Privacy Policy

1. Information We Collect

When you create an account, we collect:

• Your display name and email address;
• Phone number (optional, for payment verification);
• Preferred language (English, Burmese, or Japanese);
• Quiz session history: answers, scores, and time spent per question;
• Payment slip images you upload (KBZPay / WavePay screenshots) for premium activation.

We also collect limited technical data automatically — IP address, device and browser type — to operate and secure the Service.

2. How We Use Your Information

• To deliver and personalise the practice experience;
• To track your progress and surface weak-area recommendations;
• To verify and process your premium payments;
• To send account-related emails (password reset, payment confirmation);
• To detect and prevent abuse (rate-limiting, bot detection).

We do not use your personal information to train AI models, and we do not send your personal information to third-party AI services.

3. Payment Information

Payment slip images are reviewed manually by our team to confirm your purchase. They are stored in a private, signed-URL-only bucket and are never sent to any AI service or automated processor. We do not store full card numbers or banking credentials — payment is completed within your chosen mobile wallet, not on our platform.

4. Data Storage, Security, and Retention

Your data is stored on Supabase (a SOC 2-certified provider) with row-level security policies that prevent any user from accessing another user's data. Daily encrypted backups are retained on Cloudflare R2 for 30 days.

We retain your account data and quiz history for as long as your account is active. Payment slip images are retained only as long as needed to verify and support your purchase, and are deleted thereafter. When you delete your account, we remove your personal data within 30 days, except where retention is required for legal, fraud-prevention, or accounting purposes.

5. International Data Transfer

Our infrastructure providers (Supabase, Vercel, Cloudflare, Upstash) operate servers outside Myanmar. By using the Service, you understand that your data may be processed and stored in other countries, under safeguards appropriate to each provider.

6. Cookies

We use essential cookies only — for authentication (your login session) and to remember your preferred language. We do not use third-party advertising or analytics cookies.

7. Third-Party Service Providers

We rely on a small set of providers strictly to operate the Service:

• Supabase — database and authentication;
• Vercel — application hosting (receives standard request metadata such as IP and user agent);
• Cloudflare — bot protection and encrypted backup storage;
• Upstash Redis — rate-limiting (stores per-user request counts on a short rolling window).

We also use AI tools (including Anthropic Claude) in our internal content-production process to help author practice questions and explanations before they are published. No user personal information is sent to these tools.

8. Data Sharing

We do not sell, rent, or share your personal data with any third party for marketing purposes. We disclose data only to the service providers listed above, or where legally required (such as a valid court order or fraud investigation).

9. Your Rights

You have the right to:

• Access the data we hold about you;
• Correct inaccurate information (via the Profile page);
• Request deletion of your account and all associated data;
• Export your quiz history (contact support for a CSV export).

To exercise any of these rights, reach us via the Contact page.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect data from anyone under 13. Users under 18 should use the Service with the consent of a parent or guardian. Parents who believe their child has provided us with data should contact support for prompt removal.

11. Governing Law

This policy is governed by the laws of the Republic of the Union of Myanmar.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notification before they take effect.