Privacy Policy

1. Summary

SAT Climb collects only what we need to give you a personalized SAT prep experience. We don’t sell your personal information, we don’t use it for advertising, and we don’t share it with third parties except the service providers we need to operate (payment, hosting, analytics). Students under 13 cannot use the product. Students 13 to 17 require a parent or guardian to sign up on their behalf.

2. Information we collect

Information you give us

• Account info — email, name (if provided), and target SAT score. Sign-in is passwordless: you use a one-time link sent to your email or sign in with Google, so we never collect or store a password.
• For minors’ accounts — the parent or guardian’s name and email, used to obtain and document verifiable parental consent.
• Payment info — handled by Stripe. We receive a tokenized payment reference, last 4 digits, card brand, billing ZIP, and country. We do not see or store full card numbers, CVCs, or full billing addresses.
• Free SAT snapshot — if you take our public 30-question snapshot without an account, we collect the email you enter to see your results and the answers you give, and we store a one-way hashed (not raw) version of your IP address to prevent abuse. We use this to show and email your score and to follow up about creating an account; every such email includes an unsubscribe option.
• Support & feedback — anything you send us by email, in-product feedback forms, or any other channel.

Information generated through use

• Practice activity — items shown, your responses, whether each was correct, time spent per item, session mode (Skill Focus, Section Test, Mini Mock, Full Mock), and resulting mastery updates.
• Score projections — the projected SAT range and mock concordance scores we compute from your responses.
• Device & usage info — IP address, browser type and version, operating system, referring URL, and approximate geographic location derived from IP. Collected via standard server logs and our analytics provider.
• Cookies & identifiers — see Section 4.

3. How we use information

We use the information described above to:

• provide and operate the Service — serving practice items, computing mastery, generating drill plans and score projections;
• process payments, including via Stripe, and detect or prevent fraudulent transactions;
• send transactional emails (signup confirmation, receipts, mock-test summaries, cap-reached notifications, account or security alerts);
• send product emails (sprint progress, weekly mastery summary, abandoned sessions). You can unsubscribe at any time from the link at the bottom of any product email;
• improve the product — including calibrating item difficulty, refining the mastery model, and analyzing aggregate cohort performance. We use aggregated and de-identified data for these purposes;
• respond to support requests, comply with legal obligations, and enforce our Terms of Service.

What we don’t do. We don’t sell or rent your personal information. We don’t use it for ad-targeting across the open web. We don’t share individual student responses with schools, colleges, parents (unless the account is a minor’s and the parent is the account holder), or anyone else, except as described in Section 5.

4. Cookies & tracking technologies

We use three categories of cookies and similar technologies:

• Strictly necessary — session cookies that keep you logged in and protect against cross-site request forgery. We cannot disable these; the Service won’t function without them.
• Functional — preferences such as theme, timezone, and dismissed notifications. Set on first use; can be cleared from your browser.
• Analytics — first-party PostHog cookies that help us understand how the product is used in aggregate (which features are used, where users drop off). PostHog is configured to mask sensitive inputs by default and to honor “Do Not Track” signals.

We do not use third-party advertising cookies or cross-site tracking pixels. You can block cookies via your browser settings; if you do, parts of the Service may not work.

5. Sharing & disclosure

We share personal information only in the following limited cases:

• Service providers who process information on our behalf under written agreement (see Section 6).
• Legal compliance — to comply with applicable law, a valid subpoena, court order, or other legal process; to enforce our Terms; or to protect the rights, safety, or property of SAT Climb, our users, or others.
• Business transfers — if SAT Climb is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We’ll notify you of any change in control and the resulting choices about your information.
• Parents of minors — for users aged 13 to 17, the parent or guardian creates and holds the account, so they already have full access to its information, activity, and mastery progress by signing in. We do not operate a separate parent login.

6. Third-party services

The Service runs on third-party infrastructure. These providers may process your information under our instructions:

• Stripe, Inc. — payment processing, fraud prevention. Stripe Privacy Policy.
• Railway Corp. — application hosting and build infrastructure.
• PostHog, Inc. — product analytics. Data is sent to PostHog’s US region. PostHog Privacy Policy.
• Resend — transactional and product email delivery (sign-in links, receipts, weekly summaries, reminders). Resend Privacy Policy.

We update this list when our processors change. Continued use of the Service after we update this list constitutes your acceptance of those changes.

7. Children’s privacy (COPPA)

SAT Climb is intended for students aged 13 and older. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child under 13 has provided personal information to us, please contact support@satclimb.com with the subject line COPPA. We will delete the information and terminate the account.

For users 13 to 17, the account must be created and held by a parent or guardian, who agrees to these terms on the student’s behalf. The parent or guardian remains the account holder and can review the information on file, request deletion, or revoke consent at any time by emailing us.

8. Data security

We use commercially reasonable measures to protect personal information, including:

• TLS encryption in transit for all traffic to and from the Service;
• encryption at rest for the production database and backups (provided by our infrastructure vendors);
• access controls limiting employee access to production data to those with a legitimate need;
• payment data isolation — full card data never reaches our servers; we only receive tokenized references from Stripe;
• regular dependency updates and security review.

No method of transmission or storage is 100% secure. If we become aware of a security incident affecting your personal information, we will notify you and the appropriate regulators as required by law.

9. Data retention

We keep personal information only as long as we have a reason to:

• Active accounts — for the life of the account.
• Closed accounts — we delete or anonymize account and practice data within 90 days of account closure, except where we’re required to retain it (e.g., for tax, accounting, or legal-hold purposes).
• Payment records — retained for 7 years for tax and accounting.
• Aggregated & de-identified data — may be retained indefinitely for product research and model calibration.

10. Your rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — fix inaccurate information;
• Deletion — request that we delete your personal information (subject to legal-retention exceptions);
• Portability — receive your information in a machine-readable format;
• Objection / restriction — object to or restrict certain processing;
• Opt out of sale or sharing — we do not sell or share personal information for cross-context advertising, so there is nothing to opt out of.

To exercise any of these rights, email support@satclimb.com with PRIVACY REQUEST in the subject line. We will respond within the timeframe required by applicable law (generally 30 to 45 days). We may need to verify your identity before fulfilling the request.

California residents have specific rights under the CCPA / CPRA, including the right to know, delete, correct, and the right to non-discrimination. The above process applies.

EU / UK residents can also lodge a complaint with their local data-protection authority.

11. International data transfers

We are based in the United States, and our infrastructure is primarily in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. Where required, we rely on Standard Contractual Clauses and other appropriate safeguards for international transfers.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we’ll notify you by email or in-product notice before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact

For privacy questions, requests, or complaints, write to support@satclimb.com with PRIVACY in the subject line. SAT Climb is operated by NudgeLearn LLC; for our registered mailing address, contact the same email.