Privacy Policy

Last updated: March 2026

1. Who we are

IBGOAT (ibgoat.com) is an IB exam preparation platform operated by an individual developer. Contact: [email protected]

2. What data we collect

When you create an account we collect:

• Account information — username, email address (optional), and password (stored as a secure hash, never in plain text)
• Subject preferences — which IB subjects you study and at which level (HL/SL)
• Syllabus coverage — which topics you have marked as covered
• Study activity — questions attempted, answers submitted, scores, session history, and performance per topic
• Milestones — progress achievements earned within the platform

We do not collect payment information, advertising IDs, location data, or data from third-party sources.

3. How we use your data

• To authenticate your account and keep your session secure
• To personalise your study experience (showing only your subjects and level)
• To track your progress and show you performance over time
• To send transactional emails — welcome email on registration, password reset link if requested
• To notify the platform administrator when a question bank for a topic is nearly exhausted, so more questions can be added

We do not use your data for advertising, profiling, or any commercial purpose.

4. AI marking

When you submit a written answer, your answer text and the associated mark scheme are sent to Anthropic's API (Claude AI) for automated marking. The data sent includes the question text, the mark scheme, and your written answer. Anthropic processes this according to their own privacy policy. Your answer is stored in our database as part of your session history.

5. Email communications

If you provide an email address we may send a welcome email on registration and a password reset link if requested. We do not send marketing emails. Email delivery is handled by Resend, who process your email address solely to deliver these messages.

6. Data storage and security

All data is stored on a server in Helsinki, Finland (EU). Passwords are hashed with bcrypt. All connections use HTTPS. Authentication tokens expire after 365 days. Admin access is restricted to a single verified account.

7. Your rights (GDPR)

• Access — request a copy of all data we hold about you
• Rectification — change your username and email in settings
• Erasure — request deletion of your account and all associated data
• Portability — request your data in a machine-readable format
• Object — object to any processing you believe is not justified

To exercise any right, email [email protected]. We will respond within 30 days.

8. Data retention

We retain your data for as long as your account is active. If you request deletion, all personal data will be permanently removed within 14 days.

9. Cookies

IBGOAT does not use tracking or advertising cookies. We use localStorage (browser storage) to keep you logged in. This data never leaves your device.

10. Children

IBGOAT is designed for IB students aged 16–19. We do not knowingly collect data from children under 13. Contact us if you believe a child under 13 has created an account.

11. Changes

If we make significant changes we will update the date above and notify registered users by email where practical.