We keep this honest and minimal: we collect only what’s needed to run ExamDeck, we never sell your data, and we use no advertising trackers. This policy explains what we process and your rights under the GDPR.
The controller is Skrutiny Sebastian Koczyk, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland, operating examdeck.pro. For any privacy matter, contact [email protected].
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address & securely hashed password (PBKDF2) | Create and secure your account, log you in, send essential service emails | Performance of a contract (Art. 6(1)(b)) |
| Study activity — questions answered, progress, notes, mock-exam results | Power your dashboard, error log and readiness reports | Performance of a contract |
| Google account ID & email (only if you use Google sign-in) | Authenticate you via Google | Performance of a contract |
| Technical data — IP address, device/browser info, security/rate-limit logs, error diagnostics | Keep the Service secure, prevent abuse, diagnose problems | Legitimate interest (Art. 6(1)(f)) — security and reliability |
| Aggregate usage statistics (privacy-friendly, no cross-site tracking) | Understand and improve the product | Legitimate interest |
| Purchase records (which plan, when) — payment & card data are handled by Polar, not stored by us | Grant access to what you bought, support and refunds | Performance of a contract |
We use only essential cookies: a session cookie to keep you logged in, and a short-lived state cookie during Google sign-in. We use no advertising or cross-site tracking cookies, so no cookie-consent banner is required.
We share data only with the providers needed to run ExamDeck, each under a data-processing agreement. We never sell or rent your data.
| Provider | What it does | Location |
|---|---|---|
| OVH | Server hosting (primary data storage) | EU (France) |
| Polar (Polar Software Inc.) | Payments & Merchant of Record (billing, tax) | USA |
| Resend | Transactional email delivery | USA |
| Optional “Sign in with Google” | USA | |
| Cloudflare | CDN, security & DDoS protection (processes IPs) | USA / global edge |
| Sentry | Error monitoring (may capture diagnostic data incl. IP) | USA |
| Backblaze B2 | Encrypted off-site database backups | USA |
| Umami (self-hosted) | Privacy-friendly, cookieless analytics | EU (our own server) |
Your data is stored primarily in the EU. Some providers above are based in the USA; transfers to them rely on appropriate safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
We keep your account and study data for as long as your account is active. If you delete your account (or ask us to), we remove your personal data promptly; residual copies in encrypted backups are rotated out within ~30 days. We may retain minimal records where required by law (e.g. tax records for purchases).
Under the GDPR you have the right to: access your data, rectify it, erase it (“right to be forgotten”), restrict or object to processing, and port your data. You can export or delete your data anytime from your account settings, or email [email protected]. Where we rely on consent, you can withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).
Passwords are hashed (PBKDF2), traffic is encrypted with HTTPS, access is rate-limited, and backups are encrypted and stored off-site. No system is perfectly secure, but we take protecting your data seriously.
ExamDeck is not directed to children under 16 and we do not knowingly collect their data.
We’ll reflect material changes by updating the “last updated” date and, where appropriate, by email.
Email [email protected] for any privacy question or request.