Privacy Policy

1. Overview & Scope

At Ononot ("Ononot", "we", "us", or "our"), we are committed to protecting your privacy and being transparent about how your data is collected, processed, and safeguarded. This Privacy Policy explains our practices regarding personal information when you use our website, practice platform, APIs, and associated services (collectively, the "Service").

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information from third-party authentication services:

3. How We Use Your Information

We process your personal information strictly for legitimate business and operational purposes, including:

• Delivering Platform Features: Authenticating your identity, tracking your practice history, computing mastery analytics, and delivering personalized question recommendations.
• Service Reliability & Security: Detecting, preventing, and mitigating fraudulent activity, automated scraping, bot attacks, and security vulnerabilities.
• System Improvement & Machine Learning: Aggregating non-identifying telemetry to evaluate question difficulty curves, item discrimination, and system performance.
• Transactional Communications: Sending account verification tokens, password reset links, security notices, and critical operational updates.

4. Data Sharing & Third-Party Service Providers

WE DO NOT SELL, RENT, MONETIZE, OR TRADE YOUR PERSONAL DATA TO ADVERTISERS OR THIRD PARTIES.

We only share information with vetted infrastructure vendors strictly necessary to operate our Service under strict confidentiality standards:

• Cloud Database & Authentication: Supabase (PostgreSQL hosting, row-level security, and encrypted data storage).
• Transactional Email Services: Resend (delivering account verification and password reset emails).
• Product Analytics & Performance: PostHog (in-app telemetry and error diagnostics to ensure site uptime and stability).
• Hosting & Edge Delivery: Vercel (Next.js serverless execution, CDN edge caching, and SSL termination).
• Legal & Regulatory Compliance: We may disclose data if required to do so by applicable law, court order, governmental subpoena, or to protect the vital legal rights and safety of Ononot, our users, or the public.

5. Data Retention & Security Measures

We employ robust technical and organizational security controls to protect your data, including TLS 1.3 encryption in transit, AES-256 encryption at rest, secure password hashing via bcrypt with high salt rounds, and isolated database access keys.

We retain your account and telemetry data for as long as your account remains active or as needed to provide you with the Service. If you delete your account, your personal identifying records are purged from active databases in accordance with our data lifecycle procedures.

Please note that no method of transmission over the Internet or electronic storage is 100% impenetrable. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

6. Your Rights & Data Choices (GDPR & CCPA/CPRA)

Depending on your jurisdiction (such as the European Economic Area, UK, or California), you may possess statutory privacy rights regarding your personal information, including:

• Right of Access & Portability: The right to request a copy of the personal data we maintain about you.
• Right to Rectification: The right to correct inaccurate or incomplete account details.
• Right to Erasure ("Right to be Forgotten"): The right to request permanent deletion of your account and associated attempt records.
• Right to Restrict or Object: The right to object to or restrict certain data processing activities.
• Non-Discrimination: We will not discriminate against you for exercising any of your statutory privacy rights.

To exercise any of these rights, submit a written request to support@ononot.com. We will respond within thirty (30) days.

7. Children's Privacy (COPPA)

Our Service is not directed to children under the age of 13. We do not knowingly collect or solicit personal information from children under 13. If we learn that we have inadvertently collected personal data from a child under 13 without verifiable parental consent, we will promptly take steps to delete that information from our servers.

8. International Data Transfers

Ononot operates primarily in the United States. If you access the Service from the European Union, United Kingdom, Asia, or any other region with laws governing data collection and use that differ from United States law, please be aware that your information will be transferred to and processed in the United States in accordance with this Privacy Policy.

9. Changes to This Privacy Policy

We may update our Privacy Policy periodically to reflect changes in our operational, legal, or regulatory practices. We will notify you of any material changes by updating the "Last updated" date at the top of this policy and, where appropriate, displaying a notice on our platform.

10. Contact Us

If you have questions, comments, or data privacy requests regarding this Privacy Policy, please contact our Data Protection team at: