Privacy Policy

This Privacy Policy explains what personal information Cairn collects, how we use it, who we share it with, and the choices you have. It applies to our website and learner app (together, the “Service”). Many of our users are high-school students, so we have tried to keep it short and clear. It should be read together with our Terms of Service.

1. Who we are

Cairn is operated by [Legal entity name] (“we”, “us” or “our”). We are responsible for the personal information described in this policy. You can reach us at privacy@example.com or by mail at [Mailing address].

SAT® is a trademark registered by the College Board, which is not affiliated with, and does not endorse, this site. PSAT/NMSQT® is a registered trademark of the College Board and the National Merit Scholarship Corporation, which are not affiliated with, and do not endorse, this site. PSAT™ 10 and PSAT™ 8/9 are trademarks owned by the College Board, which is not affiliated with, and does not endorse, this site. ACT® is a registered trademark of ACT Education Corp., which is not affiliated with, and does not endorse, this site. National Merit® is a registered trademark of the National Merit Scholarship Corporation.

2. The short version

• You sign in with Google. We receive your name, email address, profile picture link and a Google account identifier. We never see your Google password.
• We store the profile details you give us and a record of your practice so we can show you your answers, explanations and progress. We also keep purchase and invite records to manage your access and discounts.
• We do not sell your personal information, we do not show ads, and we do not share your information for targeted advertising.
• We do not use your learning data to train third-party AI models.
• We use essential cookies to keep you signed in, remember your chosen practice destination during sign-in and remember a friend’s invite code. We count page visits with Vercel Web Analytics and measure page speed with Vercel Speed Insights; neither identifies you. We do not use advertising cookies or tracking pixels.
• You can delete your account at any time from your Account page. Section 8 explains what is deleted and which records our service providers may keep.

3. What we collect

3.1 From Google, when you sign in

You can sign in to Cairn only with a Google account. Sign-in is handled by our authentication provider, Supabase. We ask Google only for basic sign-in information (the “openid”, “email” and “profile” permissions). With your permission, Google shares with us:

• your email address;
• your name;
• a link to your Google profile picture; and
• an identifier for your Google account.

Supabase stores this information together with a user ID that it creates for your Cairn account. We do not receive your Google password, and these permissions do not give us access to your Gmail, Google Drive, contacts or other Google data.

3.2 Information you give us

When you set up your profile, we collect:

• Display name (required), which is shown in the app;
• Target exam: SAT®, PSAT/NMSQT®, PSAT™ 10, PSAT™ 8/9, ACT®, or undecided;
• Planned test date, if you choose to give one; and
• Your acceptance of our Terms: which version you accepted, when you accepted it, and your confirmation that you meet our age requirements.

If you email us about privacy, we also receive your email address and whatever you choose to include in your message. When you use signed-in Support, we store your account ID, request type (issue or refund), message, submission time and status. For a refund request, we also store the purchase reference and the eligibility result and reason at the time you submit. When an admin closes a request, we record the closing time, admin identity and reason; you can see the closing reason in Support.

3.3 Your practice activity

Each time you work on an exercise set, including a vocabulary round, we record:

• which set you practiced;
• the answers you selected and whether each one was correct; and
• when you started and when you submitted the set.

Vocabulary rounds save your checked answers and results as exercise practice. The round’s countdown and streak display run in your browser; we do not store them as separate records.

For practice tests, we record which test you take, your answers and questions flagged for review, when you start and finish, each module’s start and submission times and timing information used to run the test. We store your practice scores and calculate your practice Selection Index for PSAT/NMSQT® practice from those scores. These are practice results, not official exam results or predictions.

From your practice records we calculate your progress and any badges you earn.

3.4 Technical information

• Session cookies. When you sign in, we set essential cookies that keep you signed in. They are “HttpOnly”, which means the code running on web pages cannot read them. See section 7.
• Practice destination cookie. We temporarily remember your choice of SAT, PSAT/NMSQT or ACT practice, or the Full Practice option you chose, while you sign in. See section 7.
• Invite-link cookie. If you follow a friend’s invite link, we temporarily remember their invite code while you sign in and set up your account. See section 7.
• Server logs. Like most websites, our hosting and database providers automatically keep server logs when your browser contacts the Service. These logs include your IP address, your browser’s user agent (which describes your browser and device type) and the time of each request. They are used for security and to keep the Service running.

3.5 Purchases

Stripe handles checkout and payment processing. We send Stripe your email address, your account ID, the practice product you chose and the version of our Terms attached to the payment. Stripe also receives the US state, ZIP code and payment details you enter at checkout. Your full card number is handled by Stripe; we do not store it in our database.

Our purchase records contain your account ID, the product, payment provider and checkout reference, whether the purchase is paid or refunded, whether it is a test payment, and when our purchase record was created.

3.6 Invites

If you use invites, we store your invite code and which account invited a new learner. A friend counts toward an invite unlock after they finish setup and accept the Terms; we use their recorded Terms acceptance to calculate this count. We also store which exam’s Practice Test 2 you opened with an invite unlock and when you opened it.

The person who invited you sees the number of friends who finished setup, their available and used unlocks, and which practice tests they have opened. The invite page does not show them your name, email address or practice results. We use the invite relationship to apply the $5 friend discount to each eligible Full Practice purchase at checkout.

4. How we use your information

We use the information described above to:

• sign you in and keep your account secure;
• set up and show your profile, including your display name, target exam and planned test date;
• provide exercise sets, vocabulary rounds and practice tests, grade your answers, show answer review, explanations and practice scores, and track your progress and badges;
• process purchases and refunds, manage access to paid practice, count completed invites, provide invite unlocks and apply eligible friend discounts;
• keep a record of your acceptance of our Terms and your age confirmation;
• review support and refund requests, record their outcomes, reply when you contact us, and tell you about important changes to the Service, our Terms or this policy;
• protect the Service and its users, including by detecting and preventing abuse, fixing errors and investigating security problems;
• improve the Service using aggregated, de-identified information that does not identify you, for example to find practice questions that many learners find confusing; and
• comply with the law and enforce our Terms of Service.

We do not:

• sell your personal information;
• share your personal information for targeted (cross-context behavioral) advertising;
• show ads in the Service; or
• use your learning data to train third-party AI models.

5. Our legal reasons for using your information

Some privacy laws require us to explain the legal reason, or “legal basis”, for using personal information. We use your information because we need it to provide the Service you asked for under our Terms of Service; because we have a legitimate interest in keeping the Service secure and improving it in ways that do not override your rights; because the law requires it; or, where needed, because you (or your parent or guardian) have given consent. If you are under 18, you may use the Service only with the permission of a parent or guardian.

6. Who we share information with

We share personal information only in the following situations.

Support administrators

Designated administrators can read support requests, the learner’s name and email address, and relevant purchase details, including the product, payment status and checkout reference. They use these details to review requests and record a closing reason. Other learners cannot read your support requests.

Service providers

We use a small number of companies to run the Service. They process personal information on our behalf, to provide their services to us:

• Vercel hosts our website and app, and counts page visits and measures page speed for us (Vercel Web Analytics and Speed Insights).
• Supabase provides our database and handles sign-in. Our database is currently hosted in the United States.
• Google is the identity provider you sign in with. Google’s own handling of your Google account is covered by Google’s privacy policy.
• Stripe handles checkout and payment processing using the information described in section 3.5. Stripe also processes and retains its own records under its Privacy Policy.

Legal requests and safety

We may disclose information if we believe in good faith that the law requires it, for example in response to a valid court order, or if it is necessary to protect the safety, rights or property of our users, the public or us.

Business transfers

If [Legal entity name] is involved in a merger, acquisition, financing or sale of all or part of its business, your information may be transferred as part of that deal. We will make sure it remains protected by this policy, or we will tell you before it becomes subject to a different policy.

What we do not share

Apart from the situations above, we do not share your personal information with anyone. In particular, we do not send your practice results to schools, colleges, the College Board, scholarship programs or advertisers.

7. Cookies and similar technologies

We use essential session cookies to keep you signed in. These cookies are HttpOnly and are needed for the Service to work; if you block them, you will not be able to sign in.

When you choose a practice destination before signing in, we set a “practice-intent” cookie containing only your SAT, PSAT/NMSQT or ACT practice choice, or the Full Practice option you chose. It carries that choice through Google sign-in and profile setup. The cookie is HttpOnly, expires after 15 minutes and is cleared when you finish profile setup.

When you follow a friend’s invite link, we set a “sat_ref” cookie containing their invite code. It lets us attach the invite to your new account during setup. This cookie is HttpOnly, expires after seven days and is cleared when the code is processed during setup. It does not track your activity across other websites.

We use Vercel Web Analytics to count visits to our pages and Vercel Speed Insights to measure how quickly they load. On each page view, Web Analytics sends Vercel the page address, the referring page, filtered query parameters, your approximate location (country, region and city), operating system, browser and device type. It uses no third-party cookies; instead Vercel recognizes a visitor by a hash created from the request and discards it after 24 hours, and it does not link your visits across other websites or identify you. Speed Insights sends the page address, page-speed measurements, your network speed, browser, device type, operating system and country, recorded anonymously and not linked across your page views. We do not use advertising cookies or tracking pixels. If we introduce other analytics or any non-essential cookies, we will update this policy first and ask for your consent where the law requires it.

8. How long we keep information

• Account, profile and practice history: we keep these for as long as your account is active, so your progress is there when you come back.
• Purchases: we keep our purchase records while your account exists and delete them with your account. Deleting your account does not delete Stripe’s own payment records; Stripe retains those under its Privacy Policy, including for legal, accounting and fraud-prevention purposes.
• Invites: deleting your account removes your invite code, your own invite unlock records and the link between your account and the person who invited you. If you invited other learners, their profiles no longer identify you as their inviter. If an invited friend deletes their account, they stop counting toward your available unlocks, but practice tests you already opened with invite unlocks stay open.
• Support requests: we keep open and closed requests, including their refund-check and closure details, while your account exists. Deleting your account deletes these requests.
• When you delete your account: we permanently delete your sign-in account, profile, support requests, our purchase records, your invite records as described above and all of your practice history. Copies may remain for a limited period in our providers’ backups until those backups are routinely replaced.
• Server logs: these are kept by our hosting and database providers for the periods set by their own retention practices.
• Page-visit and page-speed data: kept by Vercel under its own retention practices; the visitor hash is discarded after 24 hours.

If the law requires us to keep specific information for longer, we keep only that information, and only for as long as required.

9. How we protect your information

• Information sent between your browser and the Service is encrypted in transit using HTTPS.
• Access to learner records is restricted at the database level, so each signed-in user can reach only their own profile and practice records.
• Because you sign in with Google, we never store a password for you.

No website or system is perfectly secure, and we cannot guarantee that your information will never be accessed without permission. If we learn of a security incident that affects your personal information, we will notify you as required by law.

10. Your rights and choices

Whatever state or country you live in, you can ask us to:

• Access the personal information we hold about you;
• Correct information that is wrong;
• Delete your information; or
• Export a copy of your information.

You can change your display name, target exam and test date yourself on your Account page. Use the “Delete account” control there to delete your account and its associated records, as described in section 8, including the limits on deletion of service-provider records. For any other request, email us at privacy@example.com from the email address linked to your account. We may need to confirm your identity before we act on a request, to protect your account. We will not treat you differently for making a request.

You can also remove Cairn’s access to your Google sign-in at any time from your Google Account settings. Doing so stops future sign-ins with Google, but it does not delete the information we already hold; to delete it, use “Delete account” or email us.

11. Children and teens

The Service is not directed to children under 13, and children under 13 may not create an account. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has created an account, please contact us at privacy@example.com.

Users who are at least 13 but under 18 may use the Service only with the permission of a parent or guardian. A parent or guardian may contact us at privacy@example.com to review their teen’s personal information or to ask us to delete it. We will take reasonable steps to confirm that the request comes from the teen’s parent or guardian before we act on it.

12. Privacy rights under US state laws

Several US states have privacy laws that give their residents rights over their personal information. Depending on where you live, these may include the right to know what personal information a business collects and how it uses it, to access, correct or delete it, to get a copy of it, and to opt out of its sale, its use for targeted advertising, or certain kinds of profiling. Some states have additional rules for information about students and minors.

As described above, we do not sell personal information and do not share it for targeted advertising, so there is nothing to opt out of. You can make any request under the law that applies to you by emailing privacy@example.com.

13. Users outside the United States

Our database is currently hosted in the United States, and our service providers may process information in other countries where they operate. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may be different from those in your country.

14. Changes to this policy

We may update this Privacy Policy from time to time, for example if we add a feature, start using a new service provider, or the law changes. When we do, we will change the “Last updated” date at the top of this page. If we make a material change to how we use or share your personal information, we will tell you in the Service or by email before the change takes effect.

15. Contact us

If you have questions about this policy or your information, or want to make a request, please contact us:

• Operator: [Legal entity name]
• Privacy email: privacy@example.com
• Mailing address: [Mailing address]
• General support: sign in and open Support