Privacy Policy

We collect the following information:

• Account information: your name, email address and password, your interface language, your time zone and the date you created your account. Your time zone is the one your browser reports (for example America/Toronto) when you open your dashboard or Account page. We use it so that your dashboard, including your exam countdown, follows your own calendar day, and to time the exam-morning email described in section 7. Your password is sensitive information: it is stored only as a one-way hash by our authentication provider, and we can never see it.
• Sign-in with Google: if you choose "Continue with Google", Google shares with us your name, email address, whether your email address is verified, your Google account ID and a link to your profile photo (see section 5).
• Exam plans: your exam date, your target level, whether you told us that you have not booked yet, and the result you tell us after your exam.
• Practice activity: your answers, scores, drafts, essays, timers, exam simulations and estimated levels, the history of the tests you start and finish, the words you look up in the dictionary and your vocabulary list.
• Voice recordings and transcripts: the recordings you save in the speaking module, and their written transcripts.
• Live examiner conversations: while a conversation with the live AI Examiner runs, your microphone audio is streamed to OpenAI so that the examiner can hear you and reply. We do not store that audio. We store the written transcript of the conversation, the feedback you ask for on it, and its length, which is what your minutes are counted from. We also keep a technical record of the conversation's timing, such as when you and the examiner spoke and how long each sentence was. It never contains the words themselves, and we use it only to check and improve the examiner.
• AI feedback: the levels, corrections, rewritten answers and comments that the AI Examiner produces on your writing, recordings and conversations; a log of when you used AI features, which we use to count your usage; and whether you agreed to our AI notice.
• Effort points, badges and streaks: we calculate them for every account from your practice. If you join the leaderboard, we also store the display name you choose. Other students see these only if you join (see section 12).
• Referrals: your referral code, who referred you, and any referral credit you have earned.
• Payments: for each purchase, the order and payment identifiers, the amount, currency and date, what you bought (access or a minute pack), its status, your access period, any refund and your device's time zone (so that your receipt shows dates in your local time); and your balance of live minutes with their expiry dates. You enter your card, UPI or bank details with Razorpay, and they stay with Razorpay: we never receive them.
• Payments that did not go through: the amount, currency and date, the order and payment identifiers, the type of payment method used (such as a card, UPI or a digital wallet) and the reason Razorpay reported. We keep these for 90 days.
• Reviews and feedback: reviews you submit (display name, star rating and text), private feedback messages you send us, and the messages from our team that we show on your dashboard, such as a reply to your review or an announcement, with whether and when you closed them. Dashboard messages appear on the site only and are never emailed.
• Messages you send us: by email or through our contact form, your name, email address and message.
• Email records: which of our emails we sent you and when, and a record of when you agreed to or stopped study tips and reminder emails.
• Your acceptance of our Terms: when you accept our Terms of Service and policies, we record the date and time, how you accepted (on the signup form, on the one-time acceptance page shown after you sign in with Google or to a demo account, or with the checkbox above a buy button, together with the order it was for, whether or not the payment then went through), the version of each document you accepted and your interface language.
• Sign-in security logs: our authentication provider records the IP address and browser details of each sign-in and keeps a security log of account events, such as sign-ins and password changes.
• Usage and device data: the pages you visit, your device and browser type, and your approximate location from your IP address. Our hosting provider receives these with every request, and Google Analytics receives them only if you accept analytics cookies.
• Cookies and similar technologies: see section 9.

We do not ask for your date of birth, postal address or any government ID. Razorpay may ask for your phone number when you pay.

If you choose "Continue with Google", Google shares with us your name, email address, whether your email address is verified, your Google account ID and a link to your profile photo. We use this information only to create your account and sign you in; your name and email address then become your account details, which we use as described in this Policy. We do not display or use your profile photo. This information is stored with your account at Supabase. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.

Google also knows that you signed in to our site, as described in Google's Privacy Policy. You can remove our access to your Google account at any time at myaccount.google.com/permissions. Your account with us stays until you delete it.

Account and purchase emails. We send the emails needed to run your account: email confirmation and sign-in links, password reset and password-change notices, receipts for access and minute packs, refund notices, and confirmation when you delete your account. These are part of the Service, so they continue while you have an account.

Study tips, reminders and follow-ups. Unless you unsubscribe, we also send:

• a welcome email when you join;
• study tips during your first week;
• reminders before and after your access ends, including renewal reminders, and a progress summary about two weeks before it ends;
• a message a few weeks after your access has ended;
• if you give us your exam date, messages around it: good luck the day before (or, if that message could not go out in time, on the morning of your exam, but only if we know your time zone and it is still before 10 a.m. there); a message the day after, when we ask how it went and invite a review; and a follow-up 28 to 30 days after, unless you have told us that you reached your target or your access is still active. We do not send these messages to our team's own accounts;
• notices when you earn referral credit;
• occasional announcements about new features;
• a weekly practice recap in any week in which you earned effort points; and
• if a payment did not go through and you have not completed the purchase since, a follow-up explaining what happened and how to complete it, at most once a week.

Some of these emails are personalised with your first name, your exam date, your practice results and your estimated levels.

How to stop them. Use the unsubscribe link at the bottom of any of these emails, or turn them off under Email preferences on your Account page. This takes effect immediately and stops all of them at once. It does not stop the account and purchase emails described above. All our emails are sent through Resend (see section 10), and replies reach our mailbox.

Essential cookies and storage. We use a small number of cookies and browser storage items that the Service needs in order to work. They do not need your consent:

• Sign-in cookie (its name starts with sb- and ends with -auth-token): keeps you signed in, for up to 400 days or until you sign out.
• tcp-lang: remembers your interface language, for 1 year.
• tcp-currency: set only when you choose a currency for prices. It holds the code of that currency (for example CAD) and is kept for 1 year, or until you choose Automatic again, which deletes it.
• buy_intent, signup_ref and pw_recovery: remember, for 15 minutes, that you were about to buy, that you arrived through a referral link, or that you are resetting your password.
• terms_pending: set only when you have signed in with Google, or to a demo account, and still have to accept our Terms, so that we can show you the acceptance page. It holds your account ID, cannot be read by scripts in the page, and is deleted as soon as you accept, or after 30 days at the latest.
• Browser storage: remembers your cookie choice, your colour theme, whether the dictionary is switched on and whether you closed certain notices, until you clear it. It also remembers, until you close the tab, the time zone we last tried to save to your account (see section 3).

Analytics cookies. We use Google Analytics only if you click Accept. Until then no analytics script runs. You can change your choice at any time with the Cookie settings link at the bottom of every page. If you accept, Google Analytics sets the cookies _ga and _ga_ followed by an ID (for up to 2 years), and receives the pages you visit, your device and browser type, your approximate location from your IP address, and events such as finishing a test or making a purchase. We do not send it your name or email address. See how Google uses information from sites that use its services.

Payment and security checks. When you tick the box to buy, or open the payment window, Razorpay's checkout may use its own cookies or similar technology to process your payment and prevent fraud. The Cloudflare check on our sign-in forms may do the same to tell people from bots.

We share personal information only as needed to run the Service, with the providers below. Each receives only what it needs to provide its service to us. Where a provider also uses information for its own purposes, under its own privacy policy, we say so.

• Supabase (our data is stored in Seoul, South Korea): our authentication, database and file storage. It holds everything stored with your account, including your password hash, recordings, essays and transcripts, and it keeps the sign-in security logs (IP address and browser details).
• Vercel (United States): hosts our website and runs our server code in Seoul, South Korea. It receives every request you make to the site, including your IP address and browser details, and keeps our server logs.
• OpenAI (United States): generates AI feedback on your writing and saved recordings (it receives the essay or audio file, the task and the transcript), and definitions for the dictionary (it receives the word and its sentence from the test, not who you are). It also runs the live AI Examiner: your microphone audio streams directly from your browser to OpenAI, so OpenAI also sees your IP address, and we send a code derived from your account ID (not your name or email address) so that OpenAI can detect abuse. OpenAI states that it does not use data sent through its API to train its models, and that it keeps it for up to 30 days to detect abuse unless the law requires it to keep it longer.
• Google (United States): sign-in with Google, if you use it (see section 5); Google Analytics, only if you accept analytics cookies (see section 9); and our email mailbox, where messages you send us, replies to our emails and our own notifications about sign-ups, purchases, reviews and feedback arrive. For sign-in and analytics, Google also acts under its own Privacy Policy.
• Cloudflare (United States): runs Turnstile, the check on our sign-up, sign-in, password-reset and password-change forms that makes sure they are used by a person and not a bot. It receives your IP address and technical details about your browser. Cloudflare also uses these signals, as its own controller, to improve its bot detection (see Cloudflare's Turnstile Privacy Addendum).
• Resend (United States): sends all our emails, including receipts and account emails and, unless you unsubscribe, study tips and reminders. It receives your email address, your first name and the content of each email, which can include your exam date, practice scores and estimated levels. It also delivers the messages you send through our contact form to our mailbox.
• Razorpay (India): processes payments and refunds. With each order, we send it your email address, name, account ID, your device's time zone (so that your receipt, and any email we send you about a payment that did not go through, shows dates in your local time) and the versions of our Terms of Service and Refund & Cancellation Policy that you accepted. Razorpay collects your payment details, phone number, device and IP data directly, under its own privacy policy; we receive only the payment status, identifiers and amount, the type of payment method and, if a payment fails, the reason.

We may also disclose information if required by law, to respond to lawful requests, to protect our rights, safety or property or those of others, or in connection with a business transfer (such as a merger or acquisition). We do not sell your data.

We are based in India, and we access and manage your information from India. Your account, practice data and recordings are stored by Supabase in Seoul, South Korea. Our server code runs on Vercel servers in Seoul, South Korea, and Vercel delivers our pages from its location nearest to you. OpenAI, Google, Cloudflare and Resend process information in the United States, and Razorpay processes payments in India.

Your information is therefore communicated outside your province and outside Canada. If you live in Québec, this means that information about you is communicated outside Québec. While your information is in another country, the courts, law enforcement and national-security authorities of that country may be able to access it under local law. You can ask us for more information about these transfers at info.tcfcanadapractice@gmail.com.

• Reviews: if you submit a review, we publish your display name, star rating, review text and date on our website, and they may appear in Google search results. You choose the display name, and you can ask us to remove your review at any time.
• Leaderboard: only if you join, other signed-in students see your pseudonym, weekly effort points, badges, practice days and streak. You can leave at any time.

Your email address, practice scores and estimated levels are never shown to other users.

• Account and practice data (your profile, exam plans, answers, essays, transcripts, AI feedback, live conversation transcripts and timing records, points, badges, dictionary history, email records and the record of your acceptance of our Terms): kept while your account exists. We do not currently delete inactive accounts automatically, so your account stays until you delete it or ask us to.
• Voice recordings: the audio file is deleted automatically 60 days after you record it. The written transcript and any AI feedback stay in your account until you delete your account.
• Live examiner audio: not stored by us.
• Payments that did not go through: deleted automatically after 90 days. The order recorded with the checkbox you ticked above the buy button is part of the record of your acceptance of our Terms and is kept while your account exists.
• Messages from our team on your dashboard: deleted automatically 90 days after they expire or are withdrawn, together with the record of whether and when you closed them.

When you delete your account, we immediately delete your profile, practice data, recordings, transcripts, feedback, reviews, messages, purchase records and the record of your acceptance of our Terms from our database. A few records remain: refund records (the refund and payment identifiers and the amount, without your name or email address); the record of your choices to unsubscribe from or re-subscribe to study tips and reminder emails, with your email address kept only in a coded (hashed) form, so that an unsubscribe continues to apply; the security log kept by our authentication provider; copies in our providers' backups and logs until they expire; emails already in our mailbox; and the payment records that Razorpay keeps under its own legal obligations.

We use industry-standard measures to protect your information, including encrypted connections (HTTPS), hashed passwords, database access rules, a bot check on our sign-in forms, and private storage for your voice recordings. Other users cannot access your recordings, and playback uses links that expire after one hour. Only the people who run the Service can access account data, and only to provide the Service, give support, fix problems or meet legal obligations. Audio you submit for AI feedback is sent to OpenAI as described in section 10.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to address issues promptly. If a security incident creates a real risk of significant harm to you, we will tell you promptly by email and notify the regulators the law requires.

Depending on where you live, you may have the right to access, correct, update or delete your personal information, to object to or restrict certain processing, to receive a copy in a portable form, and to withdraw consent. You can:

• update your details and delete saved recordings from within the Service;
• delete your entire account from your Account page (see section 13 for what is deleted);
• stop study tips and reminder emails with the unsubscribe link in any of them, or under Email preferences on your Account page;
• change your analytics choice with the Cookie settings link at the bottom of every page;
• withdraw your agreement to AI processing by no longer using the AI features, or by telling us, and we will record that you have withdrawn it;
• leave the leaderboard, and ask us to remove a review;
• remove our access to your Google account at myaccount.google.com/permissions; and
• contact us at info.tcfcanadapractice@gmail.com to exercise any other right or to raise a complaint. We will respond within the time required by applicable law.

If you are not satisfied with our answer, you can complain to a data-protection authority, for example the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information.

• Who is responsible: the operator of TCFCanadaPractice is responsible for protecting personal information, approves this Policy, and decides which providers may receive information.
• Retention: we keep information only for the periods described in section 13. Automatic jobs delete recording audio after 60 days, records of failed payments after 90 days, and expired dashboard messages after 90 days.
• Complaints: privacy questions and complaints go to info.tcfcanadapractice@gmail.com. We look into every complaint, reply by email, and change our practices where a complaint shows that we should.
• Incidents: we follow a written plan for security incidents: we assess and contain the incident, keep a record of every incident, and tell you and the authorities where the law requires.