Privacy Policy
What we collect, why, and what happens when you leave. Effective September 3, 2026.
To answer am I ready to pass? we need your study data and the material you upload — and as little else as we can get away with. We don’t sell data and we don’t run ads. This page says what actually happens, matched to how the product is built; the Terms of Service covers the deal itself.
What we collect
Account basics
Your name, email, a hashed password (the password itself is never stored), an optional avatar, and settings like two-factor authentication. Sign in with Google and Google shares your name, email, and avatar with us.
Study data
Your subjects, exam dates, practice and mock responses, self-reported outcomes, and the readiness snapshots built from them.
Your uploads
Your own past papers, syllabi, notes, and recordings. Yours, and treated that way — see AI processing below.
Billing
Handled entirely by Dodo Payments as merchant of record. We keep a Dodo customer id and your subscription state — never a card number.
Technical minimum
One session cookie so you stay signed in, and rate-limit counters stored only as SHA-256 hashes. Sessions record no IP address, and the pre-signup diagnostic runs entirely in your browser — nothing is stored server-side until you claim it with an account.
The theme: the cheapest data to protect is data you never hold, so we hold the minimum the verdict needs.
AI processing
Your study context and the documents you upload are sent to AI service providers to generate your lessons, practice questions, and feedback. We use a small set of established providers for this and may change them as the product evolves — what won’t change is the boundary below.
The boundary is a storage-layer rule, not a policy promise: your uploads ground only your own practice. They never enter any shared bank, are never served to another user, and are never used to train models or build shared content.
Who receives what
- Dodo Payments
- Merchant of record — payment processing, tax, invoices, refunds.
- Resend
- Delivers transactional email: address verification, password resets, reminders.
- AI service providers
- Generate your lessons and questions, embed your documents for search, verify question quality. The specific providers may change as the product evolves.
- Cloudflare R2
- Stores your uploaded documents. Recordings are transcribed, then deleted within 7 days.
- Cloudflare Turnstile
- The human check on signup — armed only when signup abuse shows up on the network, so most signups never see it.
- Google Analytics · Microsoft Clarity
- Aggregate usage analytics on the marketing site — which pages, what gets clicked. Details in Analytics & cookies above.
- Sentry
- Error reports when something breaks; they may include technical request details.
Under all of it, the app and its Postgres database run on a single US-region virtual private server that we operate.
Retention & deletion
Delete your account any time from Settings → Delete Account. The erasure is real: your uploads, the embeddings derived from them, and the stored files are deleted — an embedding derived from a deleted document is still personal data, so it goes too.
What survives is anonymized on purpose: study evidence like exam dates and outcomes, severed of your identity, keeps the readiness score honest for the next student. Financial records are retained as needed for billing integrity.
The shortest-lived thing we hold is audio: uploaded recordings are transcribed, then deleted within 7 days.
Your choices
Delete your account any time in Settings — self-serve, no dark pattern. For anything else — a copy of your data, a correction, a question — email hello@enmaster.app and we’ll handle it. Non-essential email stops the same way: say the word.
Children
Enmaster is built for adult certification candidates. It isn’t directed at children under 13, and we don’t knowingly collect their data.
Changes
If this policy changes materially, the date at the top changes with it, and significant shifts reach account-holders by email. The current text always lives at enmaster.app/privacy.