Privacy Policy

Information we collect

• Account details. Your email address, the name you give us (optional), and your password, stored only as a salted scrypt hash. We never store your password in readable form.
• Google sign-in. If you choose “Continue with Google”, we request only the basic openid, email and profile scopes and receive your email address, whether Google has verified it, your name, and your Google account ID. We do not receive your Google password and do not access your Gmail, contacts, Drive, calendar or any other Google data.
• Practice history. The questions you answer, the options you pick, whether they were correct, time spent, and your practice and exam sessions.
• Free-trial visitors. A random identifier in a cookie so your trial progress is saved without an account. If you later sign up, this history moves into your account.
• Network information. To limit abuse (for example repeated login attempts or free-trial resets) we store a one-way keyed hash of your IP address, never the IP address itself.
• Things you send us. Question reports you submit and, if you join the waitlist, your email address.
• Payments. When paid passes are available, payments are handled by Stripe. We receive a payment reference, the amount and the pass dates. We never see or store your card details.

How we use it

• To create your account and sign you in.
• To run the service: grade answers, schedule review of questions you missed, and show your analytics and readiness score.
• To provide the pass you paid for.
• To keep the service secure and prevent abuse of the free trial and sign-in.
• To send account emails you ask for, such as password reset links, and to tell waitlist members when passes open.

We do not sell your information, use it for advertising, or share it with data brokers.

Google user data

Information received from Google is used only to sign you in and to create or identify your account. We do not use it for advertising, do not sell it, do not transfer it to others except the service providers listed below that host our application, and do not use it to train AI models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

We use a small number of service providers who process data on our behalf, only to run the service:

• Vercel hosts the website.
• Supabase hosts our database (United States).
• Stripe processes payments, when available.
• An email delivery provider sends account emails, when enabled.

We may also disclose information if required by law.

Cookies

We use only strictly necessary cookies: one to keep you signed in, one to save free-trial progress, and a short-lived one that protects Google sign-in from forgery. We do not use advertising or third-party tracking cookies.

Retention and deletion

We keep your account and practice history while your account exists so your analytics and review schedule keep working. Sign-in sessions expire automatically. You can ask us to delete your account and all associated data at any time by emailing im58585888@gmail.com from your account's email address. We complete deletion within 30 days, except for payment records we must keep for tax and accounting. If you signed in with Google, you can also remove our access at myaccount.google.com/connections.

Security

Connections to the site and to our database are encrypted. Passwords are hashed, sign-in tokens are stored only as hashes, and the database is not reachable through any public API.

Children

The service is not directed to children under 13, and we do not knowingly collect their information.

Changes

If we change this policy we will update the date above, and for significant changes we will notify account holders by email or on the site.