Privacy Policy

This policy explains what we collect, why, and how we protect it. We collect the minimum needed to run a preparation platform well — nothing more.

1. Data we collect

• Account data: your name, email address and a securely hashed password.
• Preparation profile: exam type, target band, exam date, study time and self-reported level.
• Practice data: attempts, answers, scores, error notebook entries, vocabulary and study plan progress.
• Writing and Speaking submissions: your essay text or audio recording, and the AI feedback produced.
• Billing data: Stripe customer and subscription identifiers and status. Card details are handled entirely by Stripe and never reach our servers.
• Technical data: session records, IP-derived security hashes for rate limiting, and operational logs (error codes, provider latency). We do not run advertising trackers.

2. What is sent to AI providers

When you request Writing feedback, we send the task prompt and your essay text to our writing assessment providers (OpenAI and DeepSeek, routed deterministically). When you request Speaking feedback, we send your recording and the questions asked to Google Gemini for audio assessment. We do not send your name, email address, payment details, or unrelated profile information to AI providers.

3. How we use your data

• To provide practice, assessment, progress analytics and study planning.
• To manage your account, email verification, password resets and subscription.
• To keep the platform secure: rate limiting, abuse prevention and fraud protection.
• To operate the Service reliably: error monitoring and provider performance (no essay or recording contents in operational logs).

4. Email

Transactional emails (verification, password reset, subscription notices) are sent through Resend. We do not send marketing email without consent, and every account notification includes only the information needed to act on it. Reset and verification links are single-use, expiring, and stored only as hashes.

5. Where your data is stored

Account data and practice records are stored in Cloudflare D1; audio recordings and generated listening audio are stored in Cloudflare R2. Payments are processed by Stripe. AI assessment is processed by the providers listed above. Each provider processes data under its own terms and privacy policy.

6. Retention

• Account and practice data: retained while your account is active, and deleted on request.
• Speaking recordings: retained so you can review your feedback; deleted on account deletion.
• Operational logs: retained for a limited period for security and debugging, without essay or recording contents.

7. Your rights

You can access and correct your profile data in Account, and request export or deletion of your data by contacting support. You can also request that we stop processing data that is not required to operate the Service.

8. Security

• Passwords are hashed with PBKDF2-HMAC-SHA256 and per-user salts; we never store plaintext passwords.
• Sessions use opaque tokens; only hashes are stored, and cookies are HttpOnly, SameSite and Secure in production.
• Payment webhooks are signature-verified; subscription status is only granted from verified server-side events.
• API credentials live only in server-side environment variables and are never included in browser code.

9. Children

The Service is intended for users aged 16 and over, or younger users with parent or guardian consent. If you believe a child has provided personal data without consent, contact us and we will delete it.

10. Changes and contact

We will notify material changes to this policy in the Service or by email. For privacy questions or requests, contact support from the footer. You can also read our assessment methodology for details on how AI feedback is produced.