Privacy Policy

Last updated 2026-09-29

Mock CSS ("we", "our", or "us") runs an online exam-prep platform built for Central Superior Services (CSS) Preliminary Test (MPT) aspirants in Pakistan. This Privacy Policy explains what personal information we collect when you use our website, our web app, and our mock tests, and how we store, use, and protect it.

Mock CSS is a sole proprietorship based in the Islamic Republic of Pakistan. For this policy, the proprietor is the data controller for your personal information, and can be reached at support@mockcss.pk.

By creating an account, making a payment, or otherwise using the platform, you agree to the collection and use of information as described here, together with our Terms & Conditions and Refund & Cancellation Policy.

1. Information We Collect

We only collect the personal data we actually need: to run your account, build your mock tests, track your performance history, and keep our question bank from being scraped.

A. Information You Provide

Account Registration: Your full name, email address, username, and a password, which we store as a secure hash and never see or keep in plain text.
Alternative Sign-In: If you sign up or log in using a supported third-party option instead of a password, we get your name, email address, and profile photo from that provider to create or link your account.
Profile & Identity Assets: Uploaded avatars (resized and stored as compressed web images) and any account preferences you set.
Manual Billing Proofs: Reference codes, transaction IDs, or receipt screenshots you submit to verify a manual payment (SadaPay, Easypaisa, NayaPay, or bank transfer).
Question Flags & Moderation Reports: If you use "Flag for review" during an attempt or on your results screen, we record the question, your username, and whatever explanation you give us. This goes into an internal review queue our moderators use to check for wrong answers or typos.

B. Exam & Practice Telemetry

Test Submissions: Which mode you took (Full MPT Mock, Past Papers, Practice Sets, Custom Mock), your answers, how long you took, and your scores across FPSC syllabus sections.
Incremental Session Sync: Your answer selections are saved as you go during an active attempt, so an interrupted session can resume safely, even on a different device.
Scoring Data: Your computed scores and section-by-section breakdowns.

C. Technical, Security & Infrastructure Telemetry

Device & Network Data: Your IP address, browser user-agent string, device identifiers, and sign-in timestamps.
API Pacing & Anti-Scraping Logs: How quickly you move between questions and how often you hit our endpoints. We serve exam questions one at a time over rate-limited endpoints, partly to keep the system healthy and partly to make scraping the question bank impractical.
Error & Crash Diagnostics: When something breaks, our monitoring tools may automatically capture the page or request involved, a technical stack trace, and basic request details (which can include your IP address), so we can find and fix the problem quickly.

2. Cookies & Local Storage

We don't sell your data to advertisers. Below is everything we store in cookies or local storage, and why, including the third-party tools that set their own.

Authentication Storage: We use your browser's local storage to hold your login tokens, so your session survives a page reload. Clear your browser storage and you'll be signed out.
Essential Operation: Anything else we store in cookies or local storage exists only to keep the platform working and secure.
Bot & Abuse Verification: On sensitive forms like sign-in, registration, and password reset, an automated check runs in your browser to help confirm you're a real person and not a bot. It may set its own cookies or local-storage values, and can process your IP address and certain browser or device signals as part of that check.
Product Analytics: On our deployed website, we use third-party analytics tools to see how aspirants move through the platform, through aggregated usage stats, traffic and page-view measurement, heatmaps, and session replays. These tools set their own cookies and local-storage keys and may receive your IP address, device and browser details, the page you came from, and your on-page actions such as clicks, scrolls, and mouse movement. Text content and form fields are masked by default in any session-replay tool, so a replay shows layout and interaction patterns, not your actual answers, credentials, or messages. Separately, our content-delivery network may share aggregated, request-level traffic data (such as request volume and patterns that indicate automated or bot traffic) with these analytics providers, so we can tell genuine visitors apart from crawlers and abusive traffic; this happens at the network level and is independent of your browser settings. We use this data only to diagnose usability problems, understand overall usage, distinguish real visitors from bots, and improve the interface, never to identify you personally or for advertising. These providers act as our sub-processors for this feature (see Section 6), and none of them are loaded on the live exam-attempt screen. Blocking third-party scripts or cookies in your browser disables the client-side portion of this with no loss of platform functionality.
Advertising & Conversion Measurement: On our live production website, we use a third-party advertising tool to measure how effective our marketing campaigns are and to understand which channels bring aspirants to the platform. It sets its own cookies and can receive your IP address, browser and device details, the pages you visit, and on-page actions such as button clicks, and it may use this to build audiences for future advertising on that provider's own network. This tool is not loaded on the live exam-attempt screen, and it does not have access to your exam answers, scores, or account details. This provider acts as our sub-processor for this feature (see Section 6). Blocking third-party scripts or cookies in your browser disables it with no loss of platform functionality.
Google Fonts: Typography is delivered via Google Fonts. Google may receive technical telemetry, including your IP address, in order to serve the font files. See Section 6.

3. How We Use Your Information

We use your data for legitimate, everyday reasons: running the product, keeping accounts honest, and keeping you informed about your subscription.

Simulator Execution & Diagnostics: Building syllabus-aligned practice tests, grading your attempts automatically, tracking your sectional accuracy over time, and drawing your performance charts.
Public Leaderboards: We rank every submitted attempt, of any type (Full MPT Mock, Past Papers, Practice Sets, or Custom Mocks), by question-weighted accuracy. Once you've submitted at least two attempts, your username, attempt count, accuracy percentage, and rank appear on our public leaderboard, which anyone can view, signed in or not. Submitting two or more attempts means you're opting into that public display.
Subscription Management: Checking your access, enforcing free-tier limits, processing manual payment approvals, and extending access by 30 days once a payment clears.
Service Communication: Sending you things you actually need to know: subscription updates, password recovery emails, and important administrative announcements.

Legal Basis for Processing

Where you're in a jurisdiction that requires a specific lawful basis for processing (the EU or UK under GDPR, for example), we rely on: performance of our contract with you (your account, the tests, billing); our legitimate interests (security, stopping scraping, improving the product, keeping the leaderboard honest); your consent, where we specifically ask for it; and legal obligations we have to meet (tax, accounting, fraud prevention).

4. Account Sharing & Single-User Enforcement

Every Mock CSS account is a single-user, non-transferable license:

Technical Enforcement: Only one signed-in session per account is valid at a time. Signing in on a new device or browser ends the session on every other device that was previously signed in, with no warning first. We log the time of every sign-in for this reason. This is a normal, everyday consequence of switching devices, not a sign of misuse on its own.
Integrity Monitoring: We keep an eye on access patterns platform-wide, including fast or repeated device switching and sign-ins from locations that don't add up geographically, to catch credential sharing that the single-session rule alone can't stop.
Zero-Tolerance Policy: If our telemetry shows an account being shared, rented, pooled, or used by more than one person (including people taking turns), that account will be terminated immediately, with no warning and no refund of subscription fees.
Right of Review: If your account is terminated under this section and you believe the real explanation is something ordinary (travel, a VPN, a shared campus or mobile network, or a new device), you can email support@mockcss.pk within 14 days and ask us to look again. We'll review the access data and reinstate the account if it doesn't actually support multi-user use. This review doesn't apply to confirmed credential resale, publicly posted credentials, or question-bank scraping; those terminations are final.
We may blacklist the device identifiers, IP ranges, and account credentials involved, to protect the security and intellectual property of the service.

5. Payment & Billing Data

We don't store or process your raw debit or credit card details on our servers, and we don't run automated card payments at all:

Pakistani Manual Transfers: For local payment methods (SadaPay, Easypaisa, NayaPay, or bank transfer), we keep transaction receipts and reference numbers in an access-controlled admin database, solely to verify transfers and activate subscriptions. See our Refund & Cancellation Policy for how these payments are verified and, where eligible, refunded.

6. Third-Party Disclosures & Sub-processors

We don't sell, rent, or otherwise monetize your personal data. We only share it with the third-party services we actually need to keep the platform running:

Cloud Infrastructure & Hosting: Our database host, cloud computing infrastructure, and asset storage providers, all operating under confidentiality and security commitments.
Product Analytics: Third-party analytics providers process aggregated usage stats, traffic and page-view measurement, heatmaps, and masked session replays for us, as described in Section 2.
Advertising & Conversion Measurement: A third-party advertising platform processes browsing and interaction data on our production website to measure and improve our marketing campaigns, as described in Section 2.
Typography & Fonts: External font assets delivered via Google Fonts, which may collect technical telemetry such as IP addresses to serve the font files.
Error Monitoring & Technical Diagnostics: A dedicated error-monitoring service that helps us detect, diagnose, and fix technical problems quickly, as described in Section 1.C.
Alternative Sign-In Providers: If you use a supported third-party sign-in option, that identity provider shares your basic profile information with us to authenticate you, as described in Section 1.A.
Bot & Abuse Prevention: An automated verification service used on sensitive forms to help tell genuine users from bots, as described in Section 2.
Legal Compliance: If required to do so by applicable law, a regulator, or a valid judicial process.
Platform Defense: When we need to investigate unauthorized access, request flooding, question-bank scraping, or serious violations of our Terms & Conditions.

7. International Users & Cross-Border Transfer

We're based in Pakistan and process personal data here, under the laws of the Islamic Republic of Pakistan, including the Prevention of Electronic Crimes Act 2016 and any applicable data-protection rules as they come into force.

If you access the platform from outside Pakistan, you understand and agree that your information will be transferred to, stored in, and processed in Pakistan, which may not offer the same statutory data-protection guarantees as your home jurisdiction. We apply the protections in this policy to every user in good faith, wherever they're located.

8. Data Retention & Your Rights

Account Retention: We keep your account credentials, attempt records, and performance diagnostics for as long as your account stays active.
Compliance & Audit Trails: Billing verification records, payment identifiers, and access logs are retained for whatever minimum statutory period applies, for legal, tax, and fraud-prevention purposes, even after your account is closed.
Your Rights: Depending on applicable law, you may request to access, review, correct, export, or delete your personal information. Basic corrections can be made directly from your profile settings.
Response Time: We aim to respond to a verified rights request within 30 days, and may ask you to confirm your identity first.
Account Deletion: You can request permanent deletion of your account and testing history at any time by contacting support. Once we've verified the request, we remove your identifying personal details, attempt logs, and flags from our active systems. We may retain anonymized, non-identifiable accuracy metrics to help calibrate exam difficulty.
Complaints: If you believe we've mishandled your personal data, raise it with us at support@mockcss.pk, and, where one exists in your jurisdiction, with your local data-protection authority.

9. Children's Privacy

The platform is intended for CSS aspirants who are at least 18 years old. We don't knowingly collect personal data from anyone under 18, and if we learn that we have, we'll delete it promptly.

10. Security Measures

We use industry-standard safeguards to protect your data: encryption in transit (HTTPS/TLS), hashed passwords, access controls, and rate limiting. No method of transmission or storage is completely secure, but we use commercially reasonable means to protect your information.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect technical, regulatory, or operational changes. When we make a significant change, we'll update the "lastUpdated" date at the top of this document. Continuing to use the platform after an update means you accept the revised policy.

12. Contact Us

If you have questions, feedback, or requests about this Privacy Policy or your personal data, reach out to us at:

Operator: Mock CSS (sole proprietorship), Islamic Republic of Pakistan

support@mockcss.pk +923175986301