How SHSAT Specialist handles student data
Effective August 14, 2026
SHSAT Specialist is operated by Adam Snir and is designed to collect only the information needed to provide accounts, save progress, calculate practice analytics, and protect the service.
Operator contact
SHSAT Specialist is operated by Adam Snir. Email questions, parent requests, and privacy requests to help@shsatspecialist.org.
Information we collect
- Account information such as name, email address, username for a parent-managed child account, and encrypted password credentials.
- Practice activity such as questions answered, correctness, selected skill, difficulty, timing, and test scores.
- Saved test state such as the current question, remaining time, answer history, and adaptive test state.
- Question reports submitted by a signed-in user, including the affected question, selected issue category, and written description.
- An optional preference to receive product updates. This is off unless a signed-in account holder turns it on.
- Limited technical information used for account security, including session identifiers, IP address, and browser information.
How information is used
Information is used to authenticate users, restore unfinished work, show private analytics, recommend practice, investigate reported content problems, prevent abuse, and maintain the service. SHSAT Specialist does not sell student information or use it for targeted advertising.
Account verification, password recovery, parent-consent, and security messages may be sent when needed. Product updates are separate and are sent only after an account holder opts in. Every product update includes a direct unsubscribe link, and signed-in users can also turn updates off from their account settings. We retain campaign summaries, not message bodies or mailing-list exports, for up to 90 days.
Visibility and service providers
Profiles and progress are private. Cloudflare processes hosting and database information, and Resend delivers account and consent email. These providers process information only to operate the service. Information may also be disclosed when legally required or necessary to protect users and the service.
Retention and deletion
Account information, saved progress, and submitted question reports are retained only while an account is active so the service can provide saved practice and analytics. A signed-in account holder can delete the account from the account page. The live account, saved progress, saved tests, reports, sessions, and parent-account link are deleted from the active database immediately after a successful deletion request.
The current Cloudflare database recovery system may retain a temporary inaccessible copy for up to 7 days before normal rotation removes it. Expired account-verification records are removed during automatic application cleanup. Security and email-delivery diagnostics contain masked or hashed identifiers and are deleted after 30 days unless a longer period is required to investigate abuse or comply with law.
Children and parent rights
The create-account flow asks for a birthdate neutrally and uses it only to choose the correct account process. SHSAT Specialist does not save the full birthdate. A person under 13 may enter only a parent or guardian email to request consent. No child account, child profile, or practice history is created before the parent or guardian reviews the direct notice, gives consent, and creates the child’s private username and password.
For a parent-managed child account, SHSAT Specialist collects a parent-created child display name and username, secure password credentials, practice activity, saved test state, private analytics, and the limited security information described above. This information is used only to provide, personalize, secure, and maintain the educational service. Cloudflare provides hosting and data storage, and Resend delivers required account and consent email. SHSAT Specialist does not sell children’s personal information, use it for targeted advertising, provide public profiles, or allow users to message one another.
Pending parent-consent requests and the supplied parent email expire after 7 days if consent is not completed and are removed during automatic application cleanup. Declined requests are removed within 7 days. When a parent-managed account is deleted or consent is revoked, its live account data is removed immediately and temporary database recovery history rotates out within 7 days. A second confirmation email is sent after consent and explains how to revoke it.
A parent or guardian may ask to review or delete the child’s information, stop future collection, or revoke consent. Revoking consent may require deletion of the account because saved progress depends on that information. Send a parent-rights, privacy, or deletion request to help@shsatspecialist.org.
Security
SHSAT Specialist uses restricted account access, encrypted connections in production, rate limiting, one-time expiring parent-consent links, and provider-managed password hashing. No online service can promise absolute security.
Questions or changes
Privacy and data requests can be sent to help@shsatspecialist.org. Material policy changes will be dated on this page.