Privacy Policy

UnlimitedTests ("we", "us"), operated by [LEGAL ENTITY NAME], provides digital SAT practice tests and study tools. This policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. Because many of our users are students and minors, we try to keep our practices simple and protective.

You must be at least 13 years old to create an account. We ask for your birth year at sign-up using a neutral age screen and do not create accounts for anyone under 13, and we do not knowingly collect personal information from children under 13 (consistent with the U.S. Children's Online Privacy Protection Act, "COPPA"). If someone signs up through Google without giving a birth year, we ask for it before they can use the product.

If we learn that we have collected information from a child under 13, we delete that account and its data. If you believe a child under 13 has created an account, email support@unlimitedtests.com and we will remove it.

We build for students and want parents and guardians to feel comfortable. We don't show third-party advertising, we don't sell personal information, and we don't use student data to build advertising profiles. A guardian who is linked to a student's account (with the student's acceptance) can see that student's progress summary. If you are a parent or guardian and have questions or a request about your child's information, email support@unlimitedtests.com.

• Account information you provide: name, email, password (stored only as a salted hash), birth year, and — if you choose to enable two-factor authentication — a 2FA secret and recovery codes.
• Practice activity: your answers, scores, timing, progress, study plan, bookmarks, and review history.
• AI tutor conversations: the messages you send to the tutor and its responses (see "AI tutor" below).
• Payment information if you subscribe: processed by Stripe. We do not store your full card number — we keep only a Stripe customer/subscription reference, subscription status, and plan.
• Technical data: IP address, device/browser (user agent), and standard server logs, used for security, debugging, and abuse prevention.
• Cookies: only strictly-necessary first-party cookies for sign-in sessions, security (CSRF), the Google sign-in round-trip, and (for up to 7 days) a referral code. We do not use third-party advertising, analytics, or cross-site tracking cookies.

• To operate the product and show you your progress and recommendations.
• To provide the AI tutor, score projections, and study plans.
• To process subscriptions and prevent fraud and abuse.
• To send essential account and security emails, and optional emails you turn on.
• To improve question quality and the test engine using aggregated, de-identified data.

Where required (e.g. EU/UK), our legal bases are: performance of our contract with you, your consent (for optional emails), and our legitimate interests in securing and improving the service. We do not use your personal information to build advertising profiles, and — as described below — we do not use it to train our own AI models.

Our AI tutor is powered by Anthropic's Claude models through Anthropic's API. When you use the tutor, we send your messages and relevant context — such as the question you're working on and a summary of your learning profile and recent performance — to Anthropic to generate a response. Anthropic processes this only to return a response, under its commercial API terms. [CONFIRM: align this with your Anthropic account's data-retention settings.]

Please do not enter sensitive personal information (for example, health, financial, government-ID, or precise-location details, or information about other people) into tutor chats. The tutor is a study aid, not a place for sensitive data.

We store your tutor conversations so you can revisit them. We currently keep them until you clear a conversation (using "Start fresh") or delete your account — we do not expire them automatically. You can clear a conversation at any time.

We do not train our own AI models, and we do not use your conversations or other personal data to train or fine-tune any model. We only use AI to generate responses for you in the moment.

We do not sell your personal information and we do not show third-party ads. We share data only with vendors that process it on our behalf under their own privacy and security commitments:

• Vercel — application hosting.
• Neon — database hosting (your account and practice data).
• Stripe — subscription payments.
• Google — optional "Sign in with Google" authentication.
• Anthropic — powers the AI tutor; receives your tutor messages and context to generate responses.
• Resend — transactional and notification email delivery.
• Sentry — error monitoring. We send only an opaque user id with error reports, never your email.

We may also disclose information if required by law or to protect the rights, safety, or security of our users or the service.

If your school or district provides UnlimitedTests to you, we process student information on behalf of the school under our agreement with it. We use student information only to provide the service, to follow the school's instructions, to keep the service secure, and to meet our legal obligations — we do not sell it or use it for advertising. Where FERPA applies, we act under the school's direction consistent with the "school official" exception, and schools may request access to or deletion of their students' records. Schools that need a separate data privacy agreement can contact us at support@unlimitedtests.com.

• Account & practice data: kept while your account is active. When you delete your account, we immediately anonymize your personal details (name, email, profile) so the account can no longer be linked to you, cancel any active subscription, and remove your tutor conversations and profile. We then permanently delete the remaining data tied to your account — including your practice attempts and drills — within 30 days.
• Tutor conversations: kept until you clear them or delete your account (no automatic expiry today).
• Server logs & error reports (including Sentry): kept for a limited period for security and debugging. [CONFIRM exact window.]
• Backups: removed from active systems on deletion; routine backups age out on our provider's schedule. [CONFIRM window.]
• Billing records: Stripe and we may retain payment records as needed for tax, accounting, chargeback, and fraud-prevention obligations.

Security and usage logs may be kept in a de-identified form (no longer linked to you), and aggregated, de-identified data may be retained to maintain the integrity of statistics and the question bank.

• Access / export: download a copy of the data we hold about you from your account Settings ("Your data" → Download).
• Correction: update your profile in Settings.
• Deletion: delete your account in Settings, or email us to request it.
• Email preferences: optional emails (such as study reminders and weekly summaries) can be turned on or off in Settings. Essential emails (account verification, password reset, and billing notices) are always sent.
• Two-factor authentication: you can optionally enable 2FA for email/password logins in Settings.

Depending on where you live, you may have additional rights (see the California and EU/UK sections). Contact support@unlimitedtests.com to exercise any of them; we will not discriminate against you for doing so.

If you are a California resident, you have the right to know what personal information we collect and how we use and share it, to access and delete it, to correct it, and to limit certain uses of sensitive personal information. We do not sell your personal information and we do not "share" it for cross-context behavioral advertising. For minors, we follow California's student-privacy protections, including not selling student information or using it for targeted advertising or non-educational profiling. To exercise your rights, email support@unlimitedtests.com.

If you are in the EU or UK, you have rights to access, correct, delete, restrict, and object to processing of your personal data, and to data portability. Our legal bases are described in "How we use your information." Children's consent thresholds vary by country (the UK and many EU states set the age between 13 and 16); where a parent or guardian's consent is required, it must be given before the child uses the service. UK users are additionally protected by the standards of the ICO's Children's Code. To exercise your rights, email support@unlimitedtests.com.

We protect accounts with salted, hashed passwords, optional two-factor authentication (TOTP), signed sessions, rate limiting, and encryption in transit. We limit who can access personal data internally. No system is perfectly secure, but we work to safeguard your data and to respond promptly to any incident.

We and our sub-processors may process data in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers.

We may update this policy as the product evolves. When changes are material, we will update the date above and, where appropriate, ask you to review the updated policy.

Questions, requests, or concerns? Email support@unlimitedtests.com, or write to us at [POSTAL ADDRESS]. We'll respond within a few business days.