Privacy policy

1. Data we collect

When you create an account with email

• Your email address.
• Your password, stored only as a one-way hash (Argon2). We never see or store the password itself.
• The display name you choose.
• Your SPM year (the year you sit the exam), if you give it.

When you sign in with Google

If you choose “Continue with Google”, we ask Google only for the basic sign-in permissions openid, email and profile. From Google we receive:

• your Google account ID (a number that identifies your Google account to us),
• your email address and whether Google has verified it,
• your name, which we use as your starting display name (you can change it).

We use Google’s access token once, to read these details right after you sign in, and then discard it. We do not store Google access or refresh tokens, and we cannot access your Gmail, Google Drive, contacts, calendar, photos or any other Google data. We don’t receive your Google password.

When you use LearnSPM

• Practice attempts: the paper, your chosen answers, your score, and when you started and finished.
• Ranked attempts: the same details for timed ranked tries, used to build rankings.
• Question reports: if you report a mistake in a question, the question, the reason you picked and any note you write.
• Sign-in sessions: a session record with its expiry and your browser’s user agent (e.g. “Chrome on Android”), so a session can be recognised and ended.
• Technical data: your IP address is used to limit repeated sign-in and password-reset attempts, and appears in our server logs, which we use for security and troubleshooting.

Stored on your device

• Cookies: learnspm_session keeps you signed in (30 days, refreshed while you use the site); learnspm_oauth protects the Google sign-in step (10 minutes); NEXT_LOCALE remembers your language. All are first-party and needed for the site to work. We use no advertising or analytics cookies.
• Browser storage: a paper you are in the middle of, attempts made offline or before signing in, your theme choice, and cached pages so the app works offline. This stays on your device; attempts are uploaded to your account when you sign in.

2. How we use your data

• To create your account, sign you in and keep you signed in.
• To save your attempts and show your results, progress and history on any device.
• To show rankings: your display name and ranked results appear on public rankings for your SPM year. Your email address is never shown to other users.
• To send account emails: verifying your address and resetting your password. We send no marketing email.
• To review reported questions and fix mistakes in papers.
• To protect the service: rate limiting, preventing abuse and investigating problems.

We don’t use your data for advertising, we don’t sell or rent it, and we don’t use it to train AI models. Admins may use an AI model to correct a paper’s questions; only the paper’s text and page images are sent, never your name, email or account details.

3. Google user data

LearnSPM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use the Google data listed above only to sign you in, to link your Google sign-in to your LearnSPM account (if your Google email matches an account you already have), and to fill in your display name.
• We don’t transfer or sell Google user data to anyone, or use it for ads or to train AI models.
• No person reads your Google data except when you ask us for help, for security, or when the law requires.
• You can remove LearnSPM’s access at any time in your Google Account connections. This stops future Google sign-ins but does not delete your LearnSPM account; see section 6 for that.

4. Who we share data with

We share personal data only with services that help us run LearnSPM, and only as much as they need:

• Hosting: the servers and database that run LearnSPM store the data described above.
• Email delivery: our email provider receives your email address and the message when we send you a verification or password-reset email.
• Google: when you use Google sign-in, Google handles the sign-in under its own privacy policy.

We may also disclose data if Malaysian law or a valid legal request requires it, or to protect the safety of our users. Your data may be processed on servers outside Malaysia; where it is, we keep the same protections described here.

5. How long we keep data

• Account data, attempts, rankings and reports: until you delete your account.
• Sign-in sessions: 30 days after last use, or until you sign out.
• Email verification links: 48 hours. Password reset links: 1 hour.
• Google sign-in step data: 10 minutes. Google access tokens: not stored.
• Server logs: kept only as long as needed for security and troubleshooting, then deleted.

6. Your choices and rights

• See and correct your data: your Account page shows your email, name, SPM year and sign-in methods, and lets you change your name and SPM year. Your attempts are on your Progress page.
• Delete your account: go to Account and choose “Delete account”. This immediately and permanently deletes your account, your Google sign-in link, sessions, attempts, ranking entries and reports from our database. You can also email us to ask for deletion.
• Under the PDPA you may ask for a copy of your personal data, ask us to correct it, withdraw consent, or ask us to stop processing it. Email us and we will reply within 21 days.

7. Security

We use HTTPS for all traffic. Passwords are hashed with Argon2, and session, verification and reset tokens are stored only as hashes. Session cookies are HttpOnly so page scripts can’t read them. No system is perfectly secure, but we work to protect your data and will tell affected users if a breach puts them at risk.

8. Students under 18

LearnSPM is made for secondary school students, many of whom are under 18. If you are under 18, please get your parent or guardian’s permission before creating an account. Parents or guardians can contact us to review or delete their child’s data.

9. Changes to this policy

If we change this policy, we will update the date below and, for significant changes, tell signed-in users on the site before the change takes effect.

10. Contact

For privacy questions or data requests, email [email protected].