Privacy policy

Last updated: 25 October 2026

What we collect

• Account: your email address (also used as your username) and your password, stored only as a secure hash.
• Sign-in sessions: a session cookie, plus the browser type and IP address of each session, so you stay logged in and we can spot misuse.
• Purchases: which exam you bought, the amount, the date and the status of the payment. Card details go straight to Stripe; we never see or store them.
• Study activity: the answers you check, questions you viewed, flagged questions, private notes and timed practice exam results.
• Community content: your answer votes, comments and replies. Comments are public; we show a shortened form of your username, not your full email address.
• Messages: emails you send us and our replies.

Why we use it

• To create your account, keep you signed in and give you access to the exams you bought.
• To take payments, prevent fraud and handle refunds, including checking pass guarantee claims.
• To show your progress, results and notes, and the community votes and discussion.
• To answer your messages and keep the service secure.

We only send you emails about your account and purchases. We don't send marketing without asking first.

Who we share it with

• Stripe processes payments and receives the details you enter on its checkout page.
• Cloudinary stores images used in questions. It doesn't receive your personal data.
• Our hosting and database providers, who store the data on our behalf.
• Authorities, only when the law requires it.

Cookies and browser storage

• token: keeps you signed in (7 days).
• questionsPerPage: remembers how many questions to show per page until you close the browser.
• Your light/dark theme choice and the answers of a timed practice exam in progress, kept in your browser.

We don't use advertising or tracking cookies.

How long we keep it

We keep your account data while your account exists. Payment records are kept as long as tax and accounting rules require, even after an account is deleted. Expired sign-in sessions are removed automatically.

Your choices and rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account by emailing contact@examcup.com from your account's address. Depending on where you live you may have further rights, such as objecting to how we use your data or complaining to a data protection authority.

Children

The service is meant for people aged 16 and over.

Changes

If we change this policy we'll update the date above, and tell account holders about important changes. See also our Terms of service.