Privacy policy

The short version: you can read everything on this site and sit the free mocks without telling us who you are. If you buy a mock or a bundle, you get an account, and we store your email, what you bought, and the answers you type into paid mocks. We run Google Analytics with IP anonymisation and no advertising features. We sell nothing to anyone. The details follow.

1. Browsing without an account

The free mini-mocks, the drills on the topic pages and the two tools run in your browser. Your answers, timers and scores in those are not sent to us; close the tab and they are gone.

We use Google Analytics 4 to count page views and see which pages people use. It is configured with IP anonymisation and without advertising or remarketing features. Google receives the usual analytics signals (page URL, referrer, rough location, browser and device type) under its own privacy terms. We do not run any other tracker, pixel or ad network.

Besides page views, Analytics records a few steps of buying: which mock or bundle page you looked at, a click on a buy button, and a finished order with its order number and price. It also counts account sign-ups and sign-ins. Your email is never sent to it.

Analytics cookies are only set if you click Accept in the cookie banner. If you click Reject, or never answer, Google only gets cookieless signals with no identifier that could link one visit to the next. You can change your answer at any time with "Cookie settings" at the bottom of every page.

2. The promo popup

The popup that offers a discount code asks for an email address. If you give one, we store it together with the IP address the request came from and the time, so we can spot abuse of the code. We do not send newsletters or marketing mail to that address; we have no mailing list. If you close the popup instead, nothing is stored on our side, only a flag in your browser so it does not come back.

3. Accounts

A paid mock is played inside an account. When you register we store your email address, the name you type (optional), a salted hash of your password (never the password itself) and the time you signed up. When you sign in, a signed session cookie keeps you logged in for 30 days.

4. Purchases

Checkout runs on Creem's pages. Creem processes your name, email, billing country and payment details under its own privacy policy; we never see your card number. Creem then tells us your email address, what you bought, the amount and its order id, and we store that record. Access to a mock or bundle is attached to the email used at checkout, so signing in with the same email is what unlocks it. If a purchase is refunded or disputed, we record that on the same order and remove the access.

5. Paid mock attempts

Every sitting of a paid mock is stored against your account: when the clock started, every answer you typed, which ones were marked correct, the score and the time you submitted. That is what lets you reopen a graded paper, read the worked solutions and compare sittings. While a sitting is running, your typed answers are also kept in your browser's local storage so a reload does not lose them.

6. Question reports

If you flag a question as wrong or unclear, we store the question reference, your message, the IP address the report came from and, if you were signed in, your email address, so we can reply and stop spam. Reports are kept until the question is checked and fixed, then resolved and later deleted.

7. Email

If you write to omptpractice@proton.me we receive your address and whatever you put in the message, and keep the thread for context. We do not add you to anything.

8. Cookies and browser storage

The site sets three cookies of its own:

• a session cookie after you sign in (signed, HTTP-only, 30 days);
• a promo cookie after you give the popup your email (one year), so the checkout form can fill in your code;
• an admin session cookie, which only the site owner ever gets.

Google Analytics sets its own cookies, and only after you accept them. Local storage on your device holds your cookie choice, the "popup already seen" flag and, during a paid sitting, your draft answers. Nothing is set for advertising.

9. Where the data lives and who processes it

Accounts, purchases, attempts, reports and promo emails are stored in Upstash Redis. The site runs on Cloudflare Workers. Payments go through Creem, analytics through Google. Each acts as a processor under its own terms. Nothing is sold, rented or shared beyond these.

10. Retention

Purchase records are kept as long as tax law requires. Account data and attempts are kept while the account exists. Promo emails and resolved question reports are cleared periodically. Support emails are kept while they remain useful and deleted on request.

11. Your rights

Under the GDPR you can ask what we hold about you, ask for a copy, ask us to correct it or ask us to delete it. Email omptpractice@proton.me from the address on the account and we respond within 30 days. Deleting an account removes the account and its attempts; the purchase record stays for as long as tax law requires. You can also complain to your local data protection authority.

12. Changes

If our data handling changes, this page changes first and the date at the top moves.