Privacy Policy

1. Who we are

Casper Prep Test (casperpreptest.com) is an independent practice tool for students preparing for the CASPER assessment, covering both the typed section and, on paid sittings, the on-camera video section. It is not affiliated with, endorsed by, or operated by Acuity Insights, who administer the official CASPER test. The service is operated from Australia.

2. What data we collect

When you create an account or use the service, we collect:

• Account data: your email address. That is the only personal detail registration asks for. We do not ask for your name, your institution, or your date of birth.
• Authentication data: a hashed password, and the one-time codes we email you to verify your address or reset your password. Codes are stored hashed, work once, and expire after 15 minutes. We never store plaintext passwords.
• Practice content: the written responses you submit during timed sessions, and on paid sittings the text transcript of your spoken video answers, along with AI-generated scores, feedback, and quartile bands. The video files themselves are never sent to us; they stay in your own browser. The audio of a spoken answer may be sent to our own transcription service to produce the transcript, and is deleted as soon as the text comes back (or within a day at most, if a transcription attempt fails partway); producing the transcript also involves your browser’s speech recognition, which on most browsers is a cloud service run by the browser vendor. Section 5 sets out both paths.
• Billing data: if you buy a pass, Stripe’s checkout collects your card details and the name and billing address attached to them. That happens on Stripe’s own payment page; we never see or store your card number. What we keep is the purchase record Stripe reports back to us: which pass, when, how much, in which currency, whether it was later refunded, and the reference numbers Stripe uses for the payment and for you as a customer, so the app knows whether your access is paid up and so a refund can be matched to the right purchase.
• Usage data: session timestamps, attempt counts, account preference settings, and when you last signed in. For each sitting we also keep a short behaviour record separate from the sitting itself: how far through the questions you got, which ones you put an answer in, where you were when you stopped, and the score if it was marked. We read it to see where people get stuck, and to fix what is causing it.
• Feedback you send us: if you use the feedback button in the app, we store the star rating, the topic you picked, any comment you write, and which page of the app you were on when you opened the form. That page address can identify a particular sitting of yours. Feedback is tied to your account so we can follow it up, and we keep it as a record of what users have told us.
• Your own provider key, only if you add one: the settings page lets you paste your own OpenAI or Anthropic API key. A personal OpenAI key takes over writing your scenarios, so generation runs on your account with OpenAI rather than ours. Grading works differently: a key you have saved replaces ours for that provider, so whenever grading reaches OpenAI or Anthropic it goes through your key and is billed to your account with them. While the service has its own primary provider configured, grading runs there first, on our account, and your key is reached only as a fallback; if that provider were ever switched off, your key would be the first one used. Calls made with your key are billed to your own account with that provider, and the key is deleted along with your account if you ask us to delete it. Keys are encrypted before they are stored, never sent back to your browser or shown to anyone, and the app only ever displays whether a key is set. Adding one is optional and you can replace it at any time.

3. How we use your data

• To create and manage your account.
• To deliver your practice sessions, scores, and feedback.
• To process pass payments through Stripe.
• To enforce usage caps and rate limits on the service.
• To build anonymous, aggregate score statistics across all accounts, which power percentile and quartile comparisons in your reports. Only numeric scores feed these statistics: your written responses and transcripts are never shared with, or visible to, any other account. These statistics also include calibration sittings that we generate and grade ourselves, which give the comparison a starting population. The overall comparison appears only for fully answered sittings, once enough of them exist for your sitting type; per-question comparisons cover any scenario you answered, drawn from all recorded answers to that question.
• To keep and reuse the practice questions themselves. A question you were dealt may be stored in our question bank and later shown to another student. What is stored is the question, never your answer to it, and a banked question carries no link back to you or to your account. The bank also keeps a running count and score distribution for each question, which is what per-question comparisons are drawn from; those are numbers only.
• To check the quality of those questions. Once a night the questions waiting in the bank, and only the questions, are sent to an AI provider to be scored against our criteria and marked approved or rejected. No answers, transcripts, email addresses, or account details are included in that review.
• To send you the one-time codes that verify your address or reset your password, and, if someone tries to open a second account with your address while yours exists, a one-off notice that the account is already yours. Those are the only emails we send you. Receipts, renewal notices, and payment-failure warnings come from Stripe, not from us, and we send no marketing email at all.

We do not sell your data. We do not use your written practice responses for advertising targeting.

4. AI processing

Your written responses are sent to a third-party AI provider to generate scores and feedback; which provider answers depends on the service’s configuration, availability, and your own account settings. The same providers write the practice scenarios themselves on paid sittings, and rate those scenarios for quality afterwards. The rating pass sends only the questions, never anyone’s answers. If you have added your own provider key in settings, scenario writing runs through your own account with that provider; grading still runs on the service’s primary provider first, with your key as the fallback. This processing is not an optional extra we ask permission for: the AI-written scenarios and AI marking are the product itself, so it is carried out as necessary to deliver the service you signed up for. Each provider’s own privacy policy governs how it handles data submitted through its API.

5. Data storage and security

Account data, practice sessions, and the feedback you send us are stored in Convex, a hosted database service. Data is encrypted at rest and in transit. Every read is served by server-side functions that check who is asking, so no other student can see anything of yours, and your written responses and transcripts are visible only to you. We can see, on an internal operations page, the numbers attached to your account: your email address, when you signed up, when you last signed in, how many sittings you have started and finished, how far through you got in any you left, and your scores. We look at that page to run the service. It does not show anyone’s answers.

Video answers work differently, and the distinction matters. The video recording is written to storage inside your own browser and is never uploaded to us; we have no copy of it and no way to retrieve one. What the AI grader marks is the text transcript of what you said, and that transcript is produced two ways. When our own transcription service is running, the audio of your answer (the audio only, never the video) is uploaded over an encrypted connection into our database provider’s file storage, passed from there to hardware we operate, converted to text, and deleted from that storage as soon as the text exists; if an attempt fails partway, an automatic sweep removes the leftover audio within a day at most. We keep the transcript and never the audio. Your browser’s built-in speech recognition also runs during every spoken answer, whether or not our service is in use: it provides the live fallback transcript that stands in if our service cannot be reached, and on Chrome and most Chromium-based browsers that built-in feature works by sending your audio to the browser vendor’s servers under that vendor’s privacy policy, outside our control. If you would rather no audio leave your machine at all, use the typed option for the video section.

Recordings do not sit in your browser forever. Clips older than about thirty days are deleted the next time you start a sitting, and clearing your browser’s site data removes them straight away. Because the video never leaves your device, a recording is gone for good once that happens, and we cannot restore it for you.

6. Third-party services

• Convex: database, authentication, and the server-side functions the app runs on.
• Stripe: payment processing, receipts, and billing history.
• Cloudflare: bot protection (Turnstile) on the signup and password-reset forms. Solving the check sends your IP address and browser signals to Cloudflare so it can tell people from scripts.
• Third-party AI providers: AI scoring of responses, scenario generation on paid sittings, and the nightly quality rating of banked questions.
• Resend: delivery of verification and password-reset emails.
• Vercel: hosting, and anonymous usage analytics covering page views, anonymous page-performance measurements (Core Web Vitals) from real visits, plus three product events: a signup being submitted, a sitting being started, and a checkout being started. These carry no practice content and no personal details.

Each provider has its own privacy policy and data processing terms. We only share the minimum data necessary for each service to function.

7. Where your data is processed

The service is operated from Australia, but the providers listed above run on infrastructure in the United States, in China, and elsewhere. Your written responses and, on paid sittings, your spoken-answer transcripts are marked by an AI provider outside Australia, and which provider that is depends on the service configuration and on which is available at the time. Creating an account, sitting a practice test, or buying a pass therefore involves your data being transferred to and processed in countries whose privacy laws differ from those where you live, including countries with weaker protections than Australia has. That transfer is inherent in how the service is built and delivered; there is no way to use it without one. We only send each provider the minimum data it needs to do its job.

8. Data retention

Your account data and practice history are retained for as long as your account is active. Accounts that have been inactive for more than 24 months may be deleted, along with their data; we will email the address on the account with reasonable warning before doing so. If you wish to have your data deleted sooner, contact us at the email below and we will process your request within 30 days. Deletion is handled by us by hand; there is no self-serve delete button in the app yet. Deleting your account also deletes any personal API key you saved. Note that we cannot recall data already sent to an AI provider for marking; each provider’s own retention policy governs that copy.

We also keep a short operational log of what the server did, such as a sitting being generated, a grading run failing, or a payment webhook arriving. Those lines are labelled with your account id so we can answer questions about your own account, and they hold no practice content. A few of them, written when an email we tried to send you failed or was rate-limited, carry the email address instead, because at that moment there may be no account to point at. All of them are deleted automatically after 30 days. Separately, each spoken answer sent for transcription leaves a short-lived record holding the text that came back and the text your browser heard, kept so we can tell what a sitting was marked on; those are deleted after 30 days too. The records that pace verification emails and sitting limits are cleared daily.

Two things outlive a deleted account. Questions that entered the question bank stay in it: they are the questions themselves, with no answer of yours attached and no link back to you, so deleting your account removes your responses and scores without emptying the bank other students practise on. Feedback you sent us through the app also stays, because it is a record of what was said about the product rather than part of your practice history. If you would rather it went too, say so in your deletion request and we will remove it.

8a. Data breaches

If we become aware of a data breach involving your personal information that is likely to result in serious harm, we will notify you promptly at the address on your account, tell you what was involved and what we are doing about it, and notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it. Users outside Australia will be notified with the same promptness.

9. Cookies and sessions

We use a session cookie to keep you signed in. No advertising or third-party tracking cookies are used.

10. Your rights

You can access your practice data at any time from the history page, and update your account settings from the settings page. You may also ask us to correct your data, to provide a copy of it, or to delete your account and everything associated with it; write to the address below. Depending on where you live you may have further rights under local privacy law, including the right to complain to a data protection regulator.

If you have a privacy complaint, write to us first at the address below and we will respond within 30 days. If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (oaic.gov.au), or to the privacy regulator where you live.

11. Children

This service is intended for candidates preparing for post-secondary admissions and is not directed at children. You must be at least 16 years old to create an account. If we learn that we hold data from someone under that age, we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by updating the “Last updated” date at the top of this page. If a change materially affects how we handle data you have already given us, we will say so rather than rely on the date alone.

13. Contact

For privacy questions, correction requests, or deletion requests, contact us at admin@casperpreptest.com.