Privacy Policy

• Your email address, when you create an account.
• Your password — stored only as a cryptographic hash by our authentication provider. We never see or store the password itself.
• Your subscription status, plan and expiry date.
• Your test scores and run history, once progress tracking is available, so you can see your own improvement.
• Anything you choose to write in the feedback form, and the email address you give with it if you want a reply.
• When feedback is sent, a one-way hash of your IP address — not the address itself. It lets us stop the form being flooded by counting recent submissions from the same sender, and cannot be turned back into an IP address by us or anyone else.
• Basic technical logs generated automatically by our hosting provider, such as IP address and browser type, kept for security and troubleshooting.

We do not ask for your name, address, date of birth, or anything about your application or service history. We do not collect sensitive information.

When payments go live they will be handled by a third-party payment provider. Card numbers are entered directly with that provider and are never sent to, seen by, or stored on our servers. We receive only confirmation that a payment succeeded and a reference for it.

• To create and secure your account, and let you sign in
• To know which tests your plan opens
• To show you your own progress over time
• To email you about your account — confirmation, password reset, and billing or service notices
• To detect and prevent misuse, such as account sharing or automated scraping

We do not sell your information, share it for advertising, or send marketing email you have not asked for.

We use one kind of cookie: the session cookie that keeps you signed in. It is necessary for the site to work and is removed when you sign out.

There are no advertising cookies, no third-party trackers and no cross-site profiling on this site.

We use a small number of providers to run the service. They process data on our behalf and are not permitted to use it for their own purposes.

• Supabase — accounts, authentication and database. Your data is stored in their Sydney, Australia region.
• Vercel — website hosting and delivery, via servers in Australia and overseas.
• A payment provider — for processing subscriptions, once payments are live.
• An email provider — for account emails such as confirmation and password reset.

Some of these providers operate infrastructure outside Australia, which may mean your information is stored or processed overseas.

Account and subscription information is kept while your account exists. Delete your account and it is removed. Basic transaction records are kept for as long as tax and business records law requires, and technical logs are kept for a short period for security purposes.

Passwords are hashed, connections are encrypted in transit, and access to the database is restricted so that a signed-in user can read only their own records. No system is perfectly secure, so please use a password you do not use anywhere else, and tell us if you think your account has been accessed.

• Access — ask us what we hold about you and we will tell you.
• Correction — your email address can be changed, or ask us and we will fix it.
• Deletion — delete your account from your account page at any time. This permanently removes your account, subscription record and any saved scores.
• Complaint — if you think we have mishandled your information, contact us first; you can also complain to the Office of the Australian Information Commissioner.

This service is not intended for children under 16, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

If this policy changes materially we will update the date at the top and, where the change affects you, tell you by email.

Questions about privacy, or to make any of the requests above:
Quantum Thread Australia (sole trader), trading as CBATone · ABN 54 499 540 660
ravijay.j@gmail.com