Privacy statement
What EconAce collects, why, how it is protected, who it is shared with, how long it is kept and how to have it removed.
Last updated 28 August 2026
Who we are
EconAce is a revision tool for Cambridge International AS & A Level Economics 9708. It is operated by the EconAce team, who is the data controller for the information described here. You can reach us through the contact form.
What we collect
We collect only what the service needs to work. There is no advertising, no analytics product, and no third-party tracking on this site.
| What | Why we hold it |
|---|---|
| Your name, and a display name if you set one | To identify your account and to label your entries on the leaderboards |
| Your email address | To sign you in, to confirm your address and to let you reset your password |
| Your password | To sign you in |
| A profile picture, if you upload one | To show alongside your name |
| Your attempts, answers, scores and dates | To show your progress, build your review queue and rank the leaderboards |
| Your XP, streak and badges | To show your progress |
| A digest of your IP address | To rate-limit sign-in and sign-up attempts and protect accounts |
| Anything you write in the contact form | To answer you |
How it is protected
- Your password is stored only as a bcrypt hash. It cannot be read or recovered by anyone, including us. If you forget it we can only help you set a new one.
- Your email address is encrypted at rest with AES-256-GCM. Alongside it we store a separate keyed digest which lets us look your account up without holding the address in readable form. The two keys are independent, so access to the lookup index does not decrypt the addresses.
- Password reset and confirmation links are stored only as digests, so a copy of our database could not be used to take over an account. They are single use and expire.
- Sign-in sessions use a signed token in a cookie that JavaScript cannot read. The token carries only your account identifier and role, never your email address.
- Administrators can see that an account exists and a masked form of its address, such as
abc•••@example.com. The full address is not shown in the admin area.
What other people can see
Your name — or your display name if you have set one — your profile picture, your best score for a level and the date you achieved it appear on the public leaderboards.
Nothing else is public. Your email address, your individual answers and your review queue are never shown to other users.
Cookies
We set one cookie, which holds your sign-in session. It is essential to the service: without it you cannot stay signed in. We do not use advertising or analytics cookies.
Your light or dark theme choice is kept in your browser's local storage. It never leaves your device and is not sent to us.
Who we share it with
We do not sell your data and we do not share it for marketing. We use a small number of processors to run the service:
- Vercel — hosting, and storage for profile pictures
- Neon — the database
- Resend — sending confirmation and password reset emails
Each processes data only on our instructions. Data is stored in the United States.
How long we keep it
- Account data is kept while your account is open, and for up to 24 months after it becomes inactive.
- Contact messages are kept for up to 12 months after we close them.
- Rate-limiting records are short-lived and hold no personal detail beyond a digest.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop using it in a particular way. You can also ask us to send it to you in a portable form. Use the contact form and we will respond within one month.
Deleting your account removes your attempts, answers, review queue, badges and profile picture. Leaderboard entries are removed with it.
Children
You must be at least 13 to hold an account. If you believe a younger child has created one, contact us and we will remove it.
Changes
If we change this statement materially we will update the date at the top of this page. The current version always governs.