Privacy Policy

What we collect from you

Only what the service needs to work:

• Account details: the email address you sign up with, and your plan.
• Your practice work: the answers you write or record, and the scores and feedback our tools derive from them. This is what makes a debrief possible, so it is kept against your account until you delete it.
• Payment data: handled by Stripe. We receive a confirmation, the amount, and the last four digits and brand of the card. We never receive or store your full card number.
• Technical logs: IP address, browser and device type, pages requested, and timestamps. Standard server records, kept on a short cycle.

What we collect automatically, and who receives it

This site runs advertising and analytics tags that send data to third parties. They are named here because you cannot make a decision about a category:

• Google Analytics 4, for audience measurement. Data goes to Google, in the browser and also server to server through the Measurement Protocol.
• Microsoft Clarity, for session recordings and heatmaps: clicks, scrolling, mouse movement and pages viewed. Data goes to Microsoft, from the browser only.
• Meta Pixel, for advertising measurement and targeting. Data goes to Meta, in the browser and also server to server through the Conversions API.
• A client identifier we generate and store in your browser under the key pc_cid, so that a visit and a later purchase can be recognised as the same person.

Whether this counts as selling or sharing your data

We do not sell your practice answers, your feedback or your account details, and we never will. That part of the service is yours.

The advertising tags are a different matter, and we will not describe them with a comfortable word. Sending identifiers and page-view events to Meta and Google so that advertising can be targeted and measured is treated as "sharing for cross-context behavioural advertising" under California law, and depending on how it is configured it can also meet that law's broad definition of a "sale" even though no money changes hands for the data.

An earlier version of this page stated that we do not sell personal data, without qualification, while these tags were running. That statement was wrong and it has been corrected rather than softened. If you want to opt out, our do not sell or share page explains how.

Why we process it

To create and run your account, to score your work and show progress over time, to take payment, to send transactional email about your account and purchases, to keep the service secure and working, to measure which pages and campaigns bring people here, and to comply with law.

Who else processes data for us

Service providers that process data on our instructions, under contract:

• Stripe, for payment processing.
• Resend, for transactional email such as receipts and account messages.
• Netlify, for hosting and content delivery.
• Google and Meta, for the analytics and advertising described above. These two act for their own purposes as well as ours, which is why they are treated separately in the section on selling and sharing.

International transfers

We are established in the United Arab Emirates and our providers operate in the United States and the European Union, so your data is processed outside the country where you live. Where the law requires a transfer mechanism, we rely on our providers' standard contractual clauses and equivalent safeguards.

How long we keep it

Practice history stays until you delete it or close your account. Account and transaction records are kept while your account exists and afterwards for as long as tax and accounting rules require. Technical logs roll off on a short cycle. Advertising and analytics data is retained by Google and Meta under their own retention schedules, which we do not control. A TikTok pixel ran on this site until 1 October 2026 and was removed; data it sent before that date is held by TikTok under its own schedule.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, delete it, or give you a copy to take elsewhere. You can export or delete your practice history yourself from settings, and close your account outright.

If you are in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you also have the right to opt out of the sharing described above, the right not to be discriminated against for exercising any of these rights, and in some states the right to appeal a refusal. If you are in the European Economic Area or the United Kingdom, you have the rights given by the GDPR, including the right to object and the right to complain to your supervisory authority.

To exercise any of this, write to us through the contact form. We will verify that the request comes from you, usually by replying to the email address on the account, and answer within the time the applicable law allows.

Children

This service is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has given us personal information, tell us and we will delete it.

Security

Traffic is encrypted in transit, payment card data never reaches our servers, and access to production data is limited to those who need it. No service can promise perfect security, and we will not pretend otherwise. If a breach affects your data we will tell you where the law requires it, and where it does not but you would want to know.

Voice and audio

Where voice practice is available, audio is processed to produce a transcript and feedback, and is kept against your account until you delete it. Where it is not enabled, no microphone access is requested and no audio is recorded.

Changes to this policy

The revision date at the top of this page always reflects the current version. When we make a change that affects what we collect or who receives it, we will say so rather than quietly amending the text.