Privacy Policy

Psychometricks is operated by [company name — to be confirmed], a company registered in England and Wales (company number [company number — to be confirmed]), whose registered office is [registered office — to be confirmed]. We are the data controller for the personal data described here. For data-protection requests, email [data-protection email — to be confirmed]; for anything else, [contact email — to be confirmed].

We process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Psychometricks accounts belong to adults: a parent or guardian, or an adult learner. Children practise through a parent's or guardian's account. We ask the account holder to confirm they are 18 or over before we collect anything else.

We design for children's privacy: we do not ask for a child's name, date of birth, school, email address or photograph, there is no chat and no public leaderboard, and there is no advertising or cross-site tracking anywhere on the Site.

Account details.Your email address, an optional name or nickname, and your password (stored only in hashed form). If you use "Continue with Google", Google shares your email address and name with us.

Your sign-up answers. That you confirmed you are 18 or over, and whether you chose to receive news by email — each with the date and time, and the exact wording you were shown, so we can show what you agreed to.

Practice data.Which questions were attempted on your account, whether they were answered correctly, and any flagged; for practice papers and timed exams in Exam mode, the answers given and the time spent on each question. For a timed exam we also record the time used, when the clock was paused and why (you paused it, left the page, or the page stopped checking in), how often and for how long, when the open exam page last checked in (about every 20 seconds), and whether you asked for your results by email, so a saved exam can carry on where it stopped. This powers your Progress page, lets you hide the questions you've already done, and helps us find questions that are too hard, too easy or faulty.

Feedback.If you rate or report a question, the rating or the reason you chose and any comment you add. Please don't include personal details in comments.

Technical data. To block abuse, our rate limiter holds your IP address and a request count for a few minutes. Our hosting provider keeps standard request logs. On the sign-up page, a bot check runs in the background.

We do not use analytics or advertising tools, and we do not build profiles of you or your child.

• To provide your account and practice — contract.
• To keep the Site secure and stop abuse, and to improve questions using practice data — legitimate interests.
• To send account emails you need, such as confirming your address or resetting your password — contract.
• To email you your exam results when you ask for them — contract.
• To send news about new practice and features, only if you opted in — consent, which you can withdraw at any time.
• To meet legal obligations, such as tax records once paid plans exist — legal obligation.

We do not sell personal data, and we make no automated decisions that have legal or similarly significant effects on you.

Our practice is used by children, so we follow the UK Information Commissioner's Age Appropriate Design Code: high-privacy settings by default, collecting only what the service needs, and no nudges or tracking. In the United States, practice for younger children is covered by COPPA. We never ask a child for personal information: the account belongs to the parent or guardian, a child's practice is stored on that account, and the parent can ask us for a copy of it, or to delete it, at any time.

If you believe a child has given us personal information directly, contact [data-protection email — to be confirmed] and we will delete it.

• Supabase — our database and sign-in provider, under a data processing agreement. Storage region: [region — to be confirmed].
• Vercel — hosting; keeps standard request logs.
• Upstash — rate limiting; holds an IP address and a request count for a few minutes.
• Resend — sends the emails you ask for, such as your exam results; it receives your email address and the email's contents.
• Cloudflare Turnstile — the background bot check on sign-up; not used to track you or for advertising.
• Google — only if you choose "Continue with Google".

When paid plans open, payments will be handled by a payment provider we will name here, which will hold your card details; we will not.

We use only what the Site needs to work: a sign-in cookie to keep you logged in, and a short-lived cookie (one hour) that carries your sign-up answers across a Google sign-in. Your light or dark theme choice is remembered in your browser's local storage. We set no analytics or advertising cookies, so there is no cookie banner.

We keep your account and practice data while your account is open. If you close your account, we delete your personal data within 30 days, except records we must keep by law. We keep records of your consent choices for as long as your account exists and up to three years afterwards, so we can show what you agreed to. IP addresses held for rate limiting expire within minutes.

You can ask to access, correct, delete, restrict or move your data, object to processing based on legitimate interests, and withdraw consent at any time. Email [data-protection email — to be confirmed]; we reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

We use encrypted connections, hashed passwords and access controls; answers and explanations are protected so they can't be read before they are unlocked. Some providers may process data outside the UK; where they do, we rely on appropriate safeguards such as the UK's international data transfer agreements.

If we change this policy in a way that matters, we will tell you by email or on the Site before it takes effect.