Privacy policy

Last updated: [DATE]

DRAFT — not yet reviewed by a lawyer. This describes what the software actually does, so that a legal review is straightforward. Do not rely on it as legal advice, and have it reviewed before real students use the system.

Who is responsible

[SCHOOL NAME] operates ABD~Exams and decides what data is collected and why. Questions and requests go to [CONTACT EMAIL].

Children

This service is used by school students, some of whom are under the age of digital consent in their country. The school is responsible for obtaining any parental consent its local law requires before creating student accounts.

We do not show advertising, we do not build advertising profiles, and we do not sell or share personal data with third parties for their own purposes.

What we store

Only what the service needs to work:

Your name and email address, so you can sign in and be identified to your teacher.
Your password, stored only as an Argon2id hash — it cannot be read back, not even by us.
Your school year, so the right subjects and exams are shown.
Your exam attempts: which answers you gave, whether they were correct, your score, and when you started and finished.
Competition results: your score in a match, visible to the other players in that match.
A hashed form of your IP address on sign-in and password reset, used to detect abuse. The raw address is not kept.
A cookie that keeps you signed in, and one that protects forms against cross-site attacks.

What we do not store

No advertising or analytics trackers. No location data. No contacts. No microphone recordings — teacher dictation is transcribed by your own browser and the audio never leaves your device.

If automatic question generation is enabled in future, uploaded teaching material is processed in memory and discarded; it is never written to storage.

Who can see your results

Your attempts and scores are visible to you and to staff at your school. Other students cannot see them — except your score in a live competition, which is shown to the other players in that match, as the feature requires.

How long we keep it

Account and attempt data is kept while the account is active. Sessions expire after 7 days. Unfinished exam attempts are closed automatically. Finished competitions are deleted after [RETENTION PERIOD]. Ask [CONTACT EMAIL] to delete an account and its results.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to how it is used. Contact [CONTACT EMAIL]; the school will respond within the period its law requires.

Security

Passwords are hashed with Argon2id. Sessions use signed, HTTP-only cookies and only a digest is stored, so a database leak cannot be replayed as a login. Correct answers are withheld by the server until the point the exam is meant to reveal them. All traffic is served over HTTPS.

No system is perfectly secure. If you find a vulnerability, report it to [SECURITY CONTACT] — we would rather hear from you than not.