Privacy Policy

1.Information We Collect

• Account information: student first name, email address, and grade level.
• Optional parent email: a parent may add their own email to receive weekly progress reports. It is stored solely for that purpose.
• Optional details: a birthday and a "dream high school", if the student chooses to share them. Both can be skipped entirely.
• Learning data: practice results, exam-simulation scores, streaks, XP and coins, and topics that need work — used to personalize practice and estimate scores.
• Payment information: processed entirely by Stripe. Card numbers go directly to Stripe; we never see or store them. We keep only what we need to know which plan an account has.
• Technical data: basic device and usage information (such as browser type and approximate usage patterns) needed to run, secure, and improve the service. We do not use third-party advertising or cross-site tracking.

2.How We Use Information

• To run the service: one-time sign-in codes, saved progress, personalized practice difficulty, predicted-score estimates, and leaderboards (which show only a chosen display name — never an email or real identity).
• To keep families informed: the weekly parent progress email, if a parent email was provided. Every email includes a working unsubscribe.
• To process payments: subscriptions and purchases through Stripe.
• To keep the service safe: preventing cheating, abuse, and unauthorized access.

We do not use student data to train third-party AI models, and we do not build advertising profiles.

3.What We Never Do

• We never sell personal information — anyone's, and especially not children's.
• We never show ads or share data with advertisers or data brokers.
• We never post anything publicly beyond the leaderboard display name a player chooses.
• We never require more information than the service needs — optional fields are genuinely optional.

4.Children's Privacy (COPPA)

AceMyStates is designed for students in grades 3–8, many of whom are under 13. We comply with the Children's Online Privacy Protection Act (COPPA):

• Parental consent. Students under 13 must have a parent or guardian's consent to create an account. We collect only the minimal information needed to provide the service — no more.
• Parents' rights. A parent or guardian may, at any time: review the information we hold about their child, request its deletion, and refuse to permit further collection (which ends the account). Email acemystates@gmail.com from the parent email on file, or with enough information for us to verify you, and we will respond promptly.
• No behavioral advertising. We do not serve ads to anyone, and we do not disclose children's personal information to third parties except the service providers listed below, who process it only on our behalf.
• We do not condition a child's participation on disclosing more information than is reasonably necessary.

5.Cookies & Local Storage

We use browser local storage and similar technologies for the service to function: staying signed in, saving practice progress and preferences on your device, and remembering settings like game difficulty. We do not use third-party advertising cookies or cross-site trackers. Clearing your browser storage signs you out and removes locally saved progress (progress synced to your account is preserved).

6.Service Providers We Use

A small number of providers process data on our behalf, only to run the service:

Each provider is bound by its own security and privacy obligations, and we share only what each one needs.

7.How We Protect Data

Account and learning data is stored with Supabase using row-level security policies and encrypted connections (HTTPS/TLS everywhere). Sign-in uses one-time email codes rather than passwords, so there is no password database to breach. Access to production data is limited to the operator of the service. No online service can promise perfect security, but if we ever become aware of a breach affecting your data, we will notify affected users promptly and in accordance with applicable law, including New York's SHIELD Act.

8.Retention & Deletion

We keep account data while the account is active. You may request deletion of an account and all associated data at any time by emailing acemystates@gmail.com; we complete deletion within 30 days. Payment records held by Stripe are retained as required by financial regulations.

9.Your Rights & Choices

• Access & correction: see or fix the information on an account at any time — in the app or by emailing us.
• Deletion: request full deletion (Section 8).
• Email choices: every non-essential email has an unsubscribe link; sign-in codes are the only strictly necessary emails.
• Parental rights: see Section 4.

10.U.S. State Privacy Rights

Depending on where you live, state law (such as the California Consumer Privacy Act or the New York SHIELD Act) may give you additional rights — to know what personal information is collected, to request deletion, and to not be discriminated against for exercising those rights. We honor these requests for all users regardless of state: everything in Sections 8 and 9 is available to everyone. We do not sell or "share" personal information as those terms are defined under the CCPA.

11.International Users

The service is operated from the United States and intended for students preparing for New York examinations. If you use it from outside the U.S., your information is processed and stored in the U.S. under this policy.

12.Changes to This Policy

If this policy changes materially, we will post the new version here, update the "Last updated" date, and — for significant changes affecting children's data — notify parents by email and obtain new consent where COPPA requires it.

13.Contact Us

Questions about privacy, or a request about your data? Email acemystates@gmail.com — a human reads every message.