Privacy policy

• Your account. The email address you sign up with, a name if you choose to give one, and a hash of your password. We never store the password itself.
• Your practice. For each drill and test: which questions you were shown, the choice you picked, whether it was right, choices you crossed out, questions you flagged, roughly how long you spent on each one, and the resulting scores. We also keep a running accuracy tally per domain — that is what the dashboard ranks your weak spots from.
• When you use ZanWise. The last time you used the site, to within a few minutes, and which days you used it. The ZanWise team looks at these, with your account and practice history, to see whether and how the site is being used.
• Questions you report. If you report a question, we store which question it was, the reason you picked, any note you typed, and that it came from your account.
• Password resets. When you ask for a reset link we store a hashed, single-use token that expires after 60 minutes.

• No advertising, tracking pixels or cross-site tracking. The only analytics is an anonymous page-view count, described under Vercel below.
• No payment details. ZanWise is free and takes no payments.
• We do not sell, rent or trade your data, and we do not share it for marketing.
• We send no marketing email. The only email ZanWise sends is a password reset you asked for.

• One session cookie keeps you signed in. It is essential — without it the site cannot tell it is you.
• A short-lived security cookie is set while you sign in, to prevent request forgery.
• Your light or dark theme choice is saved in your browser's local storage and never leaves your device.

None of this is used for advertising or analytics, and the page-view count uses no cookies at all, which is why ZanWise has no cookie banner to click through.

• Vercel hosts the site and runs its server code, and keeps short-lived request logs that include IP addresses. It also counts page views for us with Vercel Web Analytics, which uses no cookies and is not tied to your account: for each page it records the address, the site you came from, your approximate location, and your browser, operating system and device type. Before a page view is sent we remove attempt numbers and reset links from the address, and staff pages are not counted.
• MongoDB Atlas stores the database — your account and practice history. The cluster is in Mumbai, India, and the server code runs in the same region.
• Resend delivers password-reset email, and nothing else. It sees your email address only at the moment you request a reset.

That is the complete list. No one else receives your data.

Your account and practice history stay until you ask for them to be deleted. Reset tokens expire after 60 minutes and are discarded once used. Hosting logs are kept only as long as our host retains them.

Email [email protected] and we will send you a copy of everything we hold about you, correct it, or delete your account and its practice history. We will do it within 30 days and usually much sooner. There is no account settings page yet, so for now email is the way to ask.

Plenty of people practising for the SAT are. ZanWise is for people aged 13 and over. If you are under 18, use it with a parent or guardian's knowledge. A parent or guardian can email the address above to have an account and its history removed, and we will not ask why.

We do not knowingly hold data about anyone under 13. If you believe we do, email us and we will delete it.

Passwords are stored as bcrypt hashes, never in plain text. The site is served over HTTPS. Answer keys are kept on the server and never sent to your browser, so a timed test cannot be read out of the page.

No system is perfectly secure. If data is ever exposed, we will say so on this page and email the accounts affected.

If this policy changes, the date at the top changes with it and the current version always lives at this address.

[email protected] for anything on this page. See also the terms of use and what is in the question bank.