Trust Center
Every number and list on this page is generated from our code — when the code changes, the page changes, and automated tests check that they match.
Live system status
- Web app & APIChecking…
- DatabaseChecking…
- Live-game realtimeChecking…
Hosting: Singapore region (application and database).
How long we keep data
| Data | Deleted after |
|---|---|
| Game & test data (answers, scores, nicknames) counted from when the game ends; never while an assignment is open | 90 days |
| SMS delivery logs (incl. phone numbers) | 90 days |
| Login records | 90 days |
| Product-analytics events (no personal data) | 395 days |
| Payment & security audit trail for dispute resolution and legal obligations | 1095 days |
| Login codes (OTP) | 1 day after expiry |
| Verifiable certificates long-term verification is their purpose | until revoked |
| Account deletion request | 7-day cancellation window, then fully erased |
Deletion runs automatically every day.
Subprocessors & data recipients
Every external service our code sends data to — none omitted; if a new service isn't listed here, our tests fail.
| Service | Purpose | Region | When |
|---|---|---|---|
| Vercel Singapore · always | application hosting | Singapore | always |
| Supabase Singapore · always | database & realtime | Singapore | always |
| Resend USA · always | transactional email (login codes, receipts, result reports at the host's request) | USA | always |
| bKash Bangladesh · always | payments — wallet details never touch our servers | Bangladesh | always |
| SSLCommerz Bangladesh · always | payments — card details never touch our servers | Bangladesh | always |
| BulkSMSBD Bangladesh · if configured | result SMS to guardians (when the host enables it) | Bangladesh | if configured |
| Anthropic USA · if configured | AI quiz generation — host-supplied sources; not used for model training | USA | if configured |
| OpenAI USA · if configured | AI generation / voice transcription (as configured) | USA | if configured |
| OpenRouter USA · if configured | AI generation / voice routing (as configured) | USA | if configured |
| Groq USA · if configured | voice transcription (as configured) | USA | if configured |
| Google (Gemini API) USA · if configured | voice transcription (as configured) | USA | if configured |
| Google (Firebase Cloud Messaging) Global · if you choose | mobile-app push notifications (when permitted) | Global | if you choose |
| Meta (Conversions API) USA · always | ad measurement: buyer purchase events, hashed, server-side — never student data | USA | always |
| Google (Analytics / Tag Manager) USA · always | visit measurement on marketing pages — never on student screens; off by default in the EEA/UK | USA | always |
| Meta (Pixel) USA · always | visit measurement on marketing pages — never on student screens; off by default in the EEA/UK. The Pixel also sends events to Meta's own gateway (hosted on Google Cloud) | USA | always |
| YouTube (Google) Global · if you choose | blog videos — load only when you press play (privacy-enhanced nocookie mode); posters are served through our own server | Global | if you choose |
| Vimeo USA · if you choose | blog videos — load only when you press play | USA | if you choose |
| Google Sign-In Global · if you choose | sign-in — only if you choose it | Global | if you choose |
| LinkedIn Sign-In Global · if you choose | sign-in — only if you choose it | Global | if you choose |
More documents
- Student Data Principles
- Security measures
- Data Processing Agreement (DPA)
- Privacy policy
- security.txt — how to report a vulnerability