Legal

What we collect

We collect your email address, username, and the IP address your account was created from, which we use to limit how many accounts can be made from one network. If you take part in an official mock, we also store your country and the test you are preparing for. We keep your question attempts, scores, and session times to power your statistics and the leaderboard. Payments are handled by Stripe, so we never see or store your card details. We also use anonymous analytics from Vercel, which use no cookies and cannot identify you.

How we use your data

Your email is used for account-related emails (confirmation, password reset, billing, and your official mock results) and for occasional updates about the platform, such as upcoming mocks and changes to our plans. You can unsubscribe from update emails at any time using the link in each one. Your usage data is used to display your statistics and leaderboard position. Your signup IP address is used only to prevent multiple accounts being created to gain an unfair advantage in official mocks. We do not sell your data to third parties.

Lawful basis for processing

We process your data under the UK GDPR on the following bases: Contract Performance (Article 6(1)(b)) for account management, service delivery, and payment processing; and Legitimate Interest (Article 6(1)(f)) for security, fraud prevention (including limiting accounts per network), essential website functionality, and sending you occasional updates about the platform, which you can opt out of at any time.

Cookies

We use strictly necessary cookies to keep you signed in. We do not use advertising, tracking, or analytics cookies.

Data storage and retention

Your data is stored securely on Supabase infrastructure hosted in the EU (Ireland). We retain your data for as long as your account is active. Signup IP address records are kept for as long as they are needed to enforce the account limit. You may request deletion at any time by contacting us.

Third-party services

We use Supabase (authentication and database), Stripe (payments), Resend (transactional email delivery), and Vercel (hosting and analytics). Each of these services maintains its own privacy policy and appropriate data processing agreements.

Children

This service is intended for users aged 13 and over. Users under 18 should use this platform under the supervision of a parent, guardian, or teacher. We do not knowingly collect personal data from children under 13.

Your rights

Under UK GDPR you have the right to access, correct, or delete your personal data, withdraw consent, and file a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. To exercise your rights, use our contact form.

Changes to this policy

We may update this policy from time to time. Any significant changes will be communicated via email.