Privacy policy

Here is everything, by where it comes from.

• A parent account. Your name and your email address. Your password is stored only as a hash, so nobody here can read it.
• A student profile. A first name, a last initial, a username you or your student choose, and a timezone. We ask for no student email address and no student free text.
• The age check. Signing up asks for a birth month and year to confirm the student is 13 or older. We keep the yes-or-no answer with the date, the address the answer came from, and which version of this policy was in effect. We do not keep the month and year themselves. If the answer is no, we keep nothing at all about that person.
• Practice. The answers chosen, whether each one was right, and the scores worked out from them.
• The practice diagnostic. The same answers and score. If somebody asks us to email the results, we keep the address they typed, the time we sent it, and whether the tips box was checked.
• An in-person application.This is the form a parent or guardian fills in to ask about classes with Andrew at the Cornelius office. It asks for your name, your student’s name, their grade, your email address and your phone number, and if you want to add them, a test date and a note. We forward it to the waitlist system described below and email it to Andrew so a new application does not wait for someone to open the waiting list. Our own records keep no copy of it here.
• Technical. The IP address a request came from, used to hold rate limits and to run the bot check, and error reports when something breaks.

We do not sell personal information and we do not hand it to advertisers. The companies below run parts of this service for us and see only what that job needs:

• Vercel hosts the site.
• Neon hosts the database.
• Resend delivers our email.
• Cloudflare runs the quick security check on the signup form, the diagnostic form, and the in-person application form, which reads the IP address of the request.
• Upstash holds the counters behind our rate limits.
• Sentry receives our error reports. We turn off the personal details it would collect by default, and we strip more before anything is sent.
• The waitlist system at schedule.bennetttestprep.com receives in-person applications. It is run by the same tutoring practice as this site, and it is where Andrew works his waiting list from.

Information about you leaves our own systems in three places, and those three are the whole list: our error reports go to Sentry, an in-person application goes to the waitlist system, and the email that tells Andrew an application arrived carries what you typed and travels through Resend like our other mail.

We would also hand something over if the law required it, and we would tell you unless we were forbidden to.

Cookies

There are three, and none of them is for advertising.

• bc_anon is a random id with nothing about you in it. We set it when you arrive on any of our public pages, and it lets us count how many people who arrive go on to try the diagnostic. It lasts 180 days.
• bc_diag is how a browser gets back to a diagnostic it started. It lasts 30 days.
• The sign-in cookie keeps you signed in once you have an account.

All three are set by us, are marked HttpOnly so no page script can read them, and travel only over HTTPS.

How long we keep things

• Account and student profile information stays until you ask us to delete it. We do not expire accounts on a timer.
• A practice diagnostic can be opened for 30 days after it is taken. After that the emailed link and the browser that took it stop working. The answers and the score stay in our records until somebody asks us to delete them.
• An email address given for diagnostic results stays until you ask us to remove it, or until you unsubscribe if you asked for tips.
• An in-person application is not kept in our own records here. We pass it to the waitlist system as it is submitted and that system holds it from then on, and the note telling Andrew it arrived sits in his mailbox as email. To have one removed, write to the address in section 2 and we will take it out of the waiting list.

Sign in and you can change your own name and password and your students’ details at any time.

For anything else, email bennetttestprep@gmail.com from the address on the account and say what you want. To have it all removed, ask us to delete the account. We delete the parent account and every student profile on it. Practice answers stay in the system with the person stripped out of them, so the question statistics they feed stay honest and there is nothing left tying them to your family.

If your student took the practice diagnostic without an account and you want it gone, tell us the email address the results were sent to and we will remove it.

The results page also carries a “Remove them from this browser” control. That one clears the browser’s access and deletes nothing, which is what a shared or library computer needs.

When this policy changes we post the new version on this page and update the date at the top. If the change matters to what we collect or who sees it, we say what changed right here rather than leaving you to compare two versions.

What changed on August 30, 2026

• We added the in-person application form and listed everything it asks for in section 1, including the phone number. No form here had asked for a phone number before.
• We added the waitlist system at schedule.bennetttestprep.com to the list of companies and systems that see something, because an application goes there and we keep no copy. An application is also emailed to Andrew, so section 1 counts three places information leaves our own systems rather than two.
• We corrected three sentences that had gone out of date: the bot check now runs on three forms rather than two, the bc_anon cookie is set across our public pages rather than on this app alone, and Sentry is no longer the only place information leaves our own systems.

This version has been in effect since August 30, 2026.

Some browsers can send a Do Not Track signal, which asks a site to stop following you across the web. We do not follow anyone across the web, so there is nothing here for that signal to switch off, and we treat a request carrying it exactly like any other.

No other company is allowed to collect information about what you do on other websites through this one. There are no advertising scripts, no analytics scripts, and no social media buttons on any page here, and our content security policy blocks them from loading at all.

Accounts belong to parents and guardians. A student profile is made by the parent, and the classroom is for students 13 and older. If the age check says under 13, we stop there and keep no record of the person we turned away.

There is nowhere in the classroom itself for a student to write anything, so nothing a student writes there is shown to anyone else. The one box on this site that takes writing is the note on the in-person application, and that form is filled in by a parent or guardian and carries their words.

Questions about any of this go to bennetttestprep@gmail.com. A person reads it.

Back to the classroom