Privacy Policy

Last updated: September 2026

Topical Vault ("we", "the site") is a revision resource for Cambridge International past papers. This page explains what data the site collects and how it's used. We've written it in plain language rather than dense legal text — if anything is unclear, get in touch using the address at the bottom.

What we collect

You can use the 2025–2026 questions without an account. If you choose to create a free account (to unlock older papers and sync your progress), we store:

• Your email address — to sign you in, confirm your account and send password-reset emails. We never send marketing email and never share or sell your address.
• A username you choose — shown only to you when signed in.
• Your password, if you sign up with email. It is never stored in readable form: our sign-in provider keeps only a salted, one-way hash, and we cannot see it.
• Your revision progress — which questions you've marked "done" and the questions in your custom practice paper — so it's available on any device you sign in on.
• If you use "Continue with Google", Google shares your name, email address and profile picture URL with our sign-in provider. We only use the email address to identify your account.

Without an account, your progress stays only in your browser's local storage on your own device and is never sent to us.

We do not use analytics, tracking pixels or advertising scripts.

Who processes your data

• Supabase provides our accounts and database. Account data and progress are stored in Supabase's Mumbai (ap-south-1) region.
• Google, only if you choose "Continue with Google".
• Cloudflare Turnstile runs a privacy-friendly "are you human?" check on the sign-in, sign-up and password-reset forms to stop automated abuse. It does not use tracking cookies for advertising.
• Hostinger hosts the website. Like any web server, it keeps short-lived access logs that include IP addresses.
• Google Fonts serves the site's fonts; loading them sends your IP address to Google.

Cookies and local storage

We don't use advertising or tracking cookies. When you're signed in we set one strictly necessary, secure, HttpOnly cookie (tv_at) that lets our server check you're signed in before it sends you older question papers. It expires within about an hour and is refreshed automatically while you use the site; signing out removes it. Your sign-in session, progress and preferences (like theme) are kept in your browser's local storage.

Children's privacy

Many of our visitors are secondary-school students. We ask only for the minimum needed to run an account (an email address and a username) — never your real name, school or date of birth. You don't need an account to use the current year's questions. If you're under the age of digital consent where you live, please ask a parent or guardian before creating an account.

Your rights

You can ask us at any time to see, correct or delete your account and everything linked to it (your username and progress are deleted along with the account). Email us from the address on your account using the contact below. Clearing your browser's site data removes anything stored locally on your device.

Changes to this policy

If what we collect changes, this page will be updated and the "last updated" date above will change accordingly.

Contact

Questions about this policy, or about your data: support.easyace@gmail.com.