Privacy Policy

This Privacy Policy explains what personal data SQEpractice (the “Service”, “we”, “us”) collects when you use sqe-practice.com, why we use it, who we share it with and what your rights are. It applies whether you use guest mode or a registered account. Please also read our Terms of Service.

Who we are

SQEpractice is the controller of the personal data described in this policy. This means we decide how and why it is used. You can contact us about privacy at support@sqe-practice.com or through the Support page.

Information we collect

Account information

When you register with an email address, we collect your email address and password. We store your password only in a hashed form that we cannot read back. If you add a name in Settings, we store it as your display name.

Sign in with Google

If you choose to sign in with Google, Google gives us your email address, your name and a link to your profile picture. We do not receive your Google password.

Study plan

If you set up a study plan, we ask when you expect to sit SQE1, which papers you are preparing for, whether this is your first attempt or a resit, and how many hours a week you can study. We use this to build your plan.

Guest mode

When you start guest mode, we create a guest account so your progress can be saved. We do not ask for your name or email address. Cloudflare Turnstile checks that a real person, not a bot, is starting the session. If you register later, your progress moves to your new account.

Practice and performance data

As you use the Service, we record your answers, the time you take, the confidence you record, your scores and mock results, your mistakes and when they are due for review, flashcard reviews, bookmarks, notes, study plan progress and points. We use this to run the features you use: marking, mock reports, mistakes review, analytics, your study plan and your predicted SQE1 score. If you report a problem with a question, we keep your report so we can fix the question.

AI term explanations

When you use Explainon a word or phrase, we send Anthropic the text you selected (up to 80 characters), the sentence it comes from (up to 600 characters) and the language you chose. Anthropic’s Claude model writes the explanation and returns it to us. We do not send your name, email address or account details to Anthropic.

We save each explanation against the term and language, not against you, and may show it to other users who look up the same term. We also record which terms you looked up and when, so we can apply daily limits.

Payment data

When you buy an access pass, you pay on a Stripe Checkout page. Stripe collects your card details. We never see or store your full card number. From Stripe we receive and keep what you bought, the amount you paid, the payment status and date, and Stripe’s reference numbers for the payment and for you as a customer.

Support requests

When you contact us, we receive your email address and your message, including its category and subject. We use them to reply. Messages sent through the Support page reach us by email through our email provider, Brevo.

How we use it and why

UK data protection law requires a lawful basis for each use of your data. We rely on:

• Contract— to create and run your account, provide practice, mocks, analytics, your study plan and AI term explanations, sell and provide access passes, and send the emails you need to use the Service, such as address verification, password resets and purchase confirmations.
• Legitimate interests— to keep the Service secure and prevent abuse, to understand how the Service is used and which sources bring visitors so we can improve it, to run the leaderboard, and to send the study and offer emails described in Emails we send. We only do this where your interests and rights do not override ours. You can object at any time, and every one of those emails has a one-click unsubscribe link.
• Legal obligation— to keep payment and accounting records.
• Advertising measurement— we use the Google Ads tag to see which of our Google ads bring visitors and sign-ups. We rely on our legitimate interests in knowing whether our advertising works. See Cookies and browser storage for how to limit it.

We do not sell your personal data. We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Your predicted score is an automated estimate shown only for your own information.

Emails we send

When you create an account, we tell you that we may email you study reminders and the occasional offer about SQEpractice, and that you can unsubscribe at any time. You do not have to tick anything. We send two kinds of email beyond the ones your account needs:

• Study reminders— a few short emails in your first week (what is free and where to start, your mistakes coming back for review, where you stand), a Sunday summary of your week, an occasional evening reminder when your streak is about to end, and, if you choose it or hold a pass, a morning plan for the day.
• Tips and offers— our own offers about SQEpractice, such as the welcome discount after your first set and what a pass adds.

If your account was created before we showed this notice, we send neither kind unless you switch it on in Settings. If you hold a pass, we also email you once, about two weeks before it ends, whatever these switches say: that email is about access you paid for, not an offer.

We send at most one of these emails a day, only to an address you have verified. Study reminders stop if you have not used the Service for three weeks. We base them on how you use the Service, for example the questions you got wrong or your next free step. We never sell your address or send emails on behalf of anyone else.

Every one of these emails has an unsubscribe link that works without signing in, and your email app’s own unsubscribe button works too. You can switch each kind on or off in Settings. Emails your account needs — address verification, password resets and purchase confirmations — are not marketing and always arrive.

What other users can see

If you have a registered account, your display name, points and rankappear on the leaderboard, where other users can see them. If you have not set a display name, we show “Learner” followed by a short code instead. Guests are not ranked. Your email address is never shown.

Your display name is the name in your Settings. You can change it at any time. Use a nickname if you would rather not show your real name.

Cookies and browser storage

We use a small number of first-party cookies and browser storage items, and Google’s advertising tag, described below.

Cookies

• sqe_access— keeps you signed in. It is HttpOnly, so scripts on the page cannot read it. It lasts 15 minutes and is renewed while you use the Service.
• sqe_refresh— renews your sign-in. It is HttpOnly and is sent only to our sign-in endpoints. It lasts 30 days.
• sqe_presence— a random ID used only to count how many people are online. It is HttpOnly and lasts 180 days. Our server deletes each presence record about 30 minutes after your last activity.
• sqe_registration_source— if you arrived from a recognised source, such as Google, Reddit or YouTube, this holds the name of that source for 30 days. If you register, we note the source on your account. It holds no personal details.
• sqe_ref— if you arrive through a referral link, this holds that link’s code for 30 days so we can record which link you came from if you register. It is HttpOnly.

The two sign-in cookies are strictly necessary. The others above are used only for our own measurement. Cloudflare, which delivers our website, may also set strictly necessary security cookies to protect it from attacks and bots.

Google Ads

Google’s advertising tag (gtag.js) runs on our pages, except the password-reset and email-verification pages. Google may set cookies such as _gcl_au (about 90 days) on our site, and its own cookies on Google domains. They link a click on one of our Google ads to the visit and sign-up that follow and, if you are signed in to Google, can be used to tailor the ads you see. Google receives your IP address, the pages you visit and details of your browser. You can limit personalised ads at adssettings.google.com, and you can block or delete these cookies in your browser without affecting the Service.

Browser storage

• sqe.anonymousId— a random ID created in your browser. It is sent with page-view events so we can count unique visitors. It stays until you clear your browser storage.
• sqe.trafficAttribution— the source that brought you to the Service and when. It is kept for 30 days.
• Settings such as whether you have seen the product tour, your Explain language and your keyboard shortcuts, and marks you make on a question during a session. These stay in your browser.

You can delete cookies and clear site storage in your browser at any time. The Service keeps working without them, except that you will need to sign in again.

Analytics and logs

We use our own first-party analytics. When you open a page, we record the page path (never the query string), the anonymous ID from your browser, the source that brought you if we know it, the time, and your account if you are signed in. We also record key actions, such as signing up, signing in, starting a practice session or mock, starting checkout and setting up a study plan. We use this to understand how the Service is used and to improve it.

We delete these product events after 180 days. Apart from the Google Ads tag described in Cookies and browser storage, we do not share your activity with advertising networks.

Our hosting providers keep basic server logs, which can include your IP address. We use them for security, to prevent abuse and to fix problems. They are kept for a limited period and then deleted.

Service providers

We use a small number of trusted providers to run the Service. Each one receives only the data it needs for the purpose below:

• Stripe— takes payments for access passes. Stripe also uses some payment data as an independent controller, for example to prevent fraud and meet its own legal duties.
• Brevo— sends our emails, such as verification, password reset, purchase, study and offer emails, and delivers support messages to us. It receives your email address and the content of each email.
• Anthropic— writes AI term explanations using its Claude model. It receives the selected text, the sentence around it and the chosen language, but not your name, email address or account details.
• Google— provides Sign in with Google, if you choose to use it, and Google Ads, which measures how our ads perform (see Cookies and browser storage).
• Cloudflare— hosts and delivers our website through its network, and runs Turnstile bot protection when you start guest mode. It processes your IP address and technical request data.
• Railway— hosts our backend servers and the database where your account and practice data are stored.

International data transfers

Some of our providers process data outside the UK, for example in the United States or the European Union. When they do, we rely on safeguards recognised by UK data protection law, such as adequacy regulations or approved contract clauses.

How long we keep data

• Account, study plan and practice data— for as long as your account exists. It is deleted when you delete your account.
• Guest accounts— kept so you can come back to your progress. You can ask us to delete a guest account at any time.
• Product analytics events— 180 days. If you delete your account, events are no longer linked to it.
• Presence records— about 30 minutes after your last activity.
• Record of your AI look-ups— for as long as your account exists. Saved explanations are not linked to anyone.
• Payment records— kept after your account is deleted, for as long as tax and accounting law requires (usually six years).
• Support messages— for as long as we need them to deal with your request and any follow-up.
• Cookies and browser storage — as described in Cookies and browser storage.

Deleting your account

You can delete your account at any time in your Settings. This permanently deletes your account and the practice data linked to it. It also ends access to any pass on the account. Deleting your account does not give a refund by itself, so please contact support first if you want one. We keep payment records as explained above.

Your rights

Under UK data protection law, you have the right to:

• Get a copy of the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Have your data deleted.
• Ask us to restrict how we use your data.
• Object to how we use your data, including for any marketing.
• Receive your data in a portable format.
• Withdraw your consent at any time, where we rely on consent.

You can update your details and delete your account in Settings. For anything else, email support@sqe-practice.com or use the Support page. We will reply within one month. We may need to confirm your identity first.

Children and eligibility

The Service is for people preparing for a professional legal exam. It is not aimed at children, and you must be at least 16 years old to use it. If you believe someone under 16 has given us personal data, please contact us so we can delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it last changed. If we make a significant change, we will tell you in the Service or by email.

Contact and complaints

If you have a question about this policy or how we handle your data, email support@sqe-practice.com or use the Support page.

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.