Privacy Policy

What we collect

Account and age information

We collect the name and email or private username you use to create an account. If you choose Google sign-in, we receive your verified email, Google account identifier, name, and profile image. Credential accounts store a password hash and recovery email, not the password itself.

Student signup asks for a date of birth only to calculate an age band on the server. The date of birth is not retained. We store only whether a learner is age 13–17 or 18 or older, plus Parent/guardian relationship and adult-attestation records when those features are used.

Learning and product information

We store practice and test activity, answers, accuracy, time spent, progress, bookmarks, achievements, study settings, score estimates, and the history needed to show work and choose later practice. If you send feedback, we store its subject, description, page, basic browser/device details, and any screenshot you choose to attach.

Billing, support, and security information

When Plus billing is available, we store payer/learner relationships, Stripe customer, Checkout, subscription, and event identifiers, subscription status, and paid-period dates. Stripe collects card and payment details on its hosted pages; SAT Crush does not store complete card numbers. We also keep session records, short-lived security cookies, request-throttling records, and security/audit events needed to protect accounts and investigate incidents.

How we use information

• create, secure, and support accounts;
• deliver practice, tests, explanations, and progress views;
• connect a learner with a Parent/guardian when they ask us to;
• process and reconcile Plus billing when Checkout is enabled;
• send transactional account or service messages when enabled;
• respond to support, privacy, deletion, export, and refund requests;
• debug the service, prevent abuse, and comply with law.

During the invited beta we do not send marketing email. We do not sell personal information, use it for behavioral advertising, or run third-party advertising trackers. The student service does not send account or learning data to an AI provider.

Cookies

SAT Crush uses essential cookies for sign-in and account protection: authentication/session cookies, CSRF protections, short-lived signup age/role state, and recent-login security state. These are required for the service to work and do not need consent.

With your explicit consent, we additionally use Google Analytics to understand how the product is used — pages visited, features used, and where the visit came from. A consent banner asks before any analytics cookie is set; declining changes nothing about the service. Your choice expires after 12 months and is asked again, and you can withdraw consent at any time by writing to support@satcrush.com. Analytics is configured with Google advertising signals disabled and the minimum data retention Google offers. We do not use advertising or behavioral-tracking cookies, and analytics data is never used for advertising.

Separately, if you arrive through a link that identifies its source (such as a campaign link), we record that source in a first-party cookie on our own domain so we can tell which channels bring students to SAT Crush. This information is not shared with any third party and does not track you across other sites.

Verified service providers

We disclose information only as needed to operate the service, respond to lawful requests, protect people and the service, or complete a business transfer subject to this policy.

Minors

SAT Crush does not permit accounts for children under 13. If we learn that an under-13 child created an account, we will disable it and delete the associated personal information. Users ages 13–17 must use SAT Crush with a Parent or guardian’s knowledge. An adult must be the payer for Plus.

A Parent account can see only the limited learner information exposed by the connected-account features. Contact us if an account was created or connected without appropriate knowledge.

Retention and security

We keep account and learning data while the account is active and until it is no longer needed to provide or secure the beta. After a verified deletion request, we aim to remove or de-identify account and learning data from the active system within 30 days. Limited billing, fraud, security, and legal records may be retained for up to seven years where reasonably needed. Residual copies may remain temporarily in protected database recovery copies and will not be restored except for recovery, security, or legal needs.

We use HTTPS, access controls, password hashing, signed provider events, and least-privilege production database access. No online service is completely secure; please report a suspected account or privacy incident promptly.

Your choices and requests

You may ask to access, correct, export, or delete your personal information. We will verify the requester and may retain information when law, security, fraud prevention, billing, or dispute handling requires it. During the beta these requests are handled manually.

Email support@satcrush.com from the account or recovery email when possible. The same address handles privacy, deletion, export, billing, refund, and legal requests. See the Refund Policy for billing rules.

Changes

We may update this policy as the beta changes. We will post the new effective date here and provide additional notice before a material change when reasonably possible.