Collect less. Protect learners more.

Information we collect

Guest practice does not require a child’s full name, email, phone number, precise location, school name, or exact date of birth. We process a random browser identifier, attempt responses, timing, and technical security records to deliver and recover practice.

For parent-managed accounts, we collect the adult account holder’s email, display name, encrypted authentication credentials or chosen identity-provider identifier, and a minimal student profile consisting of nickname, grade, and target exam year.

How and why we use information

We use information to authenticate accounts, provide practice and mocks, save progress, prevent abuse, secure the service, respond to support requests, and improve the product when optional analytics is permitted. We do not sell personal information or use student data for targeted advertising.

Children and parental controls

Accounts are for parents, guardians, or other authorized adults. Children can use guest practice without identifying themselves. A parent may request access to, correction of, or deletion of a managed profile and may refuse further collection. We do not condition participation on providing more child information than reasonably necessary.

Questionology does not provide public child profiles, direct messages, social feeds, public leaderboards, or precise-location tracking. Before knowingly collecting personal information directly from a child under 13, we will provide direct parental notice and obtain verifiable parental consent where COPPA requires it.

Cookies, analytics, and disclosures

Essential cookies and browser storage support authentication, CSRF protection, security, answer recovery, and privacy preferences. Optional analytics remains disabled until affirmative consent and is disabled when Global Privacy Control is active. Analytics excludes names, emails, raw answers, question text, session secrets, and profile identifiers.

Service providers may process limited data for hosting, database, email, authentication, security, or consented analytics under appropriate safeguards. Google or Apple receives data only when an adult chooses that sign-in method. Authorized AI providers draft educational content only; student answers are not sent to them.

Question generation and review disclosure

Some practice questions, passages, answer choices, explanations, and assessment blueprints are automatically generated or AI-assisted. Automatically generated material is not official SHSAT content and Questionology is not affiliated with NYC Public Schools, Pearson, or TestNav.

Generated candidates are checked against the platform schema, answer rules, duplicate controls, accessibility requirements, and supported digital interaction types. They remain private Drafts until a human reviewer approves the exact revision for publication. Student responses are never used as prompts for question generation.

Practice and mock results are educational simulations only. They are not official SHSAT scores, admissions predictions, or guarantees of school admission.

Retention, security, and New York residents

We retain personal information only as long as reasonably necessary for the stated purpose, legal obligations, security, dispute resolution, and reproducible assessment history. Account holders may request deletion; some de-identified or legally required records may remain. Pending guest answers remain locally only until saved or cleared.

We use administrative, technical, and physical safeguards appropriate to the information, including hashed passwords, server-side sessions, access controls, validation, and breach-response procedures. No system can guarantee absolute security. New York breach notifications will be provided as required by applicable law.

Your choices and requests

You may reject optional analytics, reopen Privacy choices in the footer, use browser Global Privacy Control, update account information, revoke sessions, or request access, correction, deletion, or a copy of applicable information through the verified operator contact published with the deployed service. We may verify identity and authority before completing a request.