Privacy Policy
Effective July 4, 2026
This Privacy Policy explains what data OneTestBank ("we", "us") collects, how we use it, and your choices. It applies to the OneTestBank web application.
What we collect
We collect only what we need to run the Service for you, and nothing more:
- Account data — name, email, and optional profile details.
- Content data — the classes, questions, exams, pools, learning objectives, and files you create or upload. You own this content; we store it only to provide the Service to you and don't use it for advertising or to train third-party AI models.
- Usage data — credit usage (to apply your plan's allowance), export history, sign-in activity (device, IP address, and timestamps), and basic technical logs.
- Billing data — your plan and subscription status. Card details are handled entirely by Stripe; we never see or store your card number.
How we use it
- To provide and operate the Service.
- To enforce plan limits and bill paid subscriptions.
- To send transactional email (verification, password reset, share invites, and billing lifecycle notices).
- To secure the Service and prevent abuse.
Third-party processors
We share the minimum data necessary with service providers that help us run OneTestBank:
- Stripe — payment processing and billing.
- AI providers (Anthropic, Google) — text you submit for AI-assisted import or editing is sent to the configured model provider to produce the result. We do not use Your Content to train models.
- Resend — transactional email delivery.
- Google Cloud Vision — optional OCR for scanned PDF import, when configured.
Cookies, local storage & analytics
We use only what the Service needs to function, and we do not use advertising, cross-site tracking, or third-party analytics cookies. Because we set only essential cookies, we do not show a cookie consent banner.
- Essential cookies — two short-lived, first-party cookies are set only during Google/Microsoft sign-in to secure the OAuth handshake. They expire within minutes.
- Local storage — after you sign in, your session token and basic profile are stored in your browser's local storage (not a cookie) to keep you logged in.
- Usage analytics (cookie-free) — to understand how the Service is used and where visitors come from, we record anonymous page-visit and feature-usage events on our own servers. No tracking cookie is set and we do not store your raw IP address; a same-day, non-reversible hash is used only to approximate unique visitor counts, and marketing link tags may be recorded to see which channel referred a visit. We also derive a country-level location from your IP at the time of the visit and store only that country code, never the IP itself, and never a more precise (city or GPS) location. This data is not sold or shared with advertisers.
- Payment provider — on billing pages, Stripe may set its own cookies strictly to prevent payment fraud.
Data retention & deletion
We keep your data while your account is active. You can export all of your data or delete your account at any time from Settings → Danger zone. On deletion, your class databases are removed from the active Service (renamed and retired on disk as a short safety net) and your account record is removed. Billing records may be retained as required for legal and accounting purposes.
Security
Passwords are hashed with bcrypt, sessions use signed JWTs, and all traffic is served over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.
Students
Students do not log in to OneTestBank. They receive exported exam files from their instructor; we do not collect student data through the Service.
Your rights
You may access, correct, export, or delete your personal data from your account settings. For other requests, contact us using the address below.
Contact
OneTestBank is an independently operated service and the data controller for your information; this policy is governed by California law. Privacy questions, or to exercise your data rights? Contact us at [email protected].