Privacy Policy

CrystalSAT ("CrystalSAT," "we," "us," or "our") is a student-run educational project that provides free SAT preparation resources, practice questions, study tools, and related features.

This Privacy Policy explains what information CrystalSAT collects, how we use it, where it is stored, and the choices available to you.

This policy describes the application as currently implemented. It is not legal advice and should be reviewed by a qualified privacy attorney before publication.

We collect information that you provide directly, information generated when you use CrystalSAT, and limited information processed by services that help us operate the site.

Based on the current application code, CrystalSAT does not intentionally request or store payment-card information, payment credentials, GPS coordinates, or a physical mailing address as part of its normal student-facing features.

The application also does not contain a normal student-facing feature specifically requesting demographic information such as gender or age.

This does not mean that third-party infrastructure may never process technical information as part of delivering the Service. Third-party providers have their own privacy practices.

We use information to create and authenticate accounts; provide practice and educational features; save and resume progress; calculate scores and learning statistics; generate and maintain mastery and study-plan progress; provide account and notification functionality; operate internal communication features; understand how the Service is used; improve reliability, performance, and functionality; understand referral and outreach effectiveness; review volunteer applications and administer volunteer access; respond to questions and support requests; and protect the Service and investigate misuse or security issues where necessary.

CrystalSAT uses learning activity primarily to provide educational functionality.

For example, mastery records store diagnostic answers, study-plan answers, test answers, topic statistics, skill statistics, scores, and progress information. These records are associated with the user’s MasteryPath record and protected by ownership-based row-level access rules.

Practice progress is likewise associated with the user’s account when the user is authenticated. For users who are not logged in, certain practice status and flag information is kept in the browser instead.

CrystalSAT uses browser storage for several functions, including theme preferences; anonymous practice progress; question flag/favorite state; referral information; and an analytics session identifier.

The analytics implementation stores its session identifier in sessionStorage. The application also uses localStorage for theme preference, anonymous practice state, question flags, and referral state.

The code reviewed does not show CrystalSAT intentionally using advertising cookies for behavioral advertising.

Browser storage is controlled by the browser, so exact deletion and retention behavior can depend on the device and browser.

CrystalSAT includes internal communication functionality for its team workspace.

Chat messages may contain message text, channel information, and thread relationships. Chat attachments may contain an original filename, MIME type, file size, and an R2 storage key.

Question reports can also contain free-text descriptions submitted by users when reporting an issue with a question.

CrystalSAT uses Cloudflare R2 object storage for certain application files.

For example, chat attachments may be stored in R2. The database stores the object’s storage key rather than a permanent public URL, and the attachment record includes the original filename, MIME type, and file size.

CrystalSAT also uses server-side access to R2 rather than placing R2 credentials in the browser. Administrative storage operations use protected backend functionality and temporary signed URLs.

Base44: CrystalSAT uses Base44 for application hosting/backend functionality, authentication, database functionality, backend functions, and analytics.

Google: Google authentication is available as a sign-in option.

Cloudflare: CrystalSAT uses Cloudflare R2 for object storage.

Desmos: CrystalSAT embeds the Desmos Graphing Calculator in an iframe hosted by Desmos. Your browser may communicate directly with Desmos while the calculator is used.

YouTube: CrystalSAT links to YouTube content and resources. When you follow those links, YouTube’s own policies apply.

Third-party providers may process information according to their own systems, privacy policies, logging, cookies, and retention practices. CrystalSAT’s code cannot establish every category of information those providers may independently process.

CrystalSAT does not have an advertising-sales feature or a system that intentionally sells student information to advertisers.

Information may be shared with service providers when necessary to operate the Service, including hosting, authentication, storage, analytics, embedded tools, and communication infrastructure.

Information may also be accessible to authorized CrystalSAT administrators or team members where necessary for operating the platform.

We may disclose information where reasonably necessary to comply with law, respond to valid legal requests, protect users or the Service, or investigate abuse, fraud, or security incidents.

CrystalSAT’s current source code does not define a universal retention schedule for account information, mastery data, educational progress, chat data, uploaded files, referral records, or most analytics records.

For that reason, this policy does not state a specific number of days or years for retention unless the application explicitly defines one.

Some analytics dashboards use recent reporting periods, but that should not be interpreted as a guaranteed deletion deadline.

When a user requests deletion, CrystalSAT will review the request and, where applicable, delete information from systems under CrystalSAT’s control, subject to legitimate operational, security, or legal retention requirements.

Third-party providers may retain information according to their own policies.

CrystalSAT uses several technical controls in the current implementation, including authenticated access, role-based access controls, row-level access restrictions for user-specific records, and server-side handling of sensitive storage credentials.

For example, MasteryPath and SiteUserProgress are protected by ownership-based rules for normal user access.

CrystalSAT cannot guarantee absolute security. No internet service or electronic storage system can be guaranteed to be completely secure.

Depending on where you live, you may have rights concerning personal information we hold about you. These may include access to your information; correction of inaccurate information; deletion of your account or personal information; information about how your data is used; and other rights provided by applicable privacy law.

To make a privacy request, contact us at hello@crystalsat.com.

We may need to verify your request before completing it, and we will handle requests in accordance with applicable law.

CrystalSAT is an SAT-preparation service and may be used by students who are under 18.

We do not intentionally design the Service to collect extensive personal information from students. The primary account information used for normal registration is an email address and authentication information, with educational data generated from use of the Service. Volunteer applications collect additional information because applicants voluntarily provide it to be considered for the volunteer program.

We do not claim in this policy that the Service is compliant with any particular children’s privacy law without a separate legal review.

Parents or guardians who have questions about a child’s information may contact us at hello@crystalsat.com.

CrystalSAT can be accessed by users in different countries.

The Service relies on third-party providers such as Base44, Google, Cloudflare, and Desmos. Those providers may process information in locations outside the country where you live, depending on their infrastructure and policies.

Because the CrystalSAT codebase does not establish the exact geographic locations or legal transfer mechanisms used by each provider, this policy does not state a specific country, transfer mechanism, or legal basis without further provider-level verification.

We may update this Privacy Policy when the Service changes, when our data practices change, or when additional clarification is needed.

When material changes are made, we may update the “Last updated” date and, where appropriate, provide additional notice through the Service or another reasonable method.

For privacy questions, requests concerning your personal information, or concerns about this policy, contact: