Privacy Policy

Information you provide to us

We collect information you choose to give us when you create an account, use learning tools, make a purchase, contact support, join community programs, or post content. This may include:

• Account information: email address, username, password hash, name, avatar or profile picture, and account settings.
• Student profile information: grade level, graduation year, target test, target test date, target score, baseline or previous scores, study schedule, and learning preferences.
• Practice and learning information: answers, question attempts, scores, timing, calculator or Desmos work, highlights, practice test events, progress, streaks, XP, levels, coins, bookmarks, notes, vocab folders, vocab sets, vocab cards, and similar study records.
• Community and user content: comments, direct messages, question sets, vocabulary content, notes, attachments, uploaded images, feedback, reports, and other content you submit.
• AI tutoring and solution content: chat messages, prompts, uploaded images, OCR inputs, extracted questions, essays, answers, generated solutions, model outputs, and related troubleshooting data.
• Payment and subscription information: Stripe customer ID, subscription ID, subscription status, plan or tier, billing period dates, promo or campaign codes, payment logs, charge/refund/dispute information, and limited card metadata such as card fingerprints where used for fraud prevention. We do not store your full card number, CVV, or full payment details on our servers.
• Support and communications: emails, support requests, cancellation feedback, complaint information, and other messages you send us.

Information collected automatically

When you use the Services, we automatically collect technical and usage information, including:

• Device and network information: IP address or IP-derived data, browser type, operating system, user agent, device characteristics, language, referring URLs, approximate location, timezone, screen signals, and hashed IP data used for security, abuse prevention, and product analytics.
• Usage and session information: pages visited, page type, time on page, session duration, feature usage, question views, activity timestamps, login attempts, failed login timestamps, password or email change history, and account lock status.
• Marketing attribution information: referral campaign codes, registration and subscription attribution, and related cookie or localStorage data.
• Advertising and tracking information: Meta Pixel events such as page views and registration or checkout-related events, subject to the choices and rights described below.

Information from other sources

We may receive information from third parties when you choose to use connected services or interact with us elsewhere:

• Google: Google account ID, email address, profile picture, and OAuth tokens when you use Google Sign-In.
• Discord: Discord user ID, username, display name, avatar, link status, server participation, beta access, invite counts, boost status, giveaway entries, and related community program information.
• Stripe: subscription, charge, invoice, refund, dispute, card metadata, and payment status information.
• Meta and advertising sources: campaign and conversion information related to ads or referrals.

We use your information to:

• Create, authenticate, secure, and administer accounts.
• Provide SAT and ACT practice, scoring, progress tracking, AI tutoring, AI-generated solutions, OCR, essay grading, community features, vocab tools, and other Services.
• Personalize learning recommendations, study plans, question selection, progress reports, and practice history.
• Process subscriptions, payments, cancellations, refunds, chargebacks, fraud checks, and tax/accounting records.
• Send service messages, support replies, account notices, billing notices, security alerts, and marketing messages where permitted.
• Run Discord community programs, beta access, giveaways, operational alerts, and support workflows.
• Monitor, debug, protect, and improve the Services, including by logging errors, investigating abuse, measuring performance, and developing new features.
• Attribute ad campaigns and measure advertising effectiveness.
• Enforce our Terms of Service, prevent fraud, protect users, comply with law, and respond to legal requests.

We share information with service providers, processors, and other third parties that help us run CookSAT. The main third parties are:

We may also disclose information:

• To other users when you post comments, profile information, messages, question sets, vocab content, or other content in visible areas of the Services.
• To business partners or successors in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets.
• To comply with law, subpoenas, court orders, legal process, or government requests.
• To protect rights, safety, security, users, CookSAT, or the public.
• With your direction or consent.

We do not sell your name, email address, or account records for money. We do use Meta Pixel and advertising attribution tools, which may be considered "sharing" or a "sale" under some privacy laws because they can support cross-context behavioral advertising.

CookSAT includes AI-powered tutoring, OCR, essay grading, question extraction, solving, explanation, and similar features. When you use these features, the text, images, attachments, essays, prompts, answers, generated outputs, and context you provide may be processed by a small number of third-party AI technology providers, accessed through their APIs, acting as service providers on our behalf. We may change or add providers from time to time.

AI features may involve sending student content, uploaded images, screenshots, essays, practice context, answer choices, and generated work to those providers. We also store AI chats, extracted questions, attachments, model outputs, and related records so the Services can show your history, debug issues, improve reliability, and maintain learning/account integrity.

Do not upload highly sensitive personal information unless it is necessary for the learning task. AI-generated responses may be inaccurate and should be checked before you rely on them.

If you sign in with Google, we collect the Google account information needed to authenticate you and maintain your session, including OAuth tokens. If you link Discord, we collect the Discord account and community information needed to connect your account and provide Discord-related features.

You may unlink connected accounts in the app where that feature is available or by contacting [email protected]. We do not control Google, Discord, Stripe, Meta, or other third-party services, and their own privacy policies govern how they use your information outside CookSAT.

We use cookies, localStorage, and similar technologies for:

• Authentication and sessions, including keeping you signed in and protecting account access.
• Security, abuse prevention, and basic service operation.
• Optional first-party product analytics, including an anonymous browser identifier, session identifier, page and feature events, timestamps, campaign attribution, signup activity, and subscription-funnel events. When you later create or access an account, consented anonymous activity may be linked to that account using time- and session-bounded identity records.
• Optional advertising measurement through Meta Pixel, including page view and conversion-related events.

Product analytics and marketing measurement are off until you make a choice, and each can be controlled separately. You can change those choices in the privacy controls on this page or in CookSAT settings. Withdrawing product analytics consent removes CookSAT's analytics identifiers and stored attribution from that browser and stops new optional collection; it does not automatically erase records already retained on our servers. Your browser may also let you block or delete storage, but some Services may not work correctly without authentication and security cookies. To make a privacy request, including deletion or an opt out of sale or sharing where applicable, email [email protected].

We keep information for as long as needed to provide the Services, keep accounts secure, comply with law, resolve disputes, prevent fraud, maintain payment and tax records, preserve learning/content integrity, and operate the product.

For the optional product-analytics system, raw event and page-view records are scheduled for deletion after 400 days. Hashed IP values attached to page views are scheduled to be cleared after 30 days. Checkout-attribution and identity-link records are also subject to the 400-day raw analytics retention window. Aggregated, de-identified reporting may be retained longer.

Account deletion today works mainly by anonymizing your identity and removing account access. After the deletion grace period, we remove or anonymize direct account identifiers on the user record and delete authentication/session/token records and friendship records. We also clear fields such as email, username, name, avatar, profile details, Google ID/image, Discord account fields, and Stripe subscription identifiers from the deleted user record where the deletion job covers them.

Some records are retained after account deletion, often in de-identified or account-disconnected form, including:

• Learning records such as attempts, practice history, test events, page sessions, scores, question views, and progress records, to preserve scoring integrity, anti-abuse signals, analytics, and product quality.
• Content contributions such as comments, vocab content, notes, question sets, Jarvis/AI records, extracted questions, images, attachments, messages, and similar records where removal would break context, moderation history, community integrity, or learning/product records.
• Payment, refund, dispute, fraud, accounting, tax, and legal records, including Stripe records, payment logs, card fingerprints used for fraud prevention, and charge/refund/dispute evidence.
• Operational logs, including logs sent to Discord channels or retained by infrastructure providers, where needed for security, debugging, abuse prevention, legal compliance, and service operation.

We may delete or anonymize additional records when legally required, when technically feasible, or after review of a verified request. Some data may remain in backups or third-party systems for a limited period according to those systems' retention practices.

We use technical and organizational measures designed to protect personal information, including HTTPS, password hashing, authentication controls, login monitoring, account lockout features, provider access controls, and operational monitoring.

No internet service is completely secure. We cannot guarantee that unauthorized third parties will never defeat our safeguards or access, steal, or modify information. You are responsible for using a strong password, keeping your login credentials private, and accessing CookSAT from a secure device and network.

CookSAT is intended for users who are at least 13 years old. The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you are under the age of majority where you live, you may use CookSAT only with permission from a parent or legal guardian. Parents and guardians should review this Privacy Policy and our Terms of Service with teen users.

If we learn that we collected personal information from a child under 13 without required parental consent, we will take reasonable steps to delete or anonymize that information as quickly as practical, subject to legal, safety, fraud-prevention, payment, and technical limits.

A parent or guardian may contact [email protected] to request review, correction, deletion, or restriction of a minor's information. We may need to verify the requester's identity and relationship to the user before acting.

Depending on where you live, you may have rights to request access to, correction of, deletion of, portability of, or restriction of certain personal information. You may also have rights to object to certain processing, withdraw consent where processing is based on consent, opt out of marketing, and appeal a denied request.

What you can do today:

• Update some account information in your account settings.
• Delete your account through account settings.
• Unlink supported third-party accounts where available.
• Contact us by email to request access, correction, deletion, review, restriction, marketing opt-out, or advertising opt-out.

CookSAT does not currently provide a self-serve data export tool. Data rights requests are handled by email at [email protected]. We may need to verify your identity before completing a request. Some requests may be limited by legal obligations, fraud prevention, payment records, security, product integrity, free expression, or technical limits.

You can opt out of marketing emails by contacting us at [email protected] or using any unsubscribe mechanism included in an email. We may still send non-marketing messages, such as account, billing, security, and support notices.

California and other state privacy laws may give residents specific rights over personal information. This section is intended to describe our current practices honestly.

Categories collected in the past 12 months:

Category A - Identifiers: YES. Examples include email, username, account IDs, IP address, Google ID, Discord ID, Stripe customer ID, and device identifiers.

Category B - California customer records: YES. Examples include name, contact information, account information, education-related profile information, and billing records.

Category C - Protected classification characteristics: NO, unless you voluntarily provide information that reveals such characteristics in content or communications.

Category D - Commercial information: YES. Examples include purchases, subscriptions, payment status, refunds, disputes, promo codes, and billing history.

Category E - Biometric information: NO.

Category F - Internet or other similar network activity: YES. Examples include page sessions, question views, login activity, device/browser information, referral information, and interaction with the Services.

Category G - Geolocation data: YES, approximate location inferred from IP address or device/network information. We do not collect precise GPS location.

Category H - Audio, electronic, visual, thermal, olfactory, or similar information: YES for electronic and visual information you upload or submit, such as images, screenshots, attachments, and AI/OCR inputs. We do not intentionally collect thermal, olfactory, or similar sensory data.

Category I - Professional or employment-related information: NO, unless you voluntarily provide it.

Category J - Education information: YES. Examples include SAT/ACT goals, scores, practice records, academic progress, essays, and learning history.

Category K - Inferences: YES. Examples include learning recommendations, skill estimates, score/progress analytics, engagement signals, and inferred study needs.

Category L - Sensitive personal information: YES. Examples include account login information, payment-related information, and student/education-related information where treated as sensitive under applicable law.

We disclose personal information to service providers and processors for business purposes, including the providers listed in Section 3. We also use Meta Pixel and advertising attribution tools. To the extent this is considered selling or sharing personal information under California law, you may opt out by emailing [email protected] with the subject "Do Not Sell or Share My Personal Information." We will process verified requests as required by applicable law.

We do not knowingly sell or share personal information of users under 16. Because CookSAT is used by teens and we do not currently collect date of birth for every user, parents or users should contact us if they believe a user under 16 has been subject to advertising sharing.

California residents may also request to know, access, correct, delete, limit use of sensitive personal information where applicable, opt out of sale/share, and not be discriminated against for exercising privacy rights. Authorized agents may submit requests by email, and we may require proof of authorization and identity verification.

California users under 18 may request removal of content they publicly posted by emailing [email protected]. Removal from public display may not remove all copies from backups, logs, moderation records, legal records, or third-party systems.

CookSAT is based in the United States, and the Services are hosted and primarily processed in the United States. If you use CookSAT from outside the United States, your information may be transferred to, stored in, and processed in the United States and other countries that may not provide the same level of data protection as your home country.

Some AI providers and subprocessors may process information outside your country, and some may process information in, or transfer it to, jurisdictions outside the United States and outside your region. By using AI features, you understand that your prompts, images, essays, and related AI inputs and outputs may be processed by the AI providers described in this Policy.

If we determine that a security incident has affected personal information in a way that requires notice, we will notify affected users, regulators, or others as required by applicable law. We may provide notice by email, in-product notice, website notice, or another legally permitted method.

We may update this Privacy Policy from time to time. The updated version will be identified by an updated "Last Updated" or "Revised" date and will be effective when posted unless a later effective date is stated. If we make material changes, we may notify you by posting a notice, sending an email, or using another reasonable method.

Effective Date: August 7, 2026

Last Updated: August 7, 2026

CookSAT LLC

Email: [email protected]

Website: cooksat.com

To request access to, review of, correction of, deletion of, or restriction of your personal information, email [email protected]. You may also use available account settings to update or delete your account.

Please include enough information for us to identify your account and understand your request. We may ask for verification before acting. We will respond as required by applicable law and will explain if we cannot complete all or part of your request.

Advertising measurement helps us understand whether the ads we run on platforms such as Instagram and TikTok actually work. To do that, we share limited purchase confirmations with our advertising partners, Meta and TikTok. A purchase confirmation may include a hashed (scrambled) version of your email address, ad click identifiers (such as values from Meta or TikTok cookies), and the purchase amount.

We never share your practice activity, scores, answers, AI tutoring conversations, or any other study data with advertising partners. Advertising pixels load only on marketing, signup, and checkout pages — never on study surfaces such as practice, tests, or tutoring.

Your choices:

• You can opt out of (or back into) this sharing at any time in your account Settings or at cooksat.com/privacy-choices.
• We honor the Global Privacy Control (GPC) browser signal as an opt-out.
• If we know you are in 9th or 10th grade, we do NOT share purchase confirmations with advertising partners unless you affirmatively opt in.