Privacy Policy

1. Who we are

Casper Prep Test (casperpreptest.com) is an independent practice tool for students preparing for the CASPER assessment, covering both the typed section and, on paid sittings, the on-camera video section. It is not affiliated with, endorsed by, or operated by Acuity Insights, who administer the official CASPER test. The service is operated from Australia.

2. What data we collect

When you create an account or use the service, we collect:

• Account data: your email address. That is the only personal detail registration asks for. We do not ask for your name, your institution, or your date of birth.
• Authentication data: a hashed password, and the one-time codes we email you to verify your address or reset your password. Codes are stored hashed, work once, and expire after 15 minutes. We never store plaintext passwords.
• Practice content: the written responses you submit during timed sessions, and on paid sittings the text transcript of your spoken video answers, along with AI-generated scores, feedback, and quartile bands. The video and audio files themselves are never sent to us; they stay in your own browser. Note that producing the transcript involves your browser’s speech recognition, which on most browsers is a cloud service run by the browser vendor; see section 5.
• Billing data: if you buy a pass, Stripe’s checkout collects your card details and the name and billing address attached to them. That happens on Stripe’s own payment page; we never see or store your card number. What we keep is the purchase record Stripe reports back to us — which pass, when, in which currency, and whether it was later refunded — so the app knows whether your access is paid up.
• Usage data: session timestamps, attempt counts, and account preference settings.
• Your own provider key, only if you add one: the settings page lets you paste your own OpenAI or Anthropic API key. A personal OpenAI key takes over writing your scenarios, so generation runs on your account with OpenAI rather than ours. Grading works differently: it always runs first on the service’s primary AI provider, on our account, and your own key is used as a fallback when that provider is unavailable. Calls made with your key are billed to your own account with that provider, and the key is deleted along with your account if you ask us to delete it. Keys are encrypted before they are stored, never sent back to your browser or shown to anyone, and the app only ever displays whether a key is set. Adding one is optional and you can replace it at any time.

3. How we use your data

• To create and manage your account.
• To deliver your practice sessions, scores, and feedback.
• To process pass payments through Stripe.
• To enforce usage caps and rate limits on the service.
• To build anonymous, aggregate score statistics across all accounts, which power percentile and quartile comparisons in your reports. Only numeric scores feed these statistics: your written responses and transcripts are never shared with, or visible to, any other account. These statistics also include calibration sittings that we generate and grade ourselves, which give the comparison a starting population. The overall comparison appears only for fully answered sittings, once enough of them exist for your sitting type; per-question comparisons cover any scenario you answered, drawn from all recorded answers to that question.
• To keep and reuse the practice questions themselves. A question you were dealt may be stored in our question bank and later shown to another student. What is stored is the question, never your answer to it, and a banked question carries no link back to you or to your account. The bank also keeps a running count and score distribution for each question, which is what per-question comparisons are drawn from; those are numbers only.
• To check the quality of those questions. Once a night the questions waiting in the bank, and only the questions, are sent to an AI provider to be scored against our criteria and marked approved or rejected. No answers, transcripts, email addresses, or account details are included in that review.
• To send you the one-time codes that verify your address or reset your password, and, if someone tries to open a second account with your address while yours exists, a one-off notice that the account is already yours. Those are the only emails we send you. Receipts, renewal notices, and payment-failure warnings come from Stripe, not from us, and we send no marketing email at all.

We do not sell your data. We do not use your written practice responses for advertising targeting.

4. AI processing

Your written responses are sent to a third-party AI provider to generate scores and feedback; which provider answers depends on the service’s configuration, availability, and your own account settings. The same providers write the practice scenarios themselves on paid sittings, and rate those scenarios for quality afterwards. The rating pass sends only the questions, never anyone’s answers. If you have added your own provider key in settings, scenario writing runs through your own account with that provider; grading still runs on the service’s primary provider first, with your key as the fallback. This processing is not an optional extra we ask permission for: the AI-written scenarios and AI marking are the product itself, so it is carried out as necessary to deliver the service you signed up for. Each provider’s own privacy policy governs how it handles data submitted through its API.

5. Data storage and security

Account data, practice sessions, and feedback are stored in Convex, a hosted database service. Data is encrypted at rest and in transit. Every read is served by server-side functions that check who is asking, so only you can view your own practice history.

Video answers work differently, and the distinction matters. The recording itself is written to storage inside your own browser and is never uploaded to us; we have no copy of it and no way to retrieve one. What reaches us is the text transcript, which is what the AI grader marks. That transcript is produced by the speech recognition built into your browser, and on Chrome and most Chromium-based browsers that feature works by sending your audio to the browser vendor’s servers to be converted to text. So while wenever receive your audio, your browser may transmit it to its own provider under that provider’s privacy policy, outside our control. If you would rather that not happen, use the typed section rather than the video section.

Recordings do not sit in your browser forever. Clips older than about thirty days are deleted the next time the app opens that storage, and clearing your browser’s site data removes them straight away. Because they never leave your device, a recording is gone for good once that happens, and we cannot restore it for you.

6. Third-party services

• Convex: database, authentication, and the server-side functions the app runs on.
• Stripe: payment processing, receipts, and billing history.
• Cloudflare: bot protection (Turnstile) on the signup and password-reset forms. Solving the check sends your IP address and browser signals to Cloudflare so it can tell people from scripts.
• Third-party AI providers: AI scoring of responses, scenario generation on paid sittings, and the nightly quality rating of banked questions.
• Resend: delivery of verification and password-reset emails.
• Vercel: hosting, and anonymous usage analytics covering page views, anonymous page-performance measurements (Core Web Vitals) from real visits, plus three product events: a signup being submitted, a sitting being started, and a checkout being started. These carry no practice content and no personal details.

Each provider has its own privacy policy and data processing terms. We only share the minimum data necessary for each service to function.

7. Where your data is processed

The service is operated from Australia, but the providers listed above run on infrastructure in the United States and elsewhere. Creating an account, sitting a practice test, or buying a pass therefore involves your data being transferred to and processed in countries whose privacy laws differ from those where you live. That transfer is inherent in how the service is built and delivered; there is no way to use it without one. We only send each provider the minimum data it needs to do its job.

8. Data retention

Your account data and practice history are retained for as long as your account is active. Accounts that have been inactive for more than 24 months may be deleted, along with their data; we will email the address on the account with reasonable warning before doing so. If you wish to have your data deleted sooner, contact us at the email below and we will process your request within 30 days. Deletion is handled by us by hand; there is no self-serve delete button in the app yet. Deleting your account also deletes any personal API key you saved. Note that we cannot recall data already sent to an AI provider for marking; each provider’s own retention policy governs that copy.

We also keep a short operational log of what the server did, such as a sitting being generated, a grading run failing, or a payment webhook arriving. Those lines are labelled with your account id so we can answer questions about your own account, but they hold no practice content, and they are deleted automatically after 30 days. The short-lived records that pace verification emails and sitting limits are cleared daily.

One thing outlives a deleted account: questions that entered the question bank stay in it. They are the questions themselves, with no answer of yours attached and no link back to you, so deleting your account removes your responses, scores, and feedback without emptying the bank other students practise on.

8a. Data breaches

If we become aware of a data breach involving your personal information that is likely to result in serious harm, we will notify you promptly at the address on your account, tell you what was involved and what we are doing about it, and notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it. Users outside Australia will be notified with the same promptness.

9. Cookies and sessions

We use a session cookie to keep you signed in. No advertising or third-party tracking cookies are used.

10. Your rights

You can access your practice data at any time from the history page, and update your account settings from the settings page. You may also ask us to correct your data, to provide a copy of it, or to delete your account and everything associated with it; write to the address below. Depending on where you live you may have further rights under local privacy law, including the right to complain to a data protection regulator.

If you have a privacy complaint, write to us first at the address below and we will respond within 30 days. If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (oaic.gov.au), or to the privacy regulator where you live.

11. Children

This service is intended for candidates preparing for post-secondary admissions and is not directed at children. You must be at least 16 years old to create an account. If we learn that we hold data from someone under that age, we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by updating the “Last updated” date at the top of this page. If a change materially affects how we handle data you have already given us, we will say so rather than rely on the date alone.

13. Contact

For privacy questions, correction requests, or deletion requests, contact us at admin@casperpreptest.com.