Privacy Policy

We only ask for what the platform needs to work:

• To create your account: your email, and your name if you enter one. Your password is never stored as text — only an irreversible bcrypt hash of it is kept.
• From your use of the platform: your answers to questions, mock exam attempts, questions you've saved, your mistakes, your study plan, and your XP and day streak. This is the platform itself: without it there is no readiness score, no plan, and no mistake log.
• For a paid subscription: the plan name, start and end dates, and the number of attempts used, plus a record of your payments (amount, currency, payment status, and the payment provider's own payment id). We never store your card details — payment happens entirely with a licensed payment provider, outside our servers.
• Automatically: when your account was created and when you were last active.

We use Vercel Web Analytics to understand which public pages are visited and improve the site. It records aggregated information such as page, referrer, device type, browser, and coarse region. We do not send it your name, email, answers, or exam results, and we do not add custom events containing personal data.

Account, learning, exam, and admin pages are excluded from analytics, and URL query strings are removed before an event is sent. We do not use Google Analytics, advertising pixels, or heatmaps, and we do not sell or rent your data.

We use exactly two kinds, and both are necessary:

• Session cookie: keeps you signed in. Without it you'd be signed out on every page.
• Language cookie: remembers your choice between Arabic and English.

No advertising or tracking cookies. Vercel Analytics uses aggregated statistics without third-party cookies, and is not used on your protected pages.

It is stored in a managed database with Neon (a managed PostgreSQL database service), whose servers are in Frankfurt, Germany (European Union). That means your data is processed and held outside the Kingdom of Saudi Arabia. We state this explicitly because it's your right to know before creating an account.

The connection to the database is encrypted (TLS), as is your connection to the site.

Only the platform's administrators, and only to the extent needed for operations and support. We do not share your data with anyone else unless required by applicable law or a court order, or with our payment provider to the extent needed to process your subscription — and when we do, we tell you unless the law forbids it.

We keep your data for as long as your account exists, because it is your account's content: your mistake log and progress mean nothing if deleted. Deleting your account deletes all data tied to it.

At any time, you may request to:

• Access the data we hold about you.
• Correct any inaccurate information.
• Delete your account and everything tied to it.
• Get a copy of your data.

Account deletion is self-service from your "My profile" page and happens immediately, no waiting. Access, correction, and getting a copy are handled manually by writing to us at passuit4@gmail.com, and we respond within thirty days. We say it as it is rather than claim something isn't built yet.

The platform is intended for people 18 or older, or those using it with a guardian's consent. We do not target children or knowingly collect their data.

If what we collect or where we store it changes, we update this page and change the "last updated" date above. We will notify you by email of material changes.

For any question about your privacy: passuit4@gmail.com