Privacy Policy

Effective October 14, 2026 · Version 2026-10-14

The short version: we collect only what's needed to run your account and save your practice progress. We don't sell your data, we don't show ads, and we don't use tracking or advertising cookies. You can ask us to delete your account and data at any time.

1. Who is responsible for your data

SAT Question Bank (the "Service") is operated by Efe Unal Atasoy ("we", "us"), who is responsible for the personal data described in this policy. You can reach us at [email protected].

2. What we collect

Account details: your name and email address. If you sign up with a password, it is stored only as a salted one-way hash by our authentication provider. We never see or store your password in readable form.
Google sign-in: if you choose "Continue with Google", Google shares your name, email address, profile picture link, and Google account ID with us. We don't get access to your Google password, Gmail, contacts, or files.
Practice data: the tests you start and finish, your answers, scores, time spent, questions you mark for review or eliminate, highlights, and notes you write.
Consent records: which version of the Terms and this policy you accepted, and when.
Subscription information: your plan, subscription status, billing period, and payment-provider identifiers needed to grant or remove access. Paddle processes payment details; we do not receive or store your full card number.
Technical and security data: when you sign in or use your account, our hosting provider records your IP address, browser type, and timestamps in security and access logs.

3. How we use it

to create and secure your account and sign you in;
to save your practice progress and show it to you on any device;
to send emails you need, such as confirming your email address or resetting your password (we don't send marketing email);
to prevent abuse, investigate security incidents, and keep the Service running;
to comply with legal obligations.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you (running your account and saving progress), our legitimate interests (security and abuse prevention), your consent (where we ask for it), and legal obligations.

4. Who we share it with

We don't sell or rent your personal data, and we don't share it with advertisers. We use a small number of service providers who process data on our behalf:

Supabase: database, authentication, and hosting of your account and practice data.
Paddle: payment checkout, subscription management, and related billing records when you purchase Pro. Paddle processes payment details under its own privacy terms.
Google: only if you choose to sign in with Google. Web fonts are also loaded from Google Fonts, which receives your IP address when pages load.
Desmos: the graphing calculator in Math tests is loaded from Desmos's servers when you open it, so Desmos receives your IP address at that time.
Have I Been Pwned: when you choose a password, we check whether it has appeared in known data breaches. Only the first 5 characters of a one-way hash of your password are sent, which cannot be used to recover your password, and nothing that identifies you.

We may also disclose information if required by law, or to protect the rights, safety, and security of our users and the Service.

5. Cookies and browser storage

We don't use advertising or analytics cookies. We use your browser's local storage to keep you signed in and to keep a copy of your progress on your device so the Service works smoothly and offline. Signing out removes your saved progress from that browser.

6. How long we keep it

We keep your account and practice data for as long as your account exists. When you delete your account, your profile and practice data are deleted. Security logs kept by our hosting provider are retained for a limited period and then deleted automatically.

7. How we protect it

Data is encrypted in transit (HTTPS) and stored with our hosting provider, which encrypts it at rest. Database access rules ensure each account can read and change only its own data. Passwords are hashed and never stored in readable form. No method of transmission or storage is 100% secure, but we work to protect your information and will notify you of a breach affecting your data where required by law.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To make a request, contact us at [email protected] from your account's email address. You also have the right to complain to your local data protection authority.

9. Children

The Service is not intended for children under 13, and we don't knowingly collect personal data from them. Users under 18 should use the Service with a parent's or guardian's permission. If you believe a child under 13 has given us personal data, contact us and we will delete it.

10. International transfers

Our service providers may process data in countries other than where you live. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

11. Changes to this policy

If we make material changes, we will update the version date above and ask you to review the updated policy the next time you sign in.

12. Contact

Questions or requests about your privacy? Contact us at [email protected].