Privacy Policy

Welcome to CSCA.app. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and safeguard your information when you visit our website (csca.app), use our mobile applications, or otherwise interact with our services (collectively, the "Service"). This policy applies to the Service worldwide. Additional region-specific disclosures (European Economic Area, United Kingdom, California, and mainland China) are provided where applicable.

CSCA.app is an online exam preparation platform for the China Scholastic Competency Assessment (CSCA) examination. We operate the Service from mainland China. You can contact us at success@csca.app.

**3.1 Account information.** When you sign up through our authentication provider (Clerk), we receive your email address, first/last name (if provided), profile photo (if provided), your authentication method (email/password, Google, Apple, etc.), and a unique user identifier. **3.2 Learning activity.** When you use the Service, we store your practice and exam activity: questions attempted, answers submitted, scores, time spent, topic breakdowns, wrong-answer notebooks, favorites, daily streaks, mock-exam attempts, and PvP challenge history. This data is stored in our database (Supabase) so you can review your progress. **3.3 Purchase data.** When you make a purchase, we receive from our payment processors (Apple, Google, Gumroad, or Xendit) a confirmation that the payment succeeded, the product purchased, the amount, the currency, a masked payment method (e.g., "Visa ending 4242" or "Alipay"), and a transaction ID. **We do not receive or store your full credit card number, CVV, or bank account details.** For WeChat Pay / Alipay purchases made by email, we keep a record of the email exchange and transaction receipt. **3.4 Device and app data.** When you use our website or mobile apps, we automatically collect: IP address (anonymized where feasible), approximate location (country/region, derived from IP), browser type and version, operating system, device type and screen resolution, pages/screens visited, time spent, referring website, in-app events (such as exam start/submit), and app crash reports. **3.5 Cookies and local storage.** We use cookies and browser local storage to remember your preferences (language, cookie consent, dark mode), keep you signed in, and measure usage. See Section 13 for details. **3.6 Communications.** If you email us at success@csca.app or subscribe to our newsletter, we store your email address and the content of your messages so we can respond and so we can send you study tips and product updates (you can unsubscribe at any time).

We use the information we collect to: - Provide and maintain the Service, including authentication, personalized progress tracking, and delivering the paid content you purchase; - Process payments and prevent fraudulent transactions and chargebacks; - Respond to your questions and provide customer support; - Send you transactional emails (purchase receipts, account notifications, password resets) and, with your consent, marketing emails (study tips, new content announcements); - Analyze aggregate usage to improve content, user experience, and site performance; - Detect, investigate, and prevent security incidents, abuse, and violations of our Terms of Service; - Comply with legal obligations and enforce our rights.

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR: - **Contract:** To provide the Service you've requested (account, paid content, transactional emails); - **Legitimate interests:** To improve the Service, secure our systems, and prevent fraud; - **Consent:** For non-essential cookies, analytics, and marketing communications (you may withdraw consent at any time); - **Legal obligation:** To comply with applicable laws such as tax and accounting rules.

We use the following third-party service providers to operate the Service. Each provider processes data on our behalf and is contractually required to protect that data: - **Clerk** (Clerk Inc., USA) — user authentication, sign-in/sign-up, session management. - **Supabase** (Supabase Inc., USA / Singapore) — database storage for user accounts, learning activity, and purchase access records. - **Vercel** (Vercel Inc., USA) — website and application hosting, log storage, edge delivery. - **Google Analytics 4** (Google LLC, USA) — aggregated website analytics with IP anonymization. - **Resend** (Resend Inc., USA) — transactional and marketing email delivery (receipts, account notifications, learning updates). - **Gumroad** (Gumroad Inc., USA) — web payment processing for international card payments. - **Xendit** (PT. Xendit Teknologi / Xendit Inc.; Indonesia, Singapore, Philippines) — web payment processing for cards, local bank transfers, and regional e-wallets in Southeast Asia. - **Apple** (Apple Inc., USA) — In-App Purchase processing for iOS; App Store distribution. - **Google** (Google LLC, USA) — Google Play Billing processing for Android; Google Play distribution. - **WeChat Pay and Alipay** (Tencent / Ant Group, China) — payment processing for mainland China users via manual email workflow. We do not sell your personal information to any third party. We share information with these providers only as necessary to operate the Service, and they are bound to use the information solely for the purposes we specify.

Because we use service providers located outside mainland China (including in the United States, the European Union, Singapore, Indonesia, and the Philippines), your personal information may be transferred to, stored in, and processed in countries other than the one in which you reside. These countries may have data-protection laws different from those of your country. We implement appropriate safeguards for such transfers, including Standard Contractual Clauses (SCCs) where applicable, and we require all providers to maintain security and confidentiality obligations at least equivalent to those under this policy.

Depending on where you live, you have the following rights with respect to your personal information: **8.1 Users in the European Economic Area / United Kingdom (GDPR / UK GDPR):** - Right of access, rectification, erasure, restriction, portability, and objection; - Right to withdraw consent at any time; - Right to lodge a complaint with your local data-protection authority. **8.2 Users in California, United States (CCPA / CPRA):** - Right to know what personal information we collect, use, and disclose; - Right to delete personal information we have collected from you; - Right to correct inaccurate personal information; - Right to opt out of the "sale" or "sharing" of your personal information — **we do not sell or share personal information for cross-context behavioral advertising;** - Right to limit the use of sensitive personal information; - Right not to receive discriminatory treatment for exercising your rights. **8.3 Users in mainland China (PIPL):** - Right to access, correct, copy, and delete your personal information; - Right to withdraw consent; - Right to request an explanation of our processing rules. **8.4 Exercising your rights.** To exercise any of the above rights, please email success@csca.app with the subject line "Privacy Request". We will respond within 30 days (or such shorter period required by applicable law). We may need to verify your identity before fulfilling the request.

You may delete your account and associated personal information at any time by one of the following methods: 1. **In-app / website:** Sign in, go to your account page, and select "Delete my account". This will immediately initiate account deletion. 2. **Email:** Send a request from the email address associated with your account to success@csca.app with the subject "Delete my account". We will verify your identity and complete deletion within 7 business days. When you delete your account, we will permanently delete or anonymize: your Clerk authentication record, your profile information, your learning activity (practice history, exam attempts, wrong-answer notebook, favorites, streaks, PvP challenges), and your marketing email subscription. **What we may retain after deletion:** We may retain certain information where we have a legal obligation or legitimate business reason to do so, specifically: purchase records and invoices required for tax and accounting compliance (typically 5–10 years under applicable laws), fraud-prevention logs, and anonymized aggregate analytics data that cannot be linked back to you.

The Service is intended for students preparing for university entrance examinations, typically aged 16 or older. We do not knowingly collect personal information from children under the age of 13 (or the equivalent minimum age in your jurisdiction — for example, 14 in mainland China, 16 in parts of the EEA). In line with the U.S. Children's Online Privacy Protection Act (COPPA), if we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information as soon as reasonably possible. If you are a parent or guardian and believe that your child has provided personal information to us without your consent, please contact us at success@csca.app and we will take appropriate steps to remove the information.

We retain personal information for as long as necessary to provide the Service and for legitimate and essential business purposes, such as: maintaining your account while it is active; complying with legal, tax, and accounting obligations (typically 5–10 years for purchase records under mainland Chinese law); resolving disputes; and enforcing our Terms of Service. Analytics data collected through Google Analytics is retained for 26 months (the Google Analytics default) and is aggregated and anonymized.

We implement appropriate technical and organizational measures designed to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include: - HTTPS / TLS encryption for all connections between your device and our servers; - Password hashing and secure session management through Clerk; - Role-based access controls and least-privilege principles for internal systems; - Regular security reviews and dependency updates; - Anonymization of IP addresses and limitation of data collection to what is necessary. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

We use cookies and similar technologies to remember your preferences, keep you signed in, analyze site usage, and improve the Service. You can control cookies through our cookie-consent banner and through your browser settings. Blocking essential cookies may prevent some parts of the Service from working correctly. We do not use third-party cookies for cross-site advertising.

Our mobile applications may request the following permissions, each of which you can grant or deny in your device settings: - **App Tracking (iOS App Tracking Transparency / ATT):** We do not track you across other companies' apps and websites for advertising purposes. Our iOS app does not request ATT permission. - **Push notifications:** With your consent, we may send push notifications for transactional events (exam reminders, challenge results, purchase confirmations). You can disable push notifications at any time in your device settings. - **Crash and performance reports:** We may collect anonymized crash and performance data to diagnose stability issues. - **Device identifiers:** We do not use the Apple IDFA, Android Advertising ID, or any cross-app advertising identifier. All payment data inside the iOS and Android apps is handled directly by Apple and Google respectively; we never receive your card number or Apple/Google account credentials.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes, we will update the "Last Updated" date at the top and, where appropriate, notify you through the Service or by email. Your continued use of the Service after the updated policy takes effect constitutes your acceptance of the updated policy.

This Privacy Policy and any dispute arising out of or relating to it shall be governed by and construed in accordance with the laws of the People's Republic of China (mainland), without prejudice to any mandatory consumer-protection or data-protection rights you may have under the laws of your country of residence.

If you have any questions about this Privacy Policy, our data practices, or want to exercise your privacy rights, please contact us at: Email: success@csca.app Website: https://csca.app For GDPR, CCPA, PIPL, or other privacy-specific inquiries, please include the relevant framework (e.g., "GDPR Request", "CCPA Request") in your email subject line so we can route your request appropriately.