Privacy Policy

Last updated: May 2026

VerbaNorth ("we", "us", "our") is an independent language test preparation platform. This policy explains what data we collect, how it is processed, where it is stored, and how you can review or delete it. We aim for plain language — if any section is unclear, email [email protected].

1. What we collect

When you create an account and use VerbaNorth, we collect the following:

• Account data — your display name and email address.
• Authentication data — email verification status, sign-in events, and (if you sign in with Google) the basic profile fields Google returns to the authentication provider. Passwords are managed by our authentication provider (Supabase) and are never stored by VerbaNorth in plain text.
• Practice results and progress — the mock-test sections and lab drills you complete, your answers, score estimates, timing, and study-plan choices.
• Writing and speaking submissions — the essays you submit in Writing Lab and the audio you record in Speaking Lab. Speaking audio is transcribed to text; we currently retain the transcript and the AI feedback. Raw audio is not stored beyond the brief processing window required to produce the transcript.
• AI feedback — the estimated practice scores and written feedback generated for your submissions.
• Device-local data — some features (Vocabulary Builder, Reading Lab history, study-streak counters, daily-drill state, weekly-focus override) save state in your browser's localStorage. This stays on your device and is not synced across devices or to our servers.

We do not currently run third-party web analytics, advertising trackers, or social media pixels.

2. How we use it

• To authenticate you and keep your session active.
• To save and display your practice history, score estimates, and study plan.
• To generate AI feedback on your writing and speaking submissions.
• To send transactional emails (verify your email address, reset your password).
• To operate, secure, and improve the service.

We do not send marketing or promotional email. If we ever offer a newsletter, it will be opt-in only with a clear unsubscribe link.

3. Service providers (data processors)

We use a small number of providers to operate the service. Each is described below so you know who handles which data.

• Supabase — authentication and database hosting. Stores your account, sign-in state, practice scores, study-plan settings, and writing/speaking submissions linked to your account.
• Resend — transactional email delivery (verify-email and password-reset messages). Resend receives the destination email address and the message content; we do not use Resend for marketing.
• OpenAI — AI provider used through our backend proxy for writing feedback, speaking transcription (Whisper), and prompt scoring. Your submitted text and audio are sent to OpenAI for the duration of the request only; we do not include your name, email, or account identifier in the prompt. Per OpenAI's API policies at the time of writing, API inputs are not used to train their models.
• Cloudflare — content delivery and basic DDoS protection in front of our server. Processes request metadata (IP address, user-agent) for security and routing.
• VPS host — runs the VerbaNorth server. Stores transient request logs that may contain IP addresses for operational and security purposes.

We do not sell or rent your personal data, and we do not share it with third parties for advertising.

4. Cookies and session tokens

We use three first-party cookies to keep you signed in. None are used for tracking or advertising.

• mp_session — HttpOnly. Stores your authentication token. Required to access your account.
• mp_refresh — HttpOnly. Used to silently refresh your session so you do not have to sign in again every hour.
• mp_auth — non-HttpOnly, flag only. Lets the page tell at a glance that you are signed in (used for instant redirects on public pages). Contains no personal data.

Some browser features (theme preference, draft answers in the Writing Lab, vocabulary progress) save data in localStorage on your device. This is not transmitted to our servers.

5. Where your data is stored

Account data, practice scores, and submissions are stored in Supabase (cloud-hosted PostgreSQL). All data is transmitted over HTTPS. Access from VerbaNorth's server is gated by row-level-security policies so that a signed-in user can only read or modify their own records.

6. Retention

We keep your account data and practice history for as long as your account is active. If you delete your account, we remove the associated records from our active database within 30 days of the request. Backups managed by our database provider may retain residual copies for up to 90 additional days before they are rotated out.

If you are in Canada, your personal information may be subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable provincial legislation. We collect, use, and disclose personal information only for the purposes described in this policy and with your implied consent through use of the service. You may withdraw consent by deleting your account or contacting us.

7. Your rights

• Access — sign in and visit the Settings page to view your account information, practice history, and study-plan choices.
• Correction — update your display name on the Settings page; email changes can be made through the auth flow.
• Deletion — request account deletion from the Settings page. This removes your account and your stored practice records.
• Questions — email [email protected] for anything else.

If you are in Canada, the European Economic Area, the United Kingdom, or another jurisdiction with privacy legislation that grants additional rights (access, rectification, erasure, restriction, portability, objection), you may exercise those rights by emailing [email protected]. We will respond within a reasonable time and, where required by applicable law, within 30 days.

8. Children

VerbaNorth is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has created an account, email us and we will remove it.

9. Security

We take reasonable measures to protect your data, including HTTPS everywhere, HttpOnly session cookies, row-level security in the database, and rate-limiting on sensitive endpoints. No service can guarantee perfect security; if we become aware of a material incident affecting your data, we will inform you.

10. International transfers

Our infrastructure providers may process data in countries outside your country of residence. By using VerbaNorth you acknowledge that your data may be transferred to and stored in those countries, subject to the protections the relevant provider applies.

11. Changes to this policy

We may update this policy. The "Last updated" date at the top of the page will reflect any change. Material changes will be communicated through the service. Continued use after a change indicates acceptance of the updated policy.

12. Contact

Email [email protected] for any privacy questions or requests.