Privacy Policy

1. Introduction

MaxYourScore ("we," "us," or "our") operates the website maxyourscore.com and related services (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the choices you have.

The Service is an AP® exam-prep product for students aged 13 and older. Many of our users are under 18, so this policy is written to be read by students and by their parents or guardians. The Service is sold directly to students and families, not to schools.

2. Information We Collect

2.1 Information You Provide

• Account information: Your name, email address, and password when you create an account. We store the password only as a salted hash, never the password itself. If you sign in with Google or Apple instead, we receive your name and email address (and, from Google, your profile picture) from that provider and store the sign-in tokens it issues; we never see your Google or Apple password.
• Age band: At sign-up we ask for your birth month and year. We use them once to work out an age band (13–15, 16–17, or 18+) and store only that band and the time you gave it. The birth month and year are not stored. If you already had an account before this step existed, you are asked once, the next time you sign in.
• Acceptance of our terms: When an account is created we record which version of the Terms of Service and this Privacy Policy was accepted, and when.
• Profile and preferences: The AP subjects you select, an optional bio and profile picture, the display alias used on leaderboards, your time zone as reported by your browser (so streaks and due dates follow your local day), and settings such as your daily study goal, font size, and notification choices.
• Onboarding details: The grade level and target scores you enter during onboarding. Today these stay in your browser's storage on your device and are not sent to our database.
• Study data: Quiz answers and scores, practice exam answers (including written free-response answers) and scores, note-packet responses, flashcards and their review schedule, study plans and the exam dates in them, video progress, bookmarks, study sessions, diagnostic results, points, streaks, and achievements.
• Content you send to AI features: Messages to the AI tutor, written answers and essays you submit for AI feedback, text you give to AI study tools, and photos you submit to the photo tool. See Section 5.
• Social features: Friend connections, study groups you create or join, challenges, and any reports you file about content, another user, or a group.
• Payment information: Payments are handled by Stripe. We do not receive or store your card number. We store the Stripe customer and subscription identifiers for your account, your plan, its status, and its renewal date.
• Referrals: If you sign up through a friend's referral link, we record which referral code was used.
• Communications: Messages you send through our contact and feedback forms or by email.

2.2 Information Collected Automatically

• Log data: For each request, our hosting provider records your IP address, browser type, the time, and the page or data requested. We also use your IP address to limit repeated requests, such as sign-up and sign-in attempts.
• Error reports: When something breaks, an error report is sent to Sentry whether or not you accept analytics. See Section 8.
• Product events on our own servers: We record a small number of events in our own database, such as a checkout being started or a purchase completed, linked to your account ID, so we can see whether the Service is working. These are not sent to PostHog and do not use cookies.
• Product analytics: Pages visited and interaction patterns are collected only if you accept analytics cookies. See Section 8.
• Cookies and browser storage: We use essential cookies for sign-in and security, browser storage for your preferences, and analytics cookies only with your consent. See Section 8.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service.
• Personalize your studying through spaced-repetition scheduling, score estimates, and AI tutor replies.
• Process payments and manage subscriptions.
• Send account and billing email, such as verifying your address, resetting your password, and notices about your account or subscription.
• Understand how the Service is used so we can improve it. Analytics that follows your browsing runs only if you have accepted analytics cookies.
• Respond to support requests and other messages you send us.
• Prevent fraud and abuse, keep the free trial to one per person, and keep the Service secure.

We do not use your information for targeted advertising, and the Service does not show third-party ads.

4. How We Share Your Information

We do not sell your personal information. We share it only in the following cases:

• Service providers: The companies in the table below run parts of the Service for us and receive the data listed. Each one handles that data under its own terms and privacy policy.
• Other students, through social features you use: Leaderboards show a display alias rather than your name, and you can opt out of them. Study groups are invite-only, and member names are visible only to other members of the group. Friends you have accepted can see study activity such as quiz scores, achievements, levels, and challenge results.
• Legal requirements: If required by law, regulation, or legal process.
• Safety: To protect the rights, property, or safety of MaxYourScore, our users, or others.

Service providers that receive personal data

5. AI Features, Voice, and Photos

What is sent to the AI provider

The AI tutor, AI feedback on written answers, the photo tool, and the AI study tools work by sending what you submit to Anthropic, our AI provider, which generates the response. That includes the text you type (questions, essays, and tutor messages) and any image you submit. Anthropic processes this content as our service provider under Anthropic's Commercial Terms of Service, the agreement that governs content sent through its API.

We do not use your content to train AI models ourselves.

What we store

Conversations with the AI tutor are saved to your account in our database so you can come back to them. This includes conversations in the tutor widget, the Voice Tutor, Language Practice, and the photo tool, stored as text only (your photos are not stored, see below). We keep at most 100 conversations, or 10 MB, per account; beyond that, the conversations you have gone longest without using are removed.

Photos

A photo you submit to the photo tool is sent to Anthropic to generate the response. We do not store the photo: our server passes it on for that one request and does not save it to our database or file storage.

Voice

Voice input in the Voice Tutor and Language Practice uses your browser's speech recognition. Depending on your browser, the audio may be sent to the browser vendor's speech service (for example Google for Chrome or Apple for Safari) to be turned into text. MaxYourScore receives only the resulting text, which is sent to Anthropic like any typed message, and does not record or store audio. Replies are read aloud by your browser's built-in text-to-speech. Voice input is optional; you can type instead.

Accuracy

AI responses can be wrong. See our Terms of Service for how AI-generated content should be used.

6. Children and Teens

• The Service is for users aged 13 and older. Sign-up, whether by email or with Google or Apple, includes a neutral age step that asks for birth month and year.
• We do not keep accounts for children under 13. If the age step shows that someone is under 13, no account is kept. If we learn that an existing account belongs to a child under 13, we delete it. A parent or guardian who believes their child under 13 has an account can write to privacy@maxyourscore.com.
• An account whose age band is under 18 never gets PostHog product analytics or Sentry Session Replay, whatever was chosen in the cookie banner. Before you sign in we do not know your age, so on public pages the banner choice applies.
• Users under 18 need the permission of a parent or legal guardian to use the Service. See our Terms of Service.
• We do not use student data for targeted advertising, and we do not sell it.
• Parents and guardians can ask us to show, correct, or delete their child's data by contacting us.
• We sell the Service directly to students and families. We do not currently provide it to schools or school districts under contract.

7. Data Security

The measures we rely on include:

• Connections to the Service use HTTPS (TLS).
• Passwords are stored only as salted hashes; we never store the password itself.
• Payment card details are entered on Stripe's pages and never reach our servers.
• Lesson media is served through short-lived signed links rather than public addresses.
• Sign-in sessions end after 14 days without a visit, and you can sign out of all devices from Settings.
• Access to our production systems is limited to the people who operate the Service.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Cookies and Tracking

We use the following types of cookies and similar storage:

• Essential Cookies: Required for authentication, session management, and security. These cannot be disabled. Your sign-in session lasts 14 days after your last visit; after that you need to sign in again. After a password sign-in, a security cookie remembers for up to 180 days that this browser has signed in before. If the age step at sign-up is not passed, a cookie lasting one day stops the form from being resubmitted straight away; it records no identity and no date. If you arrive through a referral link, a cookie remembers the referral code for 30 days.
• Functional Storage: Remembers your preferences such as theme settings, study preferences, and your analytics cookie choice.
• Analytics Cookies (optional): We use PostHog to understand how the Service is used so we can improve it, and Sentry performance tracing and Session Replay to see what is slow or what went wrong when a page breaks. All of these run only after you click Accept in our cookie banner. If you click Decline or ignore the banner, PostHog is never loaded, no performance traces are sent, Session Replay never starts, and no analytics cookies are set; any PostHog identifier left from an earlier visit is removed.

Accounts under 18 are treated more strictly: while you are signed in to an account whose age band is under 18, PostHog and Session Replay stay off even if Accept was clicked in the banner.

Error monitoring

To keep the Service working, we send error reports to Sentry whether or not you accept analytics: the error message, the page address (with sign-in links, codes, and tokens removed), your browser and operating system, and the steps that led to the error. Error reports do not set cookies and do not include performance traces or recordings unless you have accepted analytics.

What PostHog collects when you accept

• Pages you visit and the page you came from, with sign-in links, codes, tokens, and email addresses removed from web addresses.
• Browser, operating system, device type, screen size, and approximate location derived from your IP address.
• A random identifier stored in a first-party cookie and local storage so visits can be counted.
• Clicks on our public pages (such as the home, pricing, and subject pages), with the text and attributes of what you clicked hidden. Clicks inside the study app — lessons, quizzes, practice exams, study tools, your dashboard, and settings — are not recorded.

What Sentry performance tracing records when you accept

For about 1 in 10 visits, Sentry performance tracing records how long pages take to load, the pages you move between (with sign-in links, codes, and tokens removed), the timing of requests the page makes to our servers, and how quickly the page responds when you click or type — including a short technical description of the element you used, such as its type, name, or label. This covers pages inside the study app too. It does not record what you type or your quiz and exam answers, and it does not set cookies.

What Sentry Session Replay records when you accept

For about 1 in 10 visits, and for the minute before an error, Sentry Session Replay records the layout of the pages you view — including pages inside the study app — along with your clicks, scrolling, and page changes, so we can reproduce problems. All text on the page is replaced with placeholder characters and all images, video, and audio are blocked before anything leaves your browser, so a replay does not show your name, what you type, or your quiz and exam answers. Replay keeps a session record in your browser's session storage (sentryReplaySession), which is removed when you withdraw consent.

Analytics never captures what you type or your quiz and exam answers.

Changing your choice

You can change or withdraw your choice at any time using the "Cookie settings" link in the site footer or this button: Cookie settings. Withdrawing consent stops analytics, performance tracing, and Session Replay immediately and removes the PostHog identifier from your browser.

We honor Global Privacy Control and Do Not Track: if your browser sends either signal, analytics stays off and cannot be turned on in that browser.

We do not use third-party advertising cookies or trackers.

9. Data Retention and Deletion

We keep your account and study data for as long as your account exists. Saved AI tutor conversations are limited as described in Section 5.

Deleting your account

You can delete your account yourself at any time from Settings. Deleting it removes your account and the study data attached to it from our database right away, including quiz and exam attempts, notes, flashcards, progress, saved tutor conversations, and friend connections.

A few records are kept after deletion, without your name or email address:

• Reports you sent about content stay in our review queue, no longer linked to your account. Reports about users or groups, and our administrators' audit log, keep internal account IDs and the alias or text that was reported.
• To keep the free trial to one per person, we keep a keyed one-way hash of the email address, and of the card fingerprint Stripe gives us, for anyone who has used a trial. The address and card cannot be read back from it.
• Product events recorded on our own servers (Section 2.2) are kept with the account ID removed. Product events are deleted 400 days after they were recorded, whether or not the account still exists.

When you delete your account we cancel any active subscription and ask our payment processor, Stripe, to remove your name and email address from your billing customer profile. Stripe keeps that profile, and the invoices, receipts, and payment records Stripe keeps for tax, refund, and dispute purposes still show the name and email address used at purchase. To have those records removed too, contact us at the address below.

Copies held by service providers and in backups

Deleting your account does not immediately remove every copy held outside our live database. Those copies go on their own schedules:

• Error reports at Sentry and request logs at our hosting provider age out under each provider's retention period.
• Records of email we sent you are kept by Resend for its retention period.
• Analytics events at PostHog, if you accepted analytics, are stored under a random identifier rather than your account and age out under PostHog's retention period.
• Content sent to Anthropic for AI responses is kept and deleted by Anthropic under that agreement and its own retention schedule.
• Stripe keeps payment records for as long as the law requires.
• Encrypted backups of our database are kept for no more than 90 days and then removed, so a deleted account drops out of our backups within 90 days.

10. Your Choices and Rights

• Download your data: "Download your data" in Settings gives you a machine-readable file of the account and study data we hold about you.
• Correct your data: You can change your profile details in Settings.
• Delete your account: You can delete your account from Settings. Section 9 explains what happens.
• Analytics: You can change or withdraw your analytics choice at any time from "Cookie settings".
• Leaderboards: You can opt out of appearing on leaderboards.

Depending on where you live, you may have further legal rights over your personal information, such as the right to object to or restrict certain processing. To make a request that the controls above do not cover, or if you are a parent or guardian asking about your child's account, contact us at privacy@maxyourscore.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

• Email: privacy@maxyourscore.com
• Support: maxyourscore.com/contact