Kebijakan Privasi

This policy explains what personal information cscapass ("we", "the site") collects, how we use it, where it is stored, how long we keep it, and how you can delete it. It describes how the site actually works today; we will update this page when that changes.

1. Who we are and how to contact us

• Operator: [operator name to be confirmed]
• Contact email: [contact email to be confirmed]
• You can also reach us with the WhatsApp button at the bottom right of every page.

2. What we collect

When you create an account

• Your email address (stored in lower case).
• Your password — we only store a salted scrypt hash, never the password itself.
• If you sign in with Google: your Google account ID, email address and the name on your Google account.
• Your target score (80 by default; you can change it on the "Me" page) and the time you signed up.

When you use the site

• Mock exam records: which paper you took, the question language you chose, start and submit times, each answer, your score, and a snapshot of the questions at submission (used to build your report).
• Mistake book: questions you got wrong, the reason you picked, review status and counts.
• Topic practice: only wrong answers made while signed in are added to your mistake book. The 3-question placement quiz saves nothing.
• Orders and mock exam pack records: only created once paid features are switched on. The free version collects no payment information.

When you are not signed in

• You can take mock exams without an account. So that you can see your report and later move your results into a new account, we put a random token (cookie) in your browser. Our database stores only its SHA-256 hash, not linked to any email or name. Results from exams taken without signing in can only be moved into an account within 24 hours of starting the exam; after that, nobody who signs up or logs in on that device can take them (this protects results on shared computers).

We do not collect your real name (unless it comes from your Google profile), phone number, address, ID numbers or precise location. The site currently shows no advertising and uses no third-party analytics.

3. Cookies

• Sign-in session (authjs.session-token etc.): Keeps you signed in; the content is encrypted. 30 days; removed when you sign out or delete your account.
• csca_guest: Random token for mock exams taken without an account. 24 hours (renewed each time you start an exam); removed when you sign in or sign up.
• NEXT_LOCALE: Remembers your interface language. Kept by your browser; you can clear it at any time.
• csca_country: Only set when paid features are on and you choose a country on the pricing page, to show prices in your currency. Not set in the free version.

A few short-lived anti-forgery cookies are also used during sign-in. All of these are needed for the site to work and are not used for advertising or cross-site tracking.

4. How we use your information

• To sign you in and to save and show your mock exam scores, reports, mistake book and target score.
• To prevent abuse: after too many failed sign-in or sign-up attempts we temporarily limit attempts by email address and IP address. These counters are stored in our database; the email address and IP address are stored only as hashes (SHA-256), never in plain form, and expire after 15 minutes; expired counters are deleted gradually during later requests.
• To reply to questions you send us.

We do not sell or rent your personal information, and we do not use it for advertising.

5. Where it is stored and who can access it

• The site is hosted by [hosting provider, planned: Vercel] and the database is run by [database provider, planned: Turso]. Server region: [to be confirmed at launch]. These providers store and process data only on our instructions.
• Only the site's developers and operators can access the database, when investigating problems.
• Messages you send us on WhatsApp are handled by WhatsApp (Meta) under its own privacy policy.

6. How long we keep it

• Your account and study records: until you delete your account.
• Mock exam records not linked to any account: currently not deleted automatically. They are linked only to the hash of a random browser token and contain no email address. [Automatic clean-up period to be decided]
• When you delete your account, the data is removed from the site's database immediately. Backups kept by the database provider may still contain it until they expire under the provider's backup retention period: [to be confirmed at launch].

7. Your rights: access, correction, deletion

• Access: once signed in, the "Me" page, your reports and your mistake book show all the study records we keep for you.
• Correction: you can change your target score at any time; contact us to correct anything else.
• Deletion: sign in, open "Me" → "Delete account", and confirm with your password (accounts that only use Google sign-in type DELETE). This deletes your account, Google sign-in link, all mock exam records, mistakes, target score, and order and mock exam pack records, and signs you out. It cannot be undone.
• Data that is not in our database (for example WhatsApp messages you sent us, or payment records kept by a payment provider in the future) is not affected; contact us if you want it removed.

8. Children and teenagers

Most of our users are secondary school students preparing for the CSCA, and many are under 18. If the law where you live requires parental or guardian consent for minors to use online services, please sign up only with that consent. Parents or guardians who want to see or delete their child's data can contact us. [Exact age requirement pending legal review]

9. Changes to this policy

We will post any changes on this page and update the "Last updated" date. We will show a notice on the site for significant changes.