Exam Gorilla Privacy Policy
This policy explains what happens to information when you use Exam Gorilla, our app for iPhone and Android that turns your own pages into practice tests, and when you contact us through our website. It is written for parents, teachers and students. If anything is unclear, email us at hello@examgorilla.app.
"We", "us" and "our" mean Sphnix, Inc, 15833 Ibsen Pl, Dumfries, VA 22025, USA, the company that makes Exam Gorilla and is responsible for your information under data-protection law.
The short version#
- Your documents stay on your phone. We never receive your files or your library.
- To write questions, the app sends the text of the pages you choose to our server, which passes it to Google's AI service (Vertex AI, using Gemini models). Sometimes the app can't read a photo of a page on the phone. When that happens, it sends a picture of that page too. Our server doesn't keep the page text or pictures after the request is finished, and Google doesn't use them to train its AI models.
- Every copy of the app gets a private account with a random user ID, so we can count your free tests and apply your plan. It has no name or email. Signing in is optional (with Apple or Google on iPhone, with Google on Android) and is for grown-ups. There are no passwords, and we never send sign-in emails.
- We keep only what we need to run your plan: your user ID, how you signed in, the email address Apple or Google shared if you signed in, your plan, this month's counts and any single-quiz credits, and App Store or Google Play purchase records.
- There are no ads inside the app. But we advertise the app on Facebook and Instagram, and we use Meta (Facebook) to measure those ads. The app tells Meta about a few things you do, such as opening the app, signing in, making a test, finishing a test and buying a plan. It sends no names, emails, documents, questions or answers. This counts as "tracking" and "sharing for advertising", so we say so plainly here. See Advertising and Meta.
- You can say no. On iPhone, the app asks before it tracks you, and nothing links to your advertising ID unless you tap Allow. On Android, you can delete or reset your advertising ID. On our website, the Meta Pixel loads only if you tap Accept. Ad tracking is never turned on for children (see Children).
- We also use product analytics to see which features help: Google Analytics on iPhone, Android and our website, plus Mixpanel on iPhone and our website. We don't sell your information for money.
- You can delete your account in the app (Me › Delete account), and delete everything on your phone with Me › Data › Delete all my data, or by deleting the app.
What stays on your device#
Exam Gorilla stores these things only on your phone, in the app's private storage:
- the documents you add (PDFs, photos of pages, camera scans and text) and their page images
- the text the app reads from your pages
- the questions it creates, your answers, scores, stars, results, review and recall history, and streaks
- your settings and saved test presets (for example, "My weekly science quiz")
- any names you give to documents, presets or student profiles, including a first name you type in the app
We can't see, open or download any of this. It isn't sent to us except for the page content described below, and only when you ask the app to create questions.
Saving tests and stars online isn't switched on yet. Today your tests and stars stay on your phone even if you sign in. If we add a way to save them to your account, so that they move with you to a new phone, we'll update this policy and the app will explain it before anything is saved. Your documents will still stay on your phone.
On-device features. When you add a photo or a camera scan, the app first reads the page with text recognition that runs on the phone: Apple's on iPhone, and Google's ML Kit on Android. The optional "read aloud" feature uses your phone's built-in voice. None of these sends anything to us. The app doesn't use the microphone.
The camera. The app asks for camera permission only when you choose to scan a page. You can say no and still add PDFs, photos and text.
Phone backups. On iPhone, if you back up with iCloud Backup or to a computer, the backup may include Exam Gorilla's data. Apple handles those backups under your Apple Account settings and Apple's Privacy Policy. We can't access them. On Android, the app turns off Android's automatic backup, so Exam Gorilla's data isn't copied into your Google account's backup.
Backup files you export. Exam Gorilla can export a backup file of your library and import it again. The file goes wherever you choose to save or share it, for example the Files app, AirDrop, Google Drive or another cloud drive. You control that file. We don't receive a copy.
Your account#
The automatic account#
The first time you open the app, it quietly creates an account for you with Firebase Authentication, a Google service. This account has only a random user ID. It doesn't ask for or contain your name, email address, birthday or phone number. We use it to:
- count your free tests and questions each month, and apply a Plus plan or single-quiz credit to the right person
- keep each person's requests separate and stop misuse, for example someone making unlimited free tests
Signing in (optional)#
A grown-up can choose to sign in, after a grown-up check in the app. Signing in lets you keep your plan and credits if you change or reset your phone. You can sign in with:
- On iPhone: Sign in with Apple, or Google.
- On Android: Google only. Sign in with Apple isn't offered on Android.
How each works:
- Sign in with Apple. Apple tells us a user ID for you and, if you agree, an email address. You can choose Hide My Email, and then we get a private relay address from Apple instead of your real one. Apple doesn't share your name unless you choose to, and we don't store it.
- Google. Google tells us your Google account ID and email address. We ask only for the basic email and profile permission, and we don't store your name or photo.
There's no other way to sign in: no password, and no email sign-in link. The app never asks you to type an email address to sign in, and we never send sign-in emails.
When you sign in, we store on our server: your user ID, which way you signed in (Apple or Google), and the email address Apple or Google shared with us, if any. With Sign in with Apple this may be a private relay address. We use the email only to sign you in and, if you write to us, to find your account. We don't send marketing emails.
If you sign in on a phone that already had an automatic account, we move that account's credits, this month's counts and any active plan into your signed-in account, then delete the old automatic account.
You can sign out at any time. Your tests stay on your phone, and the app starts a new automatic account.
What leaves your device, and why#
1. Making questions (the AI step)#
When you tap Generate, the app (on iPhone or Android) sends this to our server over an encrypted (HTTPS) connection:
- the text of the pages you selected. It doesn't send the whole library or other documents.
- a picture of a page, only when on-device text recognition can't read that page well enough. The AI then reads the text from the picture.
- your test choices: how many questions, how hard, which question types, the grade or age band (for example "Grade 4–6"), the test style and the topics you picked. The app uses these to word the questions at the right level.
- the file name of the document and short samples of its pages, when the app asks the AI to outline the chapters in a document
- the questions already made from the same pages, so new ones aren't repeats, and questions with their source sentence, when the app double-checks answers
Our server passes this to Google Cloud Vertex AI, which runs Google's Gemini AI models. Gemini writes the questions and our server sends them back to your phone. The same service is used to check a sample of the questions against your pages and to outline the chapters in a document.
What we do and don't do with it:
- Our server doesn't store your page text, page pictures or the generated questions after the request is finished. It handles them in memory only to pass them on and return the result. Our server logs never contain page text, pictures or questions.
- We don't include your user ID, email address or purchase records in what we send to the AI. The request comes from our server, not from your phone.
- Neither we nor Google use your pages to train AI models. Google processes this content for us under the Google Cloud Data Processing Addendum and its service terms. Google states that it won't use customer data to train or fine-tune any AI models without the customer's permission. See Google Cloud's page on Vertex AI data governance and zero data retention.
- What Google may keep for a short time. Google's page explains two things. First, Vertex AI may cache request data in memory to make repeat requests faster, and deletes it no later than 24 hours after it's written. Second, Google may log prompts to detect abuse and breaches of its acceptable-use rules, under the Google Cloud terms. We don't use Google features that store your content for longer, such as grounding with Google Search or Maps.
- Our project is in the United States. Google's AI service may handle a request in any Google Cloud region.
Your permission. The first time you create a test, the app explains that page content will be sent to our AI provider and asks you (or the parent setting up the app) to agree. If you don't agree, you can still use everything else in the app on your phone, but it can't write new questions. You can withdraw your permission at any time in Me › Privacy, and the app will then stop sending pages.
A tip for parents. Anything printed on a page you send goes to the AI with it, such as a name on a worksheet. Crop out or avoid photographing names, addresses or other personal details. The app doesn't need them.
2. Plans, purchases and your allowance#
Purchases are handled entirely by the store you buy through: Apple (the App Store) on iPhone, and Google Play on Android. We never see your payment card, your Apple Account or your Google payment details. The store's handling of your purchase is covered by Apple's Privacy Policy or Google's Privacy Policy.
To apply your plan, our server keeps, with your user ID:
- your plan (Free or Plus) and when a Plus subscription ends or renews
- this month's counts: how many tests and questions you've made, and any tests being made right now
- your unused single-quiz credits
- On iPhone, App Store purchase records that Apple signs and the app passes to us: the transaction number, the original transaction number of a subscription, the product, the purchase and expiry dates, whether it was refunded, and whether it was a real or test (sandbox) purchase
- On Android, Google Play purchase records: the product, the Google Play order number, the subscription's state and expiry date, the single-quiz credits it gave, whether it was refunded or revoked, and whether it was a real or test purchase. We keep only a scrambled (hashed) form of Google Play's purchase token, never the token itself.
We check every App Store purchase record with Apple's signature before we use it. On Android, the app sends us the purchase token Google Play gives it, and our server checks it directly with Google through the Google Play Developer API before we apply anything. Google Play also sends our server real-time developer notifications when a subscription renews, is cancelled or is refunded, and we check each one with Google the same way. When you buy on Android, the app gives Google Play a scrambled code made from your user ID (a SHA-256 hash), so the purchase can be matched to your account and to help stop fraud. It isn't your name or email. We use these only to apply your allowance, restore your purchases on a new phone and stop misuse, for example the same single-quiz purchase being used twice.
3. Checking requests come from the real app (App Check)#
To protect the service from fake apps and scripts, the app uses Firebase App Check: with Apple's App Attest on iPhone, and Google's Play Integrity on Android. Your phone gives our server a cryptographic proof that a request comes from the genuine Exam Gorilla app. It contains no personal information. Google states that App Check doesn't keep the attestation material, and keeps the short-lived tokens it issues for at most 30 days when, as we do, it uses them to stop replayed requests.
4. Connection information and technical logs#
Like every internet service, our server sees your device's IP address and basic request details, such as the time and the app version, when the app connects. Google's services that we use also process it: Firebase Authentication keeps logged IP addresses for a few weeks to protect sign-in from abuse, and Cloud Functions uses IP addresses only temporarily to provide the service, as Google describes in Privacy and Security in Firebase.
Our server writes short-lived technical logs in Google Cloud Logging. They record your user ID, the kind of request, counts, timings and error reasons, so we can fix problems and stop abuse. They never contain page text, pictures, questions or purchase details. We don't use logs to build a profile of you or to track you.
5. Advertising and Meta#
We advertise Exam Gorilla on Facebook and Instagram. To learn which ads work, the app and our website use tools from Meta Platforms, Inc. (the Facebook SDK in the app, and the Meta Pixel on our home page). This is the only advertising tool we use.
What the app sends to Meta:
- that the app was opened (app activation)
- that a grown-up signed in with Apple or Google (just the fact, not the email)
- that a test was made: how many questions, which question types and the grade band
- that a test was finished: a score band (not the exact score) and the test mode
- that a plan was bought: the price and currency
- device and app details the SDK collects, such as device model, operating system, app version, IP address and, only if you allow it, your device's advertising ID (IDFA on iPhone, the Google advertising ID on Android). On Android, the app also reads the Google Play install referrer, which tells us which ad, if any, led to the install. On iPhone, Apple's SKAdNetwork reports installs from ads without identifying you.
What we never send to Meta: your name, email address, documents, page text, questions, answers or exact scores.
When it's switched on. The tracking prompt and the advertising ID are used only for a signed-in grown-up (sign-in comes after the grown-up check) who has never made a test at a Grade 1–8 level. If any test on that phone was made at Grade 1–8, we treat it as a child's phone and don't ask for tracking or use the advertising ID.
On iPhone, Apple's App Tracking Transparency prompt asks "Allow Exam Gorilla to track your activity across other companies' apps and websites?" If you tap Ask App Not to Track, we don't read the advertising ID and Meta gets no ID that links you across apps. You can change this any time in Settings › Privacy & Security › Tracking.
On Android, you can delete or reset your advertising ID in Settings › Privacy › Ads (on some phones Settings › Google › Ads). When it's deleted, the app can't read it.
On our website, the Meta Pixel loads only on the home page and only after you tap Accept on the cookie banner. If you tap Decline, or don't choose, it never loads. You can change your choice any time with Cookie settings at the bottom of the home page. It never loads on our privacy, terms or delete-account pages. When it's on, it tells Meta you visited, tapped an App Store or Google Play button, or sent the contact form. If you accepted and then send the contact form, our server also tells Meta about it directly (Meta's Conversions API), with your email address scrambled (a SHA-256 hash), your IP address and browser type. If you didn't accept, our server sends nothing to Meta.
What Meta does with it. Meta uses this to tell us how our ads perform and to show our ads to people who may like the app. Meta may combine it with what it already knows about you, under Meta's Privacy Policy. You can see and disconnect this activity in your Facebook or Instagram account under Your activity off Meta technologies (formerly Off-Facebook Activity), and control ads in Meta's Ad preferences.
Deleting your account#
You can delete your account in the app: Me › Delete account. A grown-up check comes first, and the app may ask you to sign in again. When you delete your account:
- we delete your account record on our server (plan, counts, credits and the email address Apple or Google shared) and your Firebase sign-in
- on iPhone, if you used Sign in with Apple, we tell Apple to revoke Exam Gorilla's access to your Apple sign-in
- we keep App Store and Google Play purchase records with your user ID removed, so they're no longer linked to you. We need them so that a purchase can't be used twice and to handle refunds.
- everything on your phone stays there until you delete it with Me › Data › Delete all my data or delete the app. On Android, Delete all my data also clears the page pictures and camera files the app keeps in its cache.
Google states that Firebase removes deleted sign-in data from its live and backup systems within 180 days.
Deleting your account doesn't cancel a subscription, because Apple or Google Play bills it. To stop it on iPhone, open Settings, tap your name, then Subscriptions. On Android, open the Google Play app, tap your profile picture, then Payments & subscriptions › Subscriptions.
If you can't use the app, ask us to delete it with the form on our Delete your account page. We'll email you to confirm it's really you first. You can also email hello@examgorilla.app.
Contact and support#
You can reach us by email or with the contact form on our website. Neither is part of the app.
Email. If you email hello@examgorilla.app, we receive your email address and whatever you write. We use it only to answer you, and we delete the conversation when it's no longer needed. Please don't send us your documents unless we've asked for an example to fix a problem.
The contact form on our website. When you use the contact form on examgorilla.app, we collect:
- your name, email address, the topic you pick and your message
- the page you sent it from and your browser's type and version (its "user agent"), to help us answer
- a one-way hash of your IP address: a scrambled code that can't be turned back into the address. We use it to stop spam by limiting how many messages one connection can send in an hour. The counter that uses it is deleted automatically after that hour. The hash is also saved with your message so that we can block abuse, and is deleted with it.
This is stored in Google Firebase (Cloud Firestore, in the United States) and used only to answer you. We keep it for 2 years after your ticket is closed, or until you ask us to delete it, if that's sooner. To ask, email hello@examgorilla.app with your ticket number.
Spam protection. The website contact form uses Cloudflare Turnstile to block spam. It loads only when you open the form, and checks that a real person is sending it by processing technical data such as your IP address and browser signals (for example your browser type and how the page was loaded). Cloudflare handles this data under its own privacy policy. Turnstile doesn't use cookies for tracking or advertising, and we only receive a pass or fail result, never a profile of you.
Our website is hosted by Vercel, which passes contact-form messages on to our server and, like any web host, processes your IP address and browser details to deliver the pages.
What we don't do#
- We don't show ads inside the app. The app does contain Meta's SDK to measure our own ads, as described in Advertising and Meta.
- We use product analytics to count things like tests made and features used: Google Analytics in the app on iPhone and Android and on our website, and Mixpanel on iPhone and our website (the Android app doesn't include Mixpanel). They get a random ID (your account ID once you sign in), never your name, email, documents, questions or answers. Event details are limited to counts and kinds, such as how many pages or a score band. In Google Analytics, advertising features, the advertising ID and Google Signals are turned off, and Mixpanel doesn't keep your IP address. The app sends analytics only from its published version, never from test builds. We don't use crash-reporting tools.
- We don't sell or rent personal information for money. But we do "share" it for advertising, as California law (CCPA/CPRA) uses that word: sending app and website events to Meta for ad measurement and targeting is "cross-context behavioral advertising". See Do not sell or share my personal information for how to opt out.
- We don't send marketing emails. We don't create profiles of children, use their data for marketing or turn on ad tracking for them.
- We don't use your information for anything other than the purposes in this policy without asking you first.
Who receives information#
| Who | What they receive | Why |
|---|---|---|
| Google Cloud and Firebase (Google LLC, USA): Vertex AI, Authentication, App Check, Cloud Functions, Firestore, Cloud Logging | Selected page text, sometimes a page picture, and your test choices (for the AI). Your user ID, sign-in method (Apple or Google), the email Apple or Google shared, plan, counts, credits and purchase records. App Attest (iPhone) or Play Integrity (Android) proofs, IP address and technical logs. Website contact-form messages. | To write and check questions, run our server, store your account and plan, protect the service, and store contact messages |
| Apple (iPhone) | Your purchase, handled by Apple. If you use Sign in with Apple, Apple runs that sign-in and we ask it to revoke access when you delete your account. | Payments, subscriptions, refunds, sign-in and App Attest |
| Google Play (Android) | Your purchase, handled by Google Play, and the hashed code made from your user ID. Our server sends Google the purchase token to check it, and receives Google Play's purchase notifications. Play Integrity checks. | Payments, subscriptions, refunds, and checking requests come from the genuine app |
| Google (sign-in, only if you choose Google) | That you're signing in to Exam Gorilla. Google shares your Google account ID and email address with us. | To sign you in |
| Cloudflare, Inc. (Turnstile, USA) | IP address and browser signals when you open the website contact form | To block spam (under Cloudflare's privacy policy) |
| Vercel Inc. (website host, USA) | IP address and browser details when you visit examgorilla.app, and contact-form messages passing through | To host our website |
| Mixpanel, Inc. (product analytics, USA; iPhone app and website, not the Android app) | A random ID (your user ID after sign-in) and app or website events such as test made, test finished (score band only), plans viewed and purchase made; device type, app version and approximate country. No names, emails, documents, questions or answers, and no IP address stored | To understand which features help and fix what doesn't |
| Google Analytics (Google LLC, USA; iPhone and Android apps, and website) | The same kind of events and a random app-instance or browser ID, plus IP address (used only for approximate country). Advertising features, the advertising ID and Google Signals are off | To understand which features help and fix what doesn't |
| Meta Platforms, Inc. (Facebook SDK in the iPhone and Android apps, Meta Pixel and Conversions API for the website; USA) | App events: app opened, signed in, test made (question count, question types, grade band), test finished (score band, mode), plan bought (price, currency). Device model, OS, app version, IP address. The advertising ID (IDFA or Google advertising ID) only if you allow it; the Google Play install referrer on Android. Website, only after you tap Accept: page view, store-button taps, contact form sent, and for the form a SHA-256 hash of your email, IP address and browser type. Never names, plain emails, documents, questions or answers | To measure our Facebook and Instagram ads and show them to people who may like the app. This is "sharing" for advertising under California law. Meta also uses it under its own privacy policy |
We require the companies we work with to protect information at least as well as this policy does, and to use it only to provide their service to us. Meta is the exception: it also uses what it receives for its own purposes, under its own privacy policy, which is why we treat it as "sharing" and let you opt out. We may also disclose information if the law requires it, for example a valid court order, or to protect people's safety. If the company or the app is ever sold, this policy will continue to apply to the information we hold, and we'll tell you before any change.
How long we keep things#
| Information | Where | How long |
|---|---|---|
| Documents, pages, questions, results, stars, settings | Your phone | Until you delete them, use Delete all my data or delete the app |
| Page text, page pictures and test choices sent for questions | Our server | Only while the request is being handled. Not stored afterwards. |
| The same content at Google Vertex AI | Google Cloud | Not used for training. May be cached in memory for up to 24 hours, and prompts may be logged to detect abuse, as Google describes on its data governance page. |
| User ID, sign-in method, the email Apple or Google shared, plan, counts, credits | Our server (Google Firebase, USA) | Until you delete your account. Google removes deleted sign-in data from backups within 180 days. |
| App Store and Google Play purchase records | Our server (Google Firebase, USA) | While your account exists. After you delete it, kept with your user ID removed, only as long as needed to stop a purchase being used twice and to handle refunds |
| Technical logs (no page content) | Google Cloud Logging | Short-lived: deleted automatically within 30 days |
| IP addresses at Firebase Authentication | Google Firebase | A few weeks, as Google states |
| App Check tokens | Google Firebase | At most 30 days, as Google states |
| Support emails | Our email | Until your question is resolved and it's no longer needed |
| Website contact form: name, email, topic, message, page, browser type | Google Firebase (USA) | 2 years after your ticket is closed, or until you ask us to delete it |
| Hash of your IP address (website contact form) | Google Firebase (USA) | Spam counter: 1 hour. Copy saved with your message: deleted with the message |
| App and website events sent to Meta | Meta Platforms (USA) | Kept by Meta under Meta's Privacy Policy. We don't store them ourselves. You can disconnect them under "Your activity off Meta technologies" |
| Your cookie choice on our website | Your browser (localStorage) | Until you change it or clear your browser data |
Your choices and rights#
- Delete your account: Me › Delete account, as described above.
- Delete everything on your phone: Me › Data › Delete all my data. Deleting the app also removes its data from the phone. On iPhone, phone backups made before that are handled by Apple, as described above.
- Stop sending pages to the AI: turn off "Let the AI read my pages" in Me › Privacy, or simply don't create new tests. Everything already on your phone keeps working.
- Don't sign in: the app works fully on the automatic account.
- Cancel a subscription: see "Plans" in our Terms of Use. On iPhone, open Settings, tap your name (your Apple Account), then Subscriptions. On Android, open Google Play, tap your profile picture, then Payments & subscriptions › Subscriptions.
- Delete a message you sent with the website contact form: email hello@examgorilla.app with your ticket number (it looks like EG-261022-4F7K).
- Stop ad tracking: see the next section.
- Ask what we hold, or ask us to delete it: email hello@examgorilla.app. If you never signed in, we don't know who you are, so we may ask for a detail from your Apple or Google Play receipt, such as the order ID, to find the right record.
Depending on where you live, you may have the right to ask what personal information we hold about you, and to have it corrected, deleted or sent to you. You may also have the right to object to or restrict how it's used, and to withdraw consent. These rights come from laws such as the GDPR and UK GDPR, California's CCPA, and India's Digital Personal Data Protection Act 2023. Email us to use any of these rights. We'll reply within the time the law allows and won't treat you differently for asking. If you're in the EU, the UK or another country with a data-protection authority, you can also complain to it.
Do not sell or share my personal information#
We don't sell personal information for money. We do "share" it with Meta for cross-context behavioral advertising, as California law defines it. You can opt out at any time:
- On our website: tap Decline on the cookie banner, or Cookie settings › Decline at the bottom of the home page. The Meta Pixel then never loads, and our server sends nothing to Meta about your contact form. We also treat a browser Global Privacy Control signal as a "Decline".
- On iPhone: tap Ask App Not to Track when asked, or turn off tracking for Exam Gorilla in Settings › Privacy & Security › Tracking.
- On Android: delete or reset your advertising ID in Settings › Privacy › Ads (or Settings › Google › Ads).
- At Meta: disconnect our activity under Your activity off Meta technologies in your Facebook or Instagram settings.
- By email: write to hello@examgorilla.app with "Do not sell or share" and we'll help.
Basic app events without an advertising ID may still reach Meta for ad measurement after you opt out on your phone. If you want none at all, email us and we'll tell you what we can switch off for you.
Legal bases (EU and UK). Website advertising measurement (the Meta Pixel) relies on your consent, which you give by tapping Accept and can withdraw any time. App advertising measurement with Meta relies on your consent where the law requires it (for example the tracking prompt on iPhone), and otherwise on our legitimate interest in measuring our ads. We handle page content to provide the feature you asked for (performance of our contract with you) and with your permission. We handle your account, plan and purchase records to provide the app and your plan (contract). We handle App Check proofs, connection data and technical logs for our legitimate interest in keeping the service secure and working. We handle contact-form messages for our legitimate interest in answering the questions you send us. Where the law requires a parent's consent for a child, we rely on that consent.
Children#
Exam Gorilla is made for students of all ages, including young children. It's designed so that a parent or guardian sets it up, and so that it works without any personal information about the child: the automatic account has no name, email or birthday, and there's no chat and no sharing with other users.
- Parents of children under 13 (US, COPPA), and of children under the age of digital consent where you live (between 13 and 16 in the EU, 13 in the UK, and under 18 in India): please set up the app, choose what gets added, and agree to the AI step yourself before your child uses it.
- Signing in, buying and deleting the account are for grown-ups. The app puts a grown-up check in front of each of them. If you sign in, please use your own Apple Account or Google account, not your child's.
- Ad tracking is not turned on for children. The app asks for tracking (iPhone) and reads the advertising ID (Android) only for a signed-in grown-up on a phone where no test has ever been made at a Grade 1–8 level. If a child uses your phone, please don't allow tracking when asked, and turn it off in Settings if you already did.
- Grade or age bands such as "Grade 1–3" are used to set the reading level of the questions. They're sent with the request but not stored with the account. The grade band is also included in the "test made" event sent to Meta and to our analytics, and it's how the app knows not to turn on ad tracking.
- Purchases are made through Apple or Google Play. We recommend Apple's Family Sharing and Ask to Buy, or Google Family Link with purchase approvals in Google Play, so that you approve any purchase.
- We don't knowingly collect personal information from a child beyond what this policy describes. If you believe a child's personal information has reached us, for example a name in a page photo sent for questions, email hello@examgorilla.app. Our server doesn't keep page content, but we'll help you with anything we do hold and delete it.
- Parents can review everything the app stores about tests and results, because it's on the device. They can delete it at any time with Me › Data › Delete all my data, and delete the account with Me › Delete account.
Where information is handled#
We're based in the United States. Our server, account data and website contact messages are in Google Cloud and Firebase in the United States. Google's AI service may handle a request in any Google Cloud region. The website is hosted by Vercel, and the form's spam check (Cloudflare Turnstile) runs on Cloudflare's global network. Meta handles advertising events in the United States and elsewhere. Where the law requires it, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses, which are part of Google's Cloud Data Processing Addendum.
Security#
Everything sent between the app and our server is encrypted with HTTPS. Our server accepts requests only from the genuine app (App Check) and from a signed-in account (the automatic one counts). Your account record can be read only by you and changed only by our server. Data on your phone is protected by iOS or Android, including their encryption when the phone is locked with a passcode. Our server keeps no documents, and no AI keys live inside the app. No system is perfectly secure, so we keep what we hold to the minimum.
Changes to this policy#
If we change how the app handles information, we'll update this policy and the "Last updated" date. If the change is significant, for example a new kind of data, saving tests online, or a new company receiving it, we'll tell you in the app and ask again for permission where needed before it applies.
Contact#
Sphnix, Inc
15833 Ibsen Pl, Dumfries, VA 22025, USA
Email: hello@examgorilla.app