Privacy Policy

UnlimitedTests ("we", "us"), operated by PV Innovations LLC, provides digital SAT practice tests and study tools. This policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. Because many of our users are students and minors, we try to keep our practices simple and protective.

You must be at least 13 years old to use UnlimitedTests, and we do not knowingly collect personal information from children under 13 (consistent with the U.S. Children's Online Privacy Protection Act, "COPPA"). We use a neutral age screen that asks only for your birth year, so the check goes by year of birth.

If you sign up with an email address and password, we ask for your birth year first and do not create an account for anyone under 13. If you sign in with Google, your account is created when you first sign in (and we send a welcome email), and we ask for your birth year before you can open your dashboard or start any practice or test. If the answer shows you are under 13, we immediately close and anonymize that account, sign it out, delete our record of the emails we sent to it, and remove its email address from our security audit log. The rest of its data is deleted within 30 days, as described in section 9.

If we learn that we have collected information from a child under 13 in any other way, we delete that account and its data, including those email records. If you believe a child under 13 has an account, email support@unlimitedtests.com and we will remove it.

We build for students and want parents and guardians to feel comfortable. We don't show third-party advertising, we don't sell personal information, and we don't use student data to build advertising profiles. A student can choose to share a summary of their progress with a parent or guardian (see section 7). If you are a parent or guardian and have questions or a request about your child's information, email support@unlimitedtests.com.

• Account information: your name, email address, and birth year; a password if you set one (stored only as a salted hash); a 2FA secret and recovery codes, if you turn on two-factor authentication; and a leaderboard nickname, if you choose one (see section 7). If you sign in with Google, we also store the link to your Google profile photo; the photo itself stays on Google's servers, and your browser loads it from Google when we show it to you in the site menu. The page for a study group you join also includes that link in the data it sends to other members' browsers, although the page does not display the photo.
• Google sign-in tokens: if you sign in with Google, our sign-in system stores the tokens Google returns when you sign in.
• Practice and test activity: your answers, scores, time spent on each question, progress, study plan, bookmarks, and review history, and any ACT practice essays you write, with their scores.
• Study profile: your target test and score, test date, study goals, focus topics, learning-style preference, and any study notes you write for the tutor.
• Test accommodations you turn on (extended time, a reader, large print), so practice tests match your real test. If you are in a class, your teachers can see whether you have extended time on and which tests used it, so they can read those scores fairly; they don't see the reader or large-print settings. Accommodations are not sent to our AI provider.
• Time zone: taken from your browser and saved to your account, so that "today" follows your local day.
• Usage events: the pages you view and the buttons and links you click in the app, including the text on the button or link (on a question, that can be the text of an answer choice). They are linked to your account when you are signed in, and to a random ID we save in your browser's local storage (ut_anon_id). We store them in our own database, not with an analytics company, and delete them after 90 days.
• AI tutor conversations: the messages you send to the tutor and its replies (see section 6). If your school has turned the AI tutor off, there are none.
• Official scores: SAT or PSAT scores you enter, and any official score report you choose to upload. Uploaded reports are stored privately in Vercel Blob storage and are never public.
• A parent's email address, only if you invite a parent or guardian to see your progress (see section 7).
• A notification subscription, only if you turn on browser notifications: the address and keys your browser gives us for sending them, and your browser's description (user agent).
• A consent record: when you confirm your age and accept our terms and this policy, we record the date, the policy version, your IP address, and your browser (user agent).
• Things you send us: question reports, contact-form messages, and — if you ask for your free diagnostic result by email without an account — that email address, with the score range and topics in the report we send you.
• Payment information if you subscribe: processed by Stripe. We do not store your full card number — we keep only a Stripe customer/subscription reference, subscription status, and plan.
• Technical data: IP address, device/browser (user agent), and standard server logs, used for security, debugging, and abuse prevention.

We do not collect home addresses, phone numbers, student ID numbers, or demographic information, and we do not collect payment information from students whose school provides their account.

Cookies. We use only first-party cookies: your sign-in session, a security (CSRF) token, the Google sign-in round-trip, a time-zone cookie (tz) set when you open your study plan and kept for a year, and — only if you arrive through a referral link — a referral code kept for 7 days. We do not use advertising, cross-site tracking, or third-party analytics cookies.

Videos. Lesson and explanation videos are embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com), and a video player loads only when you choose to play it. Some video thumbnails load from YouTube's image server (img.youtube.com) as soon as a page shows them. Either way, YouTube (Google) receives your IP address and browser information.

• To operate the product and show you your progress and recommendations.
• To provide the AI tutor, score projections, and study plans.
• If your school provides your account, to show your teachers your results (see section 8).
• To process subscriptions and prevent fraud and abuse.
• To understand how the product is used and to help you when you contact us — this is what usage events are for.
• To send emails. Account and security emails are always sent. Study reminders, weekly summaries, and score-report emails are on by default for every account; we cap how many reminder emails we send in a week, and you can turn each kind off in Settings or with the unsubscribe link in the email. Onboarding tips in your first two weeks and reminders about class assignments follow the study-reminder setting. If you cancel a paid plan, we may send you an offer to come back, which you can stop with its unsubscribe link. If you are on a free trial, we remind you before it ends; that reminder, like notices about a plan change you have scheduled, is a billing notice. While a school's license is active, its students do not get our promotional emails (onboarding tips, trial reminders, and win-back offers).
• To improve question quality and the test engine, and to calibrate question difficulty and compute score percentiles, using aggregated, de-identified answer data.

Where required (e.g. EU/UK), our legal bases are: performance of our contract with you; your consent, where we ask for it (for example browser notifications, or marketing emails after the free diagnostic); and our legitimate interests in securing and improving the service and in sending the study emails described above, which you can turn off at any time. We do not use your personal information to build advertising profiles, and — as described below — we do not use it to train our own AI models.

Our AI tutor, Sage, is powered by Anthropic's Claude models through Anthropic's API. Here is exactly what we send to Anthropic:

• When you chat with Sage: your message and the earlier messages in that conversation; the page you are on; and, if a question is on your screen, that question with its answer choices, its correct answer, and our explanation. So Sage can tailor its help, we also send a short profile: your first name; your target test, target score, and test date; your learning-style preference; up to 500 characters of the study notes you have written for the tutor; how much you have practised in the last 30 days and your recent accuracy; your weakest and strongest topics; the topics of your recent missed questions and how you tended to miss them (for example, answering very quickly); short summaries of earlier tutor sessions, if we have any; and what you asked Sage under practice questions in the last 7 days (the topic, whether you got it right, and your messages there), and that question's chat if it is the one on your screen. While it answers, Sage can also look up more of your practice statistics and your score estimate.
• The explanation chat beside a question (SAT or ACT), and hints on a practice question: the question with its answer choices, its correct answer, and our explanation; the answer you picked and whether it was right, once you have answered; your messages, or the hints you already have; and, so it can build on what you have already covered, short summaries of your recent Sage chats and what you asked under other recent questions on the same topic.
• Fix this mistake, after a wrong answer in practice: the question with its answer choices, its correct answer, and our explanation (including why the choice you picked is wrong); the choice you picked; what you write about how you approached it; and, after Sage teaches the step, your explanation of it in your own words. The new question it gives you afterwards is never sent.
• An ACT practice essay you submit for scoring: the essay text and the prompt it answers, so an AI model can score it.
• A Checkpoint result (paid plans): for the short AI note on your result, your score estimate and its range, the change since your last Checkpoint, your goal, and your weakest topics.
• An uploaded score report: the image or PDF, so an AI model can read the scores printed on it. We use this only to help us check the score you entered; a person makes the decision, never the AI.

We do not send your email address or your test accommodations. Anthropic processes this only to return a response under its commercial API terms, retains API inputs and outputs for a limited period (currently up to 30 days) to enforce its usage policies, and does not use them to train its models. If your school has turned the AI tutor off, none of these features runs and nothing is sent.

Please do not enter sensitive personal information (for example, health, financial, government-ID, or precise-location details, or information about other people) into tutor chats. The tutor is a study aid, not a place for sensitive data.

We store your tutor conversations so you can revisit them. On the Free plan, your Sage conversation is automatically deleted about 48 hours after each message; on paid plans — including accounts a school provides — we keep it until you clear it or delete your account. Explanation chats beside an SAT question are kept until you delete your account; ACT explanation chats are not stored. What you write in Fix this mistake is kept with that coaching session until you delete your account. Our founders can read a student's tutor conversations to investigate a problem. When a founder opens a student's tutor conversations in our admin tools, that is recorded in our audit log.

We do not train our own AI models, and we do not use your conversations or other personal data to train or fine-tune any model. We only use AI to generate responses for you in the moment.

We do not sell your personal information and we do not show third-party ads. We share data with service providers that process it on our behalf under their own privacy and security commitments. The main ones are:

• Vercel — application hosting, and private storage for uploaded score reports.
• Neon — database hosting (your account and practice data).
• Cloudflare R2 — stores our nightly database backups, which are deleted after 30 days.
• GitHub — runs the nightly backup job, and a weekly job that restores a backup to check that it works.
• Google — "Sign in with Google", and YouTube for embedded videos (see section 4).
• Anthropic — powers the AI tutor and reads uploaded score reports (see section 6).
• Resend — email delivery.
• Sentry — error monitoring. Error reports carry an opaque user id, never your email address, and we remove email addresses, cookies, IP-address headers, and request bodies before a report is sent.
• Desmos — the graphing calculator inside Math sections, loaded in your browser from Desmos when you open it.
• Stripe — subscription payments. Not used for students whose school provides their account.
• Your browser's push service (run by your browser's maker) — delivers browser notifications, only if you turn them on.

Sharing you choose. You can invite up to three parents or guardians, by email, to see a summary of your progress: your score estimate, your completed tests and their scores, how much you have practised and when you were last active, and — if you are in a school class — your class assignments and whether they are done. Only an account signed in with the invited email address can accept. They never see your individual answers or your tutor conversations. You can stop sharing at any time in Settings, and it stops immediately. This is sharing that you start: we don't set it up, and neither can a school.

Leaderboard and study groups. Our public leaderboard ranks recent test scores. It shows your leaderboard name — a nickname you choose or one we generate, never your real name — with your best score, how many tests you have taken, and how much you have improved. It is on by default, and you can turn it off in Settings under Public profile. If you join a study group, its members see your name and when you joined; unless you have turned the leaderboard off, they also see your first name and last initial with your test scores — your best score, how many tests you have taken, how much you have improved, and your recent scores.

We may also disclose information if required by law or to protect the rights, safety, or security of our users or the service.

If your school or district provides UnlimitedTests to you, we process student information on behalf of the school under our agreement with it. We use student information only to provide the service, to follow the school's instructions, to keep the service secure, and to meet our legal obligations — we do not sell it or use it for advertising. Where FERPA applies, we act under the school's direction consistent with the "school official" exception.

What teachers see. A teacher sees only the students in their own classes; a school administrator sees every class in the school. For each student, staff see the current score estimate and its range, recent tests and their scores, weakest skills, the questions the student recently missed with the answer they chose and the correct answer, patterns in how they miss questions, and pacing. This includes practice a student does on their own, including practice from before they joined the class. The class list shows each student's name, email address, latest test score, and recent practice volume and accuracy. Staff can see whether a student has extended time turned on and which of their tests were taken with it, so a score is not read against standard-time expectations. Staff do not see a student's other accommodations (reader, large print), tutor conversations, or who they share their progress with. Students are told when they join a class that their teachers can see their practice and test results.

Records. A school administrator can download a spreadsheet (CSV) of the school's current students at any time. It contains each student's name, email address, classes, the date they joined, tests completed, latest test score and date (and whether that test was left mostly blank), and practice questions answered and accuracy. We provide a complete record for any of the school's students on request, and we correct student information when the school asks us to.

Deletion. On the school's written request, we delete an individual student's account or every student account in the school. Deleting an account removes all of that student's work, not only schoolwork, because the records don't separate the two.

When the license ends. Students keep their accounts and practice history as free accounts, unless the school asks us to delete them. Paid features lock, and their tutor conversations then follow the Free plan's 48-hour deletion. Students stay on their class lists, but from the day after the license ends the school's staff see only the work a student did through the license's last day; anything the student does afterwards stays private to them. If the school renews, staff see the student's work again from the day the renewal starts, never what they did in between. This applies to everything staff can see, including the spreadsheet download and the class reports.

What changes for school students. While the school's license is active, its students can't buy anything from us, don't get our promotional emails, and aren't shown referral offers. A school can turn the AI tutor off for all of its students (see section 6). School students' results are left out of our public results page, public share links for test results, and the public leaderboard.

De-identified data. We use de-identified answer data from all students, including school students, to calibrate question difficulty and to compute score percentiles.

Changes. We will email a school's contact and its school administrators at least 30 days before we make a material change to how student data is used, which service providers receive it, or which AI provider powers the tutor. If there is a security breach, see section 13.

Schools that need a separate data privacy agreement can contact us at support@unlimitedtests.com. Our security page describes how student data is protected.

• Account & practice data: kept while your account is active. When you delete your account (or a school asks us to), we immediately remove your name, email address, and profile-photo link from the account, remove your study profile and your main Sage conversation, delete any score-report files you uploaded, cancel any active subscription, and sign you out on the device you used (if you are signed in anywhere else, sign out there too). We then permanently delete everything else tied to the account — including your tests, practice, explanation chats, parent links, and class memberships — within 30 days. Until then, a school student may still appear on their teacher's class list as an anonymized entry.
• Tutor conversations: on the Free plan, automatically deleted about 48 hours after each message; on paid plans, kept until you clear them or delete your account (see section 6).
• Usage events: deleted after 90 days.
• Server logs & error reports (including Sentry): kept for up to 90 days for security and debugging, then deleted or de-identified.
• Backups: nightly database backups are kept for 30 days, so deleted data can remain in a backup for up to 30 days after it leaves the database.
• Security audit log and email records: two internal records can keep your email address after your account is deleted — our security audit log (which also records IP addresses and browsers) and our record of the emails we have sent you. We keep them to investigate security problems and to answer questions about what happened on an account, and we do not yet delete them on a fixed schedule. For an account closed because its owner is under 13, we delete the email records and remove the address from the audit log straight away (see section 2).
• Billing records: Stripe and we may retain payment records as needed for tax, accounting, chargeback, and fraud-prevention obligations.

Aggregated, de-identified data may be retained to maintain the integrity of statistics and the question bank.

• Access / export: download a copy of your data from your account Settings ("Your data"). The file includes your account details and settings (including your birth year and test accommodations), your full-length tests and Checkpoints with your answer to each question, drills, review cards and review checks, bookmarks and notes, flashcard reviews, study-plan activity, your main Sage conversation, and our security-log entries about your account. It does not yet include everything we hold — for example, answers from topic practice sessions, usage events, chats about a single question, ACT activity, and uploaded score reports — so email support@unlimitedtests.com for a complete copy.
• Correction: email support@unlimitedtests.com to correct your information. Students whose school provides their account can also ask their school.
• Deletion: delete your account in Settings, or email us to request it. Students whose school provides their account can also ask their school.
• Email preferences: study reminders, weekly summaries, and score-report emails are on by default; turn any of them off in Settings or with the unsubscribe link in the email. Essential emails (account verification, password reset, security, and billing notices) are always sent.
• Two-factor authentication: if you sign in with an email address and password, you can turn on 2FA in Settings. If you sign in with Google, your sign-in is protected by your Google account's security (for example, Google 2-Step Verification) instead.

Depending on where you live, you may have additional rights (see the California and EU/UK sections). Contact support@unlimitedtests.com to exercise any of them; we will not discriminate against you for doing so.

If you are a California resident, you have the right to know what personal information we collect and how we use and share it, to access and delete it, to correct it, and to limit certain uses of sensitive personal information. We do not sell your personal information and we do not "share" it for cross-context behavioral advertising. For minors, we follow California's student-privacy protections, including not selling student information or using it for targeted advertising or non-educational profiling. To exercise your rights, email support@unlimitedtests.com.

If you are in the EU or UK, you have rights to access, correct, delete, restrict, and object to processing of your personal data, and to data portability. Our legal bases are described in "How we use your information." Children's consent thresholds vary by country (the UK and many EU states set the age between 13 and 16); where a parent or guardian's consent is required, it must be given before the child uses the service. UK users are additionally protected by the standards of the ICO's Children's Code. To exercise your rights, email support@unlimitedtests.com.

We protect accounts with salted, hashed passwords, optional two-factor authentication (TOTP) for email-and-password sign-in, signed sessions, rate limiting, and encryption in transit. We limit who can access personal data internally and keep an audit log of sensitive actions. No system is perfectly secure, but we work to safeguard your data.

If we confirm a security breach that affects a school's student data, we will notify that school's named contact within 72 hours of confirming it, saying what happened, which data was involved, and what we are doing about it. We will also notify affected users as the law requires.

We and our service providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers.

We may update this policy as the product evolves. When changes are material, we will update the date above and, where appropriate, ask you to review the updated policy. Schools also get advance notice, as described in section 8.

Questions, requests, or concerns? Email support@unlimitedtests.com, or write to us at PV Innovations LLC, 500 Demott Ln #73, Somerset, NJ 08875, USA. We'll respond within a few business days.