Privacy Policy

1. Who we are

YKI Test Prep (https://ykitestprep.com) is a free Finnish language exam preparation service, available as a website and as a mobile app, operated by Wahid Sohail, who is the data controller for the personal data described in this policy. Both share the same account and the same backend, so this single policy applies to both.

For questions about this policy, or to exercise any of the rights set out in section 7, contact us at ykitestprep@gmail.com.

2. What data we collect and why

Account data

If you create an account we store your email address and a hashed password via Supabase Auth. This is required to provide sign-in, saved progress, and secure access to your practice history. Legal basis: contract (providing the service you signed up for).

Practice progress

When you are signed in, your practice sessions and vocabulary progress are saved to your account so you can pick up where you left off. Legal basis: contract.

Push notifications (mobile app only)

If you allow notifications, the app registers a push token issued by Expo's push service and stores it against your account together with the device platform (Android or iOS). We use it only to send study reminders and service notifications. The token identifies a device installation, not you personally, and we do not use it for advertising or profiling. You can turn notifications off at any time in your device settings. Legal basis: consent.

Microphone and Speaking recordings (mobile app only)

The Speaking practice screen records your spoken answer so you can play it back and assess it yourself. The app asks for microphone permission the first time you record. These recordings stay on your device. They are never uploaded to us, never stored on our servers, and never shared with any third party. We have no access to them. The microphone is only active while you are actively recording an answer. Legal basis: consent.

Crash reports (mobile app only)

If the app crashes or hits an unexpected error, a diagnostic report is sent to Google Firebase Crashlytics so we can find and fix the fault. A report contains the error and where in the code it happened, plus basic device context — device model, operating system version, app version, and whether the app was in the foreground. It also includes your account's internal identifier (a random ID), so that if you contact us about a problem we can match it to the actual crash. That identifier is not your name or email address.

Crash reports contain no practice answers, no recordings, and no message or community content. Legal basis: legitimate interest (keeping the app working and diagnosing faults).

Data stored on your device

Both the website and the app keep some data locally on your device so the product works between sessions and, in the app, without a connection — for example your study streak, review schedule, which questions you previously got wrong, and a cached copy of practice content. In the app this is removed when you delete your account from the Account tab, or when you uninstall the app. Legal basis: contract.

Contact messages

When you submit the contact form we store your name, email address, and message so we can respond to you. Legal basis: legitimate interest (responding to your enquiry).

Page views (website only)

With your consent, we record pseudonymous page view data to understand which sections of the site are used most. This may include a randomly generated analytics identifier stored in your browser and basic information such as the page visited and time of visit. Legal basis: consent.

Advertising data

Mobile app. The app shows ads served by Google AdMob on a small number of screens (never during an active practice session, quiz, recording, or typing task). AdMob may collect your device's advertising identifier and general ad interaction data (such as which ads were shown and clicked) to serve and measure ads, and, where you consent, to personalise them. In the EEA, UK, and Switzerland, this runs through Google's User Messaging Platform (UMP), which asks for your consent before any personalised ad is requested; you can change your choice at any time from the consent prompt shown in the app. The app itself uses no advertising cookies — mobile advertising identifiers work differently from browser cookies, see “Cookies” below. Legal basis: consent where required, otherwise legitimate interest (keeping the app free).

Website. If we show ads on the site, Google AdSense and its partners may use cookies or similar technologies to deliver ads, measure performance, limit repeated ads, and, where you have given consent, personalise advertising. Legal basis: consent.

Third-Party Advertising and Cookies. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our sites and/or other sites on the Internet. Users may opt out of personalized advertising by visiting Google Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info.

3. Cookies (website only)

The mobile app does not use cookies. It stores the small amount of data described under “Data stored on your device” above in the app's own private storage, which is removed when you uninstall the app. The app does show its own consent prompt for advertising (see “Advertising data” above) — that is a separate, ad-specific consent screen, not a cookie banner, since mobile apps don't use browser cookies. The rest of this section applies to the website only.

When you first visit this site, a consent banner asks whether you agree to optional cookies for statistics. You can accept, decline, or customise your choice, and change it at any time using the Cookie policy link in the footer. Necessary cookies — the ones that keep the site itself working, such as staying signed in — are never subject to this choice, because they are exempt under ePrivacy law.

The banner is provided by FlexyConsent, a certified consent management platform. Google Analytics is loaded on every page using Google Consent Mode: until you consent, it is set to denied and only ever receives anonymous, cookieless ping data — no analytics cookie is set. If you accept statistics cookies, this changes to granted and a standard Google Analytics cookie is set to recognise repeat visits. Google AdSense is not currently loaded on this site at all; if that changes, this section and the cookie declaration in the banner will be updated first.

This list is maintained by hand and reflects the cookies this site is designed to set. If you notice a cookie here that is not listed, please let us know at the contact address in section 1.

4. Who we share data with

We use Supabase (supabase.com) as our backend and database provider. Your account data and progress are stored on Supabase infrastructure. Supabase is GDPR-compliant and acts as a data processor on our behalf under a Data Processing Agreement.

We also use FlexyConsent to run the cookie consent banner described in section 3, and Google Analytics, in the privacy-preserving mode also described there, to understand which parts of the site are used. We are not currently running Google AdSense or any other advertising on the site. If that changes, this policy and the cookie notice in section 3 will be updated first.

For push notifications in the mobile app we use Expo's push service, which in turn hands the message to the platform's own delivery network — Google Firebase Cloud Messaging on Android and Apple Push Notification service on iOS. These providers receive the device push token and the contents of the notification in order to deliver it. This applies to the app only; the website does not use them.

Crash reports from the mobile app go to Google Firebase Crashlytics, which processes them on our behalf so we can diagnose faults. This applies to the app only.

Ads in the mobile app are served by Google AdMob, using Google's User Messaging Platform to obtain your consent in the EEA, UK, and Switzerland before requesting personalised ads. This applies to the app only.

We do not sell your personal data. We only share data with service providers where necessary to run, measure, secure, or monetise the service in line with this policy and applicable law.

5. Transfers outside the EU/EEA

Some of the providers above are based in, or process data in, the United States. Google (Analytics and AdSense) transfers data to the US under the EU–US Data Privacy Framework and, where the Framework does not apply, under the European Commission's Standard Contractual Clauses. Supabase processes personal data under Data Processing Agreements that likewise rely on Standard Contractual Clauses for any transfer outside the EU/EEA.

Transfers only take place for the purposes described in this policy, and analytics and advertising transfers only happen after you have given the matching consent.

6. How long we keep your data

• Account data: for as long as your account is active. You can delete your account at any time — from the Account page on the website, or the Account tab in the app. Deletion is immediate and permanent.
• Practice progress: deleted when your account is deleted.
• Push notification token: deleted when your account is deleted, and automatically discarded once the device stops accepting notifications (for example after you uninstall the app or turn notifications off).
• Crash reports: retained by Firebase Crashlytics for up to 90 days, then deleted automatically.
• Speaking recordings: never sent to us, so there is nothing on our side to retain. They live only in the app's storage on your device and go when you uninstall it.
• Contact messages: up to 2 years, then deleted.
• Page view data: retained for as long as reasonably needed for reporting and product improvement.
• Advertising and consent records: kept in line with our consent platform settings, legal obligations, and advertising provider requirements.

7. Your rights

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to stop processing your data in certain circumstances
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email us at ykitestprep@gmail.com. We will respond within 30 days.

If you believe we have handled your personal data unlawfully, you also have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi. If you live in another EU/EEA country you may complain to your own national supervisory authority instead.

8. Data security

All data is transmitted over HTTPS. Passwords are never stored in plain text — Supabase Auth uses bcrypt hashing. Access to the database is restricted by row-level security policies.

9. Children

YKI Test Prep is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page will always reflect the most recent version. Continued use of the website or the app after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests: ykitestprep@gmail.com