Privacy Policy

Elevara is for students aged 13 and over. Most of our users are between 14 and 17.

We do not knowingly collect personal information from children under 13. We ask for a date of birth when you create an account and refuse the account if it shows you are under 13. That check runs in three places: in the browser, so you get a fast message; in the server action that handles the form; and in the database itself, which rejects the account regardless of how the request was made. If you sign in with Google, Google does not tell us your date of birth, so we ask you for it on the next screen and hold the account there until you have given it.

If we discover we hold information from a child under 13 without the verifiable parental consent required by the Children’s Online Privacy Protection Act (COPPA), we will delete the account and the data associated with it.

Your date of birth is used only for this age check. It is not used for personalisation, segmentation, recommendations or marketing.

If you are under 18, a parent or guardian must read and agree to our terms on your behalf, and any paid subscription must be purchased by them. See section 8.

Information you give us

• Account information — your email address and your name. Your password is handled by our authentication provider and is stored as a hash; we never see or store the password itself.
• Date of birth — for the age check described in section 1, and nothing else.
• A profile picture URL, if you sign in with Google and Google supplies one. We store the address of that image. Elevara does not currently display profile pictures anywhere in the app.
• Study goals — your target SAT score, your intended test date, and how many minutes a day you plan to study. These are what your study plan is built from.
• Question discussion— the text of any comment you post on a question, and any report you file about someone else’s comment.
• Feedback surveys — your answers to the in-app feedback survey and any free-text comment you add to it. Every question in that survey is optional.
• Support messages — anything you send us by email, including the email address you send it from.

Information created by using Elevara

This is most of what we hold, and it is what makes the product work.

• Every answer you submit — the question, the option you chose, whether it was correct, and how many seconds you spent on it.
• Study sessions — how many questions, how many correct, total time, and which skills and sections were covered.
• Diagnostic and mock exam results — your section scores, your total score, and a per-question review record.
• Ability estimates — a numeric rating for each section, updated after every answer, used to decide which question to give you next.
• Review scheduling — for each question and each vocabulary word, how well you know it and the date it is next due back.
• Streaks and totals — your current and longest study streak, your lifetime questions answered and correct, and an experience-point total and level.
• Account timestamps — when the account was created, when it was last updated, when you were last active, and how far through onboarding you are.

One thing we deliberately do not keep: when you get a question wrong, Elevara asks you to say why (“I knew this and slipped”, “I misread it”). That answer never leaves your browser and is never sent to us.

Information collected automatically

Elevara contains no advertising or ad-tracking software. What is collected automatically is the ordinary technical record any website generates, plus — since 19 August 2026 — a limited product-analytics record:

• Request logs held by our hosting and database providers, which include your IP address, the time of the request, the page or endpoint requested, and your browser’s user-agent string. These are used for operating the service, for security and abuse prevention, and for debugging.
• Authentication cookies, which keep you signed in. See section 6.
• Sign-in security records kept by our authentication provider, such as when you last signed in and when you confirmed your email address.
• Product analytics, since 19 August 2026, through PostHog. This records which pages you visit, and a short list of milestones we write by hand: creating an account, finishing onboarding, finishing a diagnostic, and finishing a mock exam. Alongside each of those, PostHog records your account identifier once you are signed in, your approximate location derived by PostHog from your IP address, and your browser and device type. You can switch this off for your browser in Settings.

The product-analytics record is deliberately narrow. We do not send PostHog the questions you see, the answers you choose, whether you were right, your section or total scores, your ability estimates, or anything you type. Automatic event capture and session recording — the two features of a tool like this that would sweep up that material — are both turned off in our configuration, and the events are written out one at a time in our own source code instead. Web addresses are stripped of anything after the ? before they are sent, so an address that carries your email address in the link does not reach PostHog.

We ourselves do not derive or store a location from your IP address, and we do not build a device fingerprint. PostHog does derive a coarse location — country, region and city — from the IP address of the requests it receives; it is not a precise location and we do not store it in our own database.

Information from other sources

• Google, and only if you choose “Sign in with Google”. We receive your Google account identifier, your email address, your name and your profile picture URL. We do not receive your date of birth, your contacts, your calendar, your Google Drive, or anything else in your Google account. If you sign up with an email address and a password instead, we receive nothing from Google.

What we deliberately do not collect

• No advertising or ad-tracking SDKs. There is no advertising pixel, no Google Analytics, no marketing tag and no session recorder. Since 19 August 2026 there is one product-analytics tool, PostHog, limited as described above; it is not an advertising product and we do not use it for advertising.
• No advertising profiles, and no targeted advertising to students.
• No study performance in any analytics tool. Your answers, your scores and your ability estimates stay in our own database.
• No third-party AI service. See section 7.
• No precise location, no contacts, no biometrics, no microphone or camera access, and no device identifiers beyond what an ordinary web request carries.
• No file uploads. There is nowhere in Elevara to upload a document, a photo or a screenshot, so we hold none.
• No payment card details. See section 8.

We use the information described in section 2 to:

• create your account, sign you in, and keep your session secure;
• run the product — serving questions, grading answers, scoring diagnostics and mock exams, tracking vocabulary, and scheduling reviews;
• choose which question to give you next, by comparing your ability estimate against the difficulty of each item in the bank;
• build and update your study plan from your target score and test date;
• show you your own history, scores, streak and progress;
• send you service emails — confirming your address, resetting your password, and notices about your account or about this policy;
• find and fix problems, and understand which parts of Elevara are actually used: which questions have a bad answer key, which screens people give up on, which features nobody reaches. Since 19 August 2026 the page and milestone counts described in section 2 are used for this, and only for this;
• protect the service against abuse, fraud and unauthorised access;
• comply with the law and respond to lawful requests.

Operator access

Elevara is run by a very small team. One administrator account can see, across all users: email address, name, sign-up date, whether onboarding is finished, target score, intended test date, number of questions answered, overall accuracy, last activity, and feedback survey answers together with the email address that submitted them. This access exists so that the product can be operated and debugged at all, and it is enforced in the database rather than only in the app — an ordinary account that calls the same functions directly is refused.

That administrator does not have a view of your individual answers, your comment history or your exam paper. Aggregate figures — accuracy per skill, how many people got a given question right — are calculated across all users and are not attributed to you.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not disclose it to advertising networks, data brokers or marketing platforms, because we do not use any.

We use the following service providers, who process data only to provide their service to us:

• Supabase — our database and authentication system. Holds essentially everything described in section 2, and sends the account emails (address confirmation and password reset) through the outbound mail service we have configured, which receives your email address and the content of those messages.
• Vercel — hosts the application. Processes ordinary web request logs, including IP addresses.
• Google— only if you choose “Sign in with Google”. Google tells us what is listed in section 2 and knows that you signed in to Elevara. If you use an email address and password instead, Google receives nothing.
• Desmos — the graphing calculator shown on math questions is loaded from www.desmos.com. Because your browser fetches it directly, Desmos receives your IP address, browser user-agent, and the page you loaded it from. It does not receive your Elevara account, your answers, or your scores.
• PostHog — our product-analytics provider, since 19 August 2026. Receives what section 2 describes under “Product analytics”: pages visited, the handful of milestone events, your account identifier once you are signed in, and the IP address the request arrives from, which PostHog turns into a coarse country-and-city location. It does not receive your answers, your scores or your ability estimates. PostHog processes this only to provide the service to us, and we have not enabled any of its advertising or session-recording features. No data reached PostHog before 19 August 2026.
• Stripe — will process payments once paid plans launch. No data reaches Stripe today. See section 8.

Our site links to a Discord server. Following that link takes you to Discord, and what happens there is governed by Discord’s own terms and privacy policy, not by this one. Elevara does not connect your Discord account to your Elevara account and receives no information from Discord.

We may also disclose information:

• where we are legally required to, including in response to valid legal process;
• to protect the rights, safety and security of our users, of Elevara, or of the public;
• to an acquiring party if Elevara is ever merged, acquired, or sold — in which case this policy continues to govern the information until you are given notice of any change;
• with your direction or consent.

Elevara has no leaderboard and no rankings. We do not compare you to other students, publish a score table, or show anyone how you are doing relative to anyone else. There is no friends list and no way for another student to look up your profile.

The one place other students see you is question discussion. If you post a comment on a question, your name and the text of your comment become visible to signed-in students who have already answered that same question — nobody else, not signed- out visitors, and not students who have yet to attempt it. That restriction is enforced by the database, not by the page.

Your answers, your scores, your exam results, your streak and your ability estimates are never shown to other students.

You can delete any comment you have posted, at any time. If you would rather your name never appear, do not post comments — or email privacy@elevara.space and we will remove what you have written.

Elevara sets no advertising cookies. Since 19 August 2026 it sets one first-party analytics cookie, described below.

You are not shown a cookie banner. That is a deliberate choice and here is the reasoning, so you can judge it for yourself: the only non-essential storage we set is the analytics cookie; it is first-party, it is not used for advertising or sold to anyone, and you can turn it off at any time in Settings. Under the United States state privacy laws this service is built for, that opt-out is what is required rather than a consent gate. Elevara is not directed at the United Kingdom or the EEA, where the rule is different — see section 13.

What we do store in your browser:

• Authentication cookies, set by our authentication provider. They hold your session so that you stay signed in. Without them you cannot use an account.
• An analytics cookie and matching local storage, since 19 August 2026, set by PostHog. It holds a random identifier so that repeat visits from this browser are recognised as the same visitor rather than counted afresh. Turning analytics off in Settings stops it being used; the switch itself is remembered in this browser’s local storage.
• Your appearance preference (system, light or dark), stored in your browser’s local storage. It never reaches our servers, and it is tied to the browser rather than to your account.
• The position of the graphing calculator panel, stored in local storage so it reopens where you left it. It never reaches our servers.
• The email address you just signed up with, stored in session storage so the “check your email” screen can show it. It is discarded when you close the tab.

You can clear browser storage at any time through your browser’s settings. Doing so signs you out and resets your appearance preference; it does not delete anything held on our servers.

Elevara sends nothing you write or answer to a third-party AI service. There is no AI tutor, no chat assistant, and no essay grader. The application makes no outbound call to any model provider, and there is no model-provider credential in the project.

The explanations you read, the diagnosis you get after a wrong answer, and your review schedule are all worked out on our own servers from the question bank and from your own history. The adaptive engine that picks your next question is a rating calculation, not a language model.

Parts of the question bank itself were drafted with AI assistance before being reviewed and corrected by us. That is a statement about how the questions were written; no student information was involved, and none is sent anywhere when you answer them.

If we ever add an AI feature, it would mean sending student work to an outside processor. We would update this policy and tell you before that happened, not after.

Elevara does not sell subscriptions yet, and collects no payment information today. The rest of this section describes how paid plans will work when they launch. We will update this policy before that happens.

Subscriptions will have to be purchased by a parent, guardian, or other adult aged 18 or over. Students under 18 will not be able to buy a subscription on Elevara. A person under the age of majority generally cannot enter a binding contract, which is one reason the paying relationship has to be held by an adult.

Payments will be processed by Stripe. Card details will be entered directly with Stripe, and Elevara will never receive or store your full card number, expiry date or security code. We will keep only a Stripe customer reference, the subscription tier and status, and the billing period — enough to know what the account is entitled to.

Elevara does not provide a separate parent login. An adult who pays for a subscription will manage billing through Stripe and will not get a view of the student’s scores or activity inside the app. A parent or guardian can still exercise the rights in section 11 on behalf of a student under 18, including asking us what we hold.

• Account data — for as long as the account is open.
• Answer history, scores and ability estimates — for as long as the account is open. This history is what the adaptive engine reads; deleting it resets your ability estimate and your review schedule.
• Question comments — kept while the account is open. Deleting a comment hides it from other students immediately and marks it deleted; the row is removed when the account is deleted.
• Feedback survey answers — kept while the account is open.
• Request logs — held by our hosting and database providers under their own retention schedules, which are shorter than the life of an account.
• Analytics events, since 19 August 2026 — held by PostHog under its own retention schedule. We do not copy them into our database.

Deleting your account

Elevara does not yet have a delete-my-account button. Deletion is by request. Email privacy@elevara.space from the address on the account and we will delete it. We do this manually today, and we complete it within 30 days of verifying the request.

Deleting an account removes your profile, your answer history, your scores, your ability estimates, your review schedule, your comments and your feedback responses. We may keep a minimal record that an account existed and was deleted, where that is needed to comply with the law or to stop the same account being recreated to evade a suspension.

Analytics events held by PostHog sit outside our database, so they are not covered by that deletion automatically. Say so in the same email and we will delete them there too, within the same 30 days.

Backups held by our hosting and database providers may retain deleted data for a limited further period, in line with those providers’ own retention schedules. Backups are not queried in the ordinary course of running the service.

• All traffic is encrypted in transit over HTTPS.
• Passwords are stored as hashes by our authentication provider. Nobody at Elevara can read your password.
• Row-level security is enabled on every table that holds student data. One student’s records are not readable by another, and this is enforced by the database rather than by the application, so it holds even if a page has a bug.
• Answer keys are withheld from the browser entirely. The correct answer to a question is not sent to your device until you have answered it.
• The administrator functions described in section 3 re-check authorisation in the database on every call. Routing is a convenience, not the control.
• Access to the production database is restricted to the operator.

No system is perfectly secure and we do not claim otherwise. You are responsible for choosing a strong password, keeping it to yourself, and using Elevara from a device and network you trust.

Depending on where you live, you may have the right to:

• get a copy of the personal information we hold about you;
• correct it if it is wrong;
• delete it;
• receive it in a portable format;
• object to or restrict some processing;
• withdraw consent where we rely on consent;
• appeal if we refuse a request;
• not be treated differently for exercising any of these.

Parents and guardians of a student under 18 may exercise these rights on the student’s behalf, including reviewing what we hold and requiring us to delete it. We may need to verify both your identity and your relationship to the student before we act.

How to make a request. Email privacy@elevara.space. Elevara has no self-serve data export tool today, so every request is handled by hand. We will verify who you are before acting, and we respond within 30 days. If we cannot complete part of a request, we will tell you which part and why.

You can change your name, target score, test date and study minutes yourself in the app at any time. Since 19 August 2026 you can also switch product analytics off for your browser, in Settings, without emailing anyone.

We send no marketing email. The only emails Elevara sends are service messages — confirming your address, resetting your password, and notices about your account or this policy. If that changes, marketing email will be something you opt into, with an unsubscribe link in every message.

California and a number of other states give residents specific rights over personal information. This section describes our actual practices.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. We do not knowingly sell or share the personal information of anyone under 16 — or of anyone at all. There is no advertising technology in Elevara and no cross-context behavioural advertising, so there is no “Do Not Sell or Share” opt-out to offer you. Since 19 August 2026 the product analytics described in section 2 run on a service-provider basis only, which is not a sale or a share; you can still switch them off for your browser in Settings. If any of that ever changes, this section changes with it and we will tell you first.

Categories of personal information collected

• A — Identifiers: Yes. Email address, name, account identifier, Google account identifier if you use Google sign-in, and IP address in request logs.
• B — California customer records: Yes. Name, email address, and education-related profile information.
• C — Protected classification characteristics: Limited. Date of birth, collected solely for the under-13 age check in section 1 and used for nothing else. We do not collect race, ethnicity, religion, sex, gender, disability or any other protected characteristic.
• D — Commercial information: No. We sell nothing today and hold no purchase or billing history. This becomes yes when paid plans launch.
• E — Biometric information: No. None, of any kind.
• F — Internet or network activity: Yes. Pages requested, questions viewed and answered, time spent, sign-in activity, and browser and device information carried by an ordinary web request.
• G — Geolocation data: Limited. We do not collect precise location, and we do not derive or store any location in our own database. Our hosting and database providers process IP addresses in their own request logs. Since 19 August 2026 our analytics provider derives a coarse country, region and city from the IP address of requests it receives.
• H — Audio, electronic, visual or similar information: No. There is nowhere in Elevara to upload a file, an image or a recording. We store the URL of a Google profile picture if you sign in with Google.
• I — Professional or employment information: No. We never ask for it.
• J — Education information: Yes. Target score, intended test date, practice answers, diagnostic and mock exam scores, study history and progress.
• K — Inferences: Yes. Your per-section ability estimate, your recommended focus areas, and your review schedule, all computed from your own answers.
• L — Sensitive personal information: Limited. Account log-in credentials, held as a hash by our authentication provider, and education information where a state treats it as sensitive. We use sensitive personal information only to provide the service you asked for, and never to infer characteristics about you.

We disclose personal information to the service providers listed in section 4 for business purposes only. California residents may request to know, access, correct and delete personal information, may limit the use of sensitive personal information, and may not be discriminated against for exercising any privacy right. Authorised agents may submit requests by email; we may require proof of authorisation as well as verification of the account holder’s identity.

California users under 18 may request removal of content they have posted publicly on the Services by emailing privacy@elevara.space. Removal from the Services may not remove copies held in backups or in records we are required to keep.

Elevara is operated from the United States and the Services are hosted and processed in the United States. If you use Elevara from outside the United States, your information will be transferred to, stored in and processed in the United States, which may not provide the same level of data protection as the country you live in.

Elevara is built for the United States SAT and is not directed at users in the United Kingdom or the European Economic Area. If you are in a country that sets a higher digital consent age than 13, the age rules that apply to you are those of your own country, and you should not create an account unless you meet them.

If we determine that a security incident has affected personal information in a way that requires notice, we will notify affected users, and any regulator, as the law requires. We may give that notice by email, by a notice inside the app, by a notice on this site, or by another method the law permits.

We may update this policy. When we do, we will post the new version on this page and update the date at the top. The updated version takes effect when it is posted unless a later date is stated.

If a change is material — a new category of information, a new processor, a new purpose, or anything that sends student work outside Elevara — we will give notice in the app or by email before it takes effect.

Questions about this policy, about the information we hold on a student, or about anything else here can go to privacy@elevara.space.

To request access to, correction of, or deletion of your information, email that address from the address on the account, and tell us what you want us to do. Please include enough detail for us to identify the account. We will verify the request before acting on it, and we respond within 30 days.

Elevara LLC, a Washington limited liability company
www.elevara.space