Privacy Policy

SAT | Kashkadarya (“we”, “us”) runs this SAT preparation platform (the “Platform”) and is the owner and operator of the personal data processed through it. We process personal data in accordance with the Law of the Republic of Uzbekistan “On Personal Data” and other applicable legislation.

This policy explains what we collect, why, who can see it, how long we keep it, and what you can ask of us. It forms part of our Terms of Use.

• Account details: first and last name, email address, and your password — stored only as a one-way Argon2id hash, never in readable form. If you sign in with Telegram: your Telegram user id, username, name and profile photo link, as Telegram provides them.
• Profile and goals: an avatar if you add one, your target SAT score and planned exam date if you set them, and the groups you belong to.
• Study data: the tests you start, your answers, time spent on each question, scores, flagged questions, notes, highlights and drawings on questions, lesson progress, vocabulary and practice sessions, and requests for extra attempts including the reason you give.
• Test monitoring: when a test starts and ends and how it ended; each time you leave the test page (switching tabs or apps, losing focus, leaving fullscreen) with the time you left and returned; and, when a test is handed in, your browser’s clock compared with ours. We do not use your camera or microphone, record your screen, or see other tabs or apps.
• Official SAT results that you or the school record, such as your score, the date of the sitting and the score report.
• Technical and security data: IP address, browser and device type (user agent), sign-in times, and a log of security events such as sign-ins, failed sign-ins and password changes. To limit password guessing we keep short-lived counters keyed on a one-way hash of the email address typed in.

• to create and run your account and sign you in;
• to deliver tests, lessons and practice, score your work and show you your progress;
• to let your teachers and the school follow and support your preparation;
• to keep tests fair — timing, attempt limits, and the monitoring described above;
• to protect the Platform and its users — detecting automated sign-ups and password guessing, investigating abuse, and keeping security logs;
• to send you notifications on the Platform, such as a newly assigned test;
• to produce statistics without names, such as a test’s average score;
• to meet our obligations under the law.

We rely on your consent (given when you sign up — by a parent or guardian for a student under 18), on the need to provide the service you signed up for, on our legitimate interest in keeping the Platform secure and tests honest, and on legal obligations. We do not sell personal data, and we do not use it for advertising.

• Your teachers see the study data and test monitoring of students in their groups, and can reset a student’s password.
• The school’s administrators can see all accounts and results, to run the school.
• Other students never see your answers. They may see statistics without names, such as how many people have taken a test.
• The public page of the school shows official SAT results only when the school chooses to publish them; the name and score shown there are published with the student’s agreement. Ask us to remove a published result at any time.

We use a few outside services, each only for its own part of the Platform:

• Hosting and storage providers that run our servers, database and file storage on our behalf.
• Cloudflare Turnstile, the robot check on sign-up, which sees your IP address and technical browser signals to tell people from bots.
• Telegram, if you choose to sign in with it.
• Desmos (the graphing calculator in tests) and YouTube (lesson videos), which load from their own sites when you open them and apply their own privacy policies.

We may also disclose data when the law requires it, for example at the lawful request of a state body.

We use only what the Platform needs to work — no analytics or advertising cookies:

• two sign-in cookies, inaccessible to page scripts: a short-lived access cookie (15 minutes) and a session cookie that keeps you signed in (up to 30 days, or until you sign out);
• your browser’s local storage for preferences such as light or dark theme, and its database (IndexedDB) for a copy of your answers during a test, so a reload or a lost connection does not lose them. It is cleared when the test is handed in.

Your data is stored on our servers and processed in accordance with the legislation of the Republic of Uzbekistan, including its requirements on where the personal data of citizens of Uzbekistan is stored.

• Account and study data: for as long as you have an account.
• After you ask us to delete your account: removed or made anonymous within 30 days, except what we must keep by law. Published SAT results are removed on request.
• Security logs: up to 12 months.
• Rate-limit counters: minutes to one day.

Passwords are hashed with Argon2id; sign-in cookies are HTTP-only and sent over encrypted connections; access to data is limited by role (student, teacher, administrator); sign-up is protected by a robot check; sign-in, sign-up and password endpoints are rate-limited with accounts locked temporarily after repeated wrong passwords; and security events are logged. No system is perfectly secure, so please use a strong password of your own and tell us at once if you suspect a problem.

You, or your parent or guardian if you are under 18, may:

• find out what personal data we hold about you and get a copy of it;
• have it corrected — you can change your name yourself in your profile;
• have your account and data deleted;
• withdraw your consent — this means closing the account, since the Platform cannot run without the data;
• complain to the authorised state body for personal data of the Republic of Uzbekistan, although we would like the chance to fix things first.

To use any of these rights, contact us using the details below. We may need to confirm it is really you, and we will answer within the time the law sets.

Many of our students are under 18. A student under 18 may use the Platform only with a parent’s or legal guardian’s consent. A parent or guardian may contact us to see, correct or delete their child’s data. We collect from students only what is needed for their studies.

We may update this policy. The date at the top shows the current version. If a change is significant — for example a new purpose for your data — we will tell you on the Platform before it takes effect and, where the law requires, ask for your consent again.

Questions about your data, or requests under this policy: