Privacy policy

This policy covers testlumo.com. It is written to describe what the site actually does, in plain terms, rather than to cover every theoretical possibility.

What we collect

Your email address, when you submit a practice test or ask for a sign-in link. We never ask for your address, your date of birth or any payment details, because we do not need them. We do not ask for your name either — though if you sign in with Google, Google passes us the display name on that account along with the address, and we store it.

Your answers and timings for each test you submit: which option you chose on each question, whether it was correct, and how long you spent on it. This is what your score report is built from.

Nothing else. We do not run advertising trackers, we do not sell data, and we do not build a profile of you across other websites.

Why we collect it

• To score your test and produce your report.
• To email that report to you.
• To keep your past attempts together, so signing in shows all of them.
• To send study tips and news about new practice tests — only if you explicitly ticked the box asking for them.

The marketing box is never ticked for you. Leaving it alone means we will not send you marketing, and you still get your results.

Your score report link

Every report has a permanent address containing a random 128-bit token, for example /results/8a3f…. Anyone holding that link can view that report. That is deliberate, so you can share your score without giving anyone an account.

It also means you should treat the link as private if you would rather not share your score. The pages are excluded from search engines, so they will not turn up in a search for your name, but a link you post publicly is public.

Who else sees it

These services process data on our behalf, and no others:

• Supabase — stores the database holding your attempts and your email address.
• Resend — sends your results email and your sign-in links.
• Vercel — hosts and serves the site, and therefore handles every request you make to it.
• Telegram — receives an alert when a test is submitted. That alert contains the email address used, the test taken and the score.
• Google — only if you choose to sign in with a Google account, in which case Google tells us your email address and the display name on that account.

Telegram is on that list for a reason worth being plain about. The submission alert goes to a Telegram group our team reads, which means it travels through Telegram’s servers on the way. Our reading it there does not make Telegram any less of a third party, and an earlier version of this page said the alert went no further than us. It did.

We do not use analytics, advertising or tracking services, and we do not sell or share your data with anyone for their own purposes.

How long we keep it

Attempts are kept so you can come back to them. If you would like your data removed, email us and we will delete your record and every attempt attached to it, which permanently breaks any report links you have shared. We will confirm once it is done.

Your rights

If you are in the UK or the EU, you have the right to see the data we hold about you, correct it, have it deleted, and withdraw consent for marketing at any time. Withdrawing marketing consent does not affect your results or your access to them. We do not currently send any marketing email at all, and there is no automated unsubscribe page yet — until there is, email the address below and we will act on it by hand.

Cookies

One cookie, tl_student, set when you sign in through an emailed link. It holds your email address and a signature, and it is what keeps you signed in. There are no advertising or analytics cookies, which is why the site has no cookie banner.

Children

The site is intended for people preparing for postgraduate admissions tests and is not directed at children under 16.

Changes

If this policy changes materially we will update the date at the top. Continued use after a change means you accept the updated policy.

Contact

For anything in this policy, including a deletion request, email privacy@testlumo.com.