Privacy Policy

• Your email address, when you create an account.
• Your password, stored only as a cryptographic hash by our authentication provider. We never see or store the password itself.
• Whether you have Premium, which plan, and when it ends.
• Your test scores and run history, including the breakdown of each run, so you can see your own improvement.
• If you use Plan: your test date, the days and length of time you can practise, the days you change, and each day’s plan as it was on the day.
• Anything you choose to write in the feedback form, and the email address you give with it if you want a reply.
• When feedback is sent, a one-way hash of your IP address, never the address itself. It lets us stop the form being flooded by counting recent submissions from the same sender, and cannot be turned back into an IP address by us or anyone else.
• When something breaks, a technical error report that includes which account was signed in and a record of what the code was doing at the time. It does not include your email address.
• Basic technical logs generated automatically by our hosting provider, such as IP address and browser type, kept for security and troubleshooting.

We do not ask for your name, address, date of birth, or anything about your application or service history. We do not collect sensitive information.

Payments are handled by Stripe. Card numbers are entered directly with Stripe and are never sent to, seen by, or stored on our servers. We receive only confirmation that a payment succeeded and a reference for it.

• To create and secure your account, and let you sign in
• To know whether your account has Premium
• To show you your own progress over time
• To email you about your account: confirmation, password reset, receipts and service notices
• To detect and prevent misuse, such as account sharing or automated scraping

We do not sell your information, share it for advertising, or send marketing email you have not asked for.

We use one kind of cookie: the session cookie that keeps you signed in. It is necessary for the site to work and is removed when you sign out.

We also use PostHog to see, in aggregate, which pages are visited and which buttons are used, so we know what to fix and what to build next. This does not identify you by name or email: unless you have an account and are signed in, PostHog has no way to connect what it sees back to you specifically, and even then we do not link its events to your account.

There are no advertising cookies, no ad-retargeting trackers and no cross-site profiling that follows you to other websites.

We use a small number of providers to run the service. They process data on our behalf and are not permitted to use it for their own purposes.

• Supabase, for accounts, authentication and the database. Your data is stored in their Sydney, Australia region.
• Vercel, for website hosting and delivery, via servers in Australia and overseas.
• Stripe, for processing payments and issuing receipts.
• Resend, for sending account emails such as confirmation and password reset.
• Sentry, for the technical error reports described above.
• PostHog, for the anonymous usage analytics described above.

Some of these providers operate infrastructure outside Australia, which may mean your information is stored or processed overseas.

Account and Premium information is kept while your account exists. Delete your account and it is removed. Basic transaction records are kept for as long as tax and business records law requires, and technical logs are kept for a short period for security purposes.

Passwords are hashed, connections are encrypted in transit, and access to the database is restricted so that a signed-in user can read only their own records. No system is perfectly secure, so please use a password you do not use anywhere else, and tell us if you think your account has been accessed.

• Access: download everything we hold about your account as a file, from your account page, at any time.
• Portability: that file is JSON, so it can be read by other software rather than only by a person.
• Correction: your email address and username can be changed from your account page, or ask us and we will fix it.
• Deletion: delete your account from your account page at any time. This permanently removes your account, Premium record and any saved scores.
• Complaint: if you think we have mishandled your information, contact us first; you can also complain to the Office of the Australian Information Commissioner.

We are based in Australia. Many of the people who use this are not, so UK GDPR and the EU GDPR apply to them and we treat everyone the same way rather than running two standards.

Why we are allowed to process your information. Each thing we do rests on one of the following.

• Performance of a contract: running the tests, saving your scores, and providing Premium you have bought. Without this we cannot provide the service you asked for.
• Legitimate interests: keeping the service secure, preventing abuse, and recording errors so faults get fixed. We use the least information that achieves it.
• Consent: analytics, which you can decline through your browser. We do not use your information for advertising and we never sell it.
• Legal obligation: keeping payment records for as long as tax law requires.

Your rights. You can ask for a copy of your information, have it corrected, have it deleted, object to or restrict how we use it, and withdraw consent where consent is what we relied on. The first and third of those are buttons on your account page and need no request at all. For anything else, email us and we will answer within one month.

Where your information is held. Outside the UK and the European Economic Area. Our database and hosting run on infrastructure located in Australia and the United States, and payments are handled by Stripe in the United States and Ireland. These transfers rely on the standard contractual clauses our providers have in place.

Complaints. Contact us first and we will try to put it right. You can also complain to the Information Commissioner’s Office in the UK, or to your national data protection authority in the EEA.

This service is not intended for children under 16, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

If this policy changes materially we will update the date at the top and, where the change affects you, tell you by email.

Questions about privacy, or to make any of the requests above:
Quantum Thread Australia (sole trader), trading as CBATONE · ABN 54 499 540 660
support@cbatone.com.au