Privacy Policy

1. Information We Collect

When you create an account, we collect:

• Your display name and email address;
• Phone number (optional, for payment verification);
• Preferred language (English, Burmese, or Japanese);
• Quiz session history: answers, scores, and time spent per question;
• Payment slip images you upload (KBZPay / WavePay / AYA Pay / UAB Pay screenshots) for premium activation.

We also collect limited technical data automatically — IP address, device and browser type — to operate and secure the Service.

2. How We Use Your Information

• To deliver and personalise the practice experience;
• To track your progress and surface weak-area recommendations;
• To verify and process your premium payments;
• To send account-related emails (password reset, payment confirmation);
• To detect and prevent abuse (rate-limiting, bot detection).

We do not use your personal information to train AI models. The only personal information we send to a third-party AI service is your payment slip image, which is read automatically to pick up the transaction details printed on it — see section 3.

3. Payment Information

Payment slip images are read by an automated OCR service, which picks up the transaction details on the slip (date, amount, transaction number) so we can match your payment to your order. A member of our team always makes the final decision — no purchase is approved or rejected automatically. Slips are stored in a private, signed-URL-only bucket and are used only to verify your purchase. We do not store full card numbers or banking credentials — payment is completed within your chosen mobile wallet, not on our platform.

4. Data Storage, Security, and Retention

Your data is stored on Supabase (a SOC 2-certified provider) with row-level security policies that prevent any user from accessing another user's data. Backups are managed by our database provider.

We retain your account data and quiz history for as long as your account is active. Payment slip images are kept for 6 months so we can verify and support your purchase, and are deleted automatically after that. The transaction number and amount we read from a slip are kept indefinitely for accounting and fraud-prevention — this is what stops the same payment slip being used twice. You can ask us to delete your account at any time via the Contact page; we action these by hand, so please allow a few working days. Some records are kept longer where retention is required for legal, fraud-prevention, or accounting purposes.

5. International Data Transfer

Our infrastructure providers (Supabase, Vercel, Cloudflare, Upstash) operate servers outside Myanmar. By using the Service, you understand that your data may be processed and stored in other countries, under safeguards appropriate to each provider.

6. Cookies

We use essential cookies only — for authentication (your login session) and to remember your preferred language. We do not use third-party advertising or analytics cookies.

7. Third-Party Service Providers

We rely on a small set of providers strictly to operate the Service:

• Supabase — database and authentication;
• Vercel — application hosting (receives standard request metadata such as IP and user agent);
• Cloudflare — bot protection and encrypted backup storage;
• Upstash Redis — rate-limiting (stores per-user request counts on a short rolling window).
• Google (Gemini) — reads the transaction details on payment slip images, as described in section 3.

We also use AI tools in our internal content-production process, to help author practice questions and explanations before they are published. No user personal information is sent to those tools. The one place a third-party AI service touches your personal information is the payment slip reading described in section 3.

8. Data Sharing

We do not sell, rent, or share your personal data with any third party for marketing purposes. We disclose data only to the service providers listed above, or where legally required (such as a valid court order or fraud investigation).

9. Your Rights

You have the right to:

• Access the data we hold about you;
• Correct inaccurate information (via the Profile page);
• Request deletion of your account and all associated data;
• Export your quiz history (contact support for a CSV export).

To exercise any of these rights, reach us via the Contact page.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect data from anyone under 13. Users under 18 should use the Service with the consent of a parent or guardian. Parents who believe their child has provided us with data should contact support for prompt removal.

11. Governing Law

This policy is governed by the laws of the Republic of the Union of Myanmar.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notification before they take effect.