Privacy policy

What PassCurve is

PassCurve is an SMLE revision question bank by Al Daim Digital. The product runs at app.passcurve.com, and its API runs at api.passcurve.com. This page explains what we store about you, why, and what happens when you delete your account.

Data we store

Everything below is keyed to your account.

• Your email address, used to sign you in. Sign-in works by a one-time code sent by email, or by Google sign-in, which shares only your email and basic profile with us through OpenID. We never store a password.
• Your exam settings: chosen exam date and daily goal.
• Study activity: question attempts, spaced-repetition review scheduling, bookmarks, private notes, streak history, XP events, daily quest progress, per-subject ability estimates, and practice session records.
• Subscription records if you subscribe: the plan, its period, and identifiers from the payment provider. Card details never reach PassCurve. Payments are processed by Stripe on the web, or Google Play in the Android app.
• A session token, kept server-side with an expiry, and stored in your browser's local storage on your device.
• Short-lived rate-limit counters that protect the service from abuse. These contain no content.

Aggregate statistics

A nightly job computes cohort-level aggregates, for example average accuracy across all candidates, used for the paid comparison feature. These aggregates cannot be traced back to an individual.

Deleting your account

Deleting your account, from Settings, Delete account, does the following immediately and permanently, in one operation:

• If you have an active Stripe subscription, it is cancelled first.
• These records are erased: question attempts, spaced-repetition state, bookmarks, notes, streaks, XP events, quest progress, ability estimates, subscription records, practice sessions, and the account itself.
• Your sign-in session is revoked.

One exception, stated plainly: if you reported a problem with a question, the report is kept but permanently unlinked from you. Reports are moderation records about a question, not about a person.

Processors

These are the only third parties that touch your data:

• Cloudflare: hosting and databases.
• Resend: sends the sign-in code emails.
• Stripe: payments on the web.
• Google: sign-in, and Google Play billing in the Android app.

No advertising, no analytics trackers, no sale of data.

Cookies

PassCurve itself sets no tracking cookies. Your sign-in token lives in your browser's local storage. Stripe and Google may set their own cookies during checkout or sign-in on their own pages.

Contact

You can reach us through Al Daim Digital at aldaim-digital.co.uk.