removed, not flagged as hidden. There is no archive and no backup copy the operator can restore from, which is the same reason deletion is irreversible for you.
The service runs on infrastructure operated by other companies. They process data strictly to provide their service, and nothing here is sold or shared for any other purpose:
| Provider | What they do |
|---|---|
| Railway | Hosting and database storage for this application. |
| Sign-in, and only if you choose “Continue with Google”. Google confirms your identity to us; we never receive your Google password. | |
| Brevo | Delivering transactional email — a welcome message and password-reset links. No marketing email is sent, ever. |
Because the service is hosted in a single region, data may be processed outside your own country. If you are in the UK or EU that is an international transfer, made under the hosting provider's own standard contractual clauses.
This is the complete list. There are no others, and none of them track you.
| Name | Kind | Purpose | Lifetime |
|---|---|---|---|
snowprep_session | Cookie | Keeps you signed in. HttpOnly, SameSite=Lax, and Secure over HTTPS, so it cannot be read by scripts or sent from another site. | 400 days |
snowprep_oauth_state | Cookie | Set only during a Google sign-in, to prove the reply came back from the request you started (CSRF protection). Deleted the moment sign-in completes. | 10 minutes |
snowprep.progress | Local storage | Your progress, and your light/dark preference, when the app is used without a server account. On this site it is read to apply your theme before the page paints, so the interface does not flash. | Until you clear it |
Why you are not asked to consent. Consent is required for storage that is not necessary for a service you asked for — analytics, advertising, cross-site tracking. Every item above is strictly necessary: without them you cannot stay signed in, cannot sign in with Google safely, and the interface flashes the wrong theme. There is nothing here to opt out of, so a banner would be a box to dismiss rather than a choice to make. Clearing your browser's cookies for this site signs you out; nothing else breaks.
You do not need to ask permission or wait for a reply to exercise the two that matter most:
For anything else — a correction you cannot make yourself, a restriction or objection request, or a question about any of this — write to gaurav.gbaba@gmail.com. Expect a reply within 30 days; in practice it will be much sooner. This is a personal project run by one person, not a support desk.
If you are in the UK or EU you have the right to complain to your national data protection authority. In India you may complain to the Data Protection Board. Raising it directly first is usually faster.
This service is intended for people preparing for a professional certification and is not directed at children. If you are under 18, please do not create an account. If you believe a child has, write to the address above and it will be deleted.
Passwords are hashed with scrypt. Sessions use HttpOnly cookies. Traffic is served over HTTPS with
HSTS, and the application sets a Content Security Policy that forbids loading code from anywhere but itself. No system
is perfectly secure, and this one is maintained by one person in their spare time — that is stated plainly rather than
implied away. See Security to report a vulnerability.
Material changes will be reflected here with a new date at the top of the page. There is no mailing list to notify, because no marketing email is ever sent.