This Privacy Policy explains what information LNATpractice (the “Service”) collects, how we use it, and who we share it with. It applies when you use the Service as a guest or with a registered account. Please also read our Terms of Service.
Information we collect
Account information
When you register, we collect your email address and display name. You can optionally add your target university and intended test date to personalise your preparation. This information is used to create and manage your account.
Guest accounts
So you can start practising and save progress before registering, we create a lightweight, anonymous guest account for you. A guest account can be upgraded to a full account at any time, which preserves the progress already linked to it.
Google authentication
If you choose to sign in with Google, we receive your verified email address and basic profile information (such as your name or display name) from Google to create or access your account. We do not receive your Google password.
Practice and performance data
As you use the Service, we record data about your practice — including your answers, scores, mistakes, flags, progress, and points or leaderboard events. This lets us score your work, show your progress, and power features such as mistake review and analytics.
Essay submissions and AI processing
When you submit a Section B essay for feedback, the text of your essay is transmitted to and processed by third-party artificial intelligence service providersacting on our behalf, which generate the automated feedback. We do not control those providers’ own systems, and we may change providers at any time. Your essay text leaves our infrastructure for this purpose — it is not processed anonymously, because it is transmitted together with the request that identifies your submission to us.
We store your essay and its feedback so you can revisit them later. Do not include personal details in your essay text that you would not want processed in this way.
Subscription and payment data
Payments for the Pro plan are processed by Stripe. We do not store your full card numbers. We retain your subscription status and the identifiers needed to manage your subscription and billing.
Support requests
When you contact us for help, we collect your email address and the content of your message so we can respond. Support email is handled through our email provider, Brevo.
Authentication and cookies
Authentication uses secure, HttpOnly session cookies (an access token and a refresh token) set by our backend. These cookies are strictly necessary to keep you logged in and to operate the Service. They are not used for advertising.
Our authentication cookies are strictly necessary and are not used for advertising. The Reddit Pixel and Google Ads tag may separately set or read advertising measurement cookies to attribute visits and registrations to our advertising campaigns.
Analytics and logging
We keep basic server-side request logs for security, debugging, and abuse prevention — for example to detect unusual activity and diagnose problems.
We also use first-party product analytics to count page views and understand which campaign source brought visitors to the Service. When a recognised utm_source or Google Ads click identifier is present, we retain only the normalised source value in your browser for up to 30 days and attach it to our own analytics events. We do not retain the click identifier, complete campaign URL, or arbitrary query parameters for this purpose.
We load the Reddit Pixel and send page-visit and registration events to Reddit for campaign measurement and attribution. Sensitive authentication routes are excluded, and we do not send essay text, practice answers, or payment details through the Pixel.
We also load the Google Ads tag and send page-view events to Google for advertising measurement and attribution. We send the page path without its query string, exclude sensitive authentication routes, and do not send essay text, practice answers, or payment details through this tag.
Third-party processors
We rely on a small number of trusted providers to run the Service. We share data with them only as needed to provide the Service, and each processes data on our behalf for the purpose described:
- Google — optional sign-in and Google Ads measurement.
- Stripe — processing subscription payments.
- Third-party artificial intelligence service providers— generating automated feedback on your essays. Essay text is transmitted to these providers for processing.
- Brevo — sending transactional and support email.
- Reddit — advertising measurement and campaign attribution.
- Hosting and database providers — hosting the application and operating our PostgreSQL database.
Data retention
We keep your account and performance data for as long as your account is active. Your essay text and feedback are retained so you can revisit them. Server logs are kept for a limited period and then deleted or anonymised in the ordinary course of operating the Service.
Account deletion
You can delete your account at any time from your Settings. Deleting your account removes your personal account data from the Service. Some information may be retained for a limited period where we are required to do so, for example to meet legal or accounting obligations, after which it is deleted.
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct information that is inaccurate or incomplete.
- Request an export of your data in a portable format.
- Request deletion of your account and personal data.
You can exercise many of these rights directly from your Settings, or by contacting us through the Support page.
Children and eligibility
The Service is intended for people preparing for university admission. It is not directed at children, and you should be at least 16 years old to use it, consistent with the age of typical applicants. If you believe someone under this age has provided us with personal data, please contact us so we can address it.
International data transfers
Some of our processors may store or process data in countries other than your own. Where personal data is transferred internationally, we take reasonable steps to ensure it remains protected in a manner consistent with this policy and applicable law.
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you within the Service.
Contact
If you have questions about this Privacy Policy or how we handle your data, please reach us through the in-app Support page.