Privacy Policy

1. Overview

OC Study ("we," "us," or "our") operates the SAT preparation platform available at ocstudy.com (the "Service"). This Privacy Policy applies to all users of the Service, including students and their parents or guardians.

We collect only the information necessary to provide the Service. We do not sell your personal data. We do not use student data for behavioral advertising. We do not share your information with third parties except as described in this Policy.

2. Information We Collect

Information you provide

Information we collect automatically

• Usage data: Questions answered, scores, time spent, sessions, streaks, and performance trends
• Device data: Browser type, operating system, screen size, and general device type
• Log data: IP address, access timestamps, pages visited, and error events
• Visitor counts and approximate location: On our public pages (home, pricing and journal) we count visits by IP address, once per day per page, and look up the approximate city and country of the IP address using a database stored on our own server (IP geolocation by DB-IP). We also measure how long the page stays open in a visible browser tab (a small signal about every 15 seconds while you are on the page; nothing you click, scroll or type is recorded). The IP address is not sent to anyone else. We use this only to understand where our visitors come from. These records are deleted after 180 days, and are not collected when your browser sends a Do Not Track signal.
• Free practice demo: If you try the free SAT practice demo without an account, we record your IP address and approximate location, the questions you answered, your answers, how long each question took, the page you started from and your browser type, and the email address if you choose to leave one. We use this to understand how the demo is used and to improve it; it is never shared, is kept for 180 days, and is not collected when your browser sends a Do Not Track signal. If you then create an account from the result page, your demo round is connected to that account.
• Cookies and local storage: Session tokens and preference settings (see Section 11)
• Email engagement: Whether an email we sent was opened or a link in it was clicked, measured with a small tracking image and tracked links. We use this only to see whether our emails are useful and to improve onboarding. Unsubscribing from optional emails stops those emails and their tracking.
• Session replay (off by default): To troubleshoot a problem, an administrator can temporarily turn on a recording of how a student's screen is used in the study app (clicks, scrolling, typed answers). Recordings never include passwords or payment details, are stored only on our own servers, are never shared, and are deleted automatically after 14 days.
• Purchase-page interaction analytics: On our pricing page and the parent billing page we record, with our own first-party script, where visitors click, how far they scroll, which sections they view and for how long, which plan or student they select, whether a promo code was accepted, and any error message shown. We use this only to find out what makes the pages confusing and to improve them. We do not record keystrokes, promo code text, card details or anything typed into Stripe. The data is tied to a random browser identifier (and to your parent account when you are signed in), is kept for 180 days, is never shared, and is not collected when your browser sends a Do Not Track signal.

We do not collect sensitive data such as Social Security numbers, government ID, financial account numbers, or biometric data.

3. How We Use Your Information

We use the information we collect solely to provide, maintain, and improve the Service:

• Create and manage your account
• Deliver personalized practice questions and study plans
• Track progress, identify weak areas, and predict score ranges
• Process payments and manage subscriptions
• Send transactional emails (account confirmation, password reset, subscription receipts)
• Respond to support inquiries
• Detect, investigate, and prevent fraud or abuse
• Comply with legal obligations

We do not use your data for targeted or behavioral advertising, nor do we build advertising profiles from student activity.

4. Children's Privacy (COPPA Compliance)

For students under 13 ("children"), we require verifiable parental consent before collecting any personal information beyond what is strictly necessary to obtain that consent. Specifically:

• Children under 13 cannot sign up on their own. Their account is created by a parent or guardian from the parent dashboard, which is how we obtain verifiable parental consent. We ask for the child's name, email address, grade, and date of birth so that we can apply these protections
• We collect only the minimum data necessary to provide the educational Service
• We do not disclose children's personal information to third parties except as permitted by COPPA (service providers operating on our behalf under a confidentiality obligation)
• We do not use children's data for advertising or to build marketing profiles
• AI-powered study features are part of the Service for every student. The parent or guardian who creates or approves a child's account consents to their use, and can withdraw that consent at any time by asking us to close the account (see our Terms, Section 10)

If you believe your child has provided personal information without parental consent, contact us immediately at privacy@ocstudy.com and we will delete it promptly.

5. Parental Rights & Access

Parents and guardians of minor users have the right to:

• Review the personal information collected about their child
• Correct inaccurate information
• Delete their child's account and associated personal data
• Refuse further collection or use of their child's data
• Withdraw consent at any time by asking us to close the child's account

To exercise these rights, email privacy@ocstudy.com from the email address associated with your parent account. We may request identity verification before fulfilling requests to protect student data.

Requests will be fulfilled within 30 days. Deletion of a child's account will result in permanent removal of their personal data from our active systems, subject to our retention policy for legal and safety obligations.

6. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

Service providers

We may share data with trusted third-party vendors who assist in operating the Service. Such as payment processors, email delivery services, and analytics tools. These providers access your data only to perform services on our behalf and are contractually prohibited from using it for any other purpose.

Legal requirements

We may disclose information if required to do so by law, court order, or governmental authority, or to protect the rights, property, or safety of OC Study, our users, or the public.

Business transfers

If OC Study is acquired, merges with, or transfers substantially all its assets to another entity, user data may be transferred as part of that transaction. We will notify users via email or a prominent notice on the Service in advance of any such transfer.

Aggregate data

We may share de-identified, aggregated data (e.g., "X% of students improved their math score within 4 weeks") that cannot reasonably be used to identify any individual.

7. No Behavioral Advertising

We do not use student data, including data from users under 18, to deliver behavioral or targeted advertising. We do not allow third-party ad networks to collect data from students on our platform.

We do not build advertising profiles from student performance data, browsing history, or usage patterns. Any communications we send users are transactional (e.g., receipts, password resets, study reminders) or directly related to the educational Service.

8. AI Features & Data Use

OC Study uses AI and machine learning to analyze your performance data and generate personalized study plans, identify skill gaps, and predict score improvement trajectories. This processing occurs within our platform and uses only your own activity data.

We do not use student performance data to train commercial AI models for sale or licensing to third parties. AI analysis is performed solely to improve your individual experience within the Service.

AI-powered personalization is part of the Service for every student. Students under 18 use it with a parent or guardian's permission, and a parent who creates, links to, or approves a student account consents to it on the student's behalf (see our Terms, Section 10). Parents may opt out at any time.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you close your account:

• Personal profile data (name, email, DOB, grade) is deleted within 90 days
• Performance and usage data may be retained in de-identified, aggregated form for service improvement
• Billing records are retained for 7 years to comply with financial regulations
• Data may be retained longer if required by law or for pending legal matters

For children's data specifically, we do not retain personal information longer than reasonably necessary to fulfill the educational purpose for which it was collected.

10. Security

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, loss, misuse, or alteration. These include:

• Encrypted data transmission (HTTPS/TLS)
• Hashed and salted password storage. We never store passwords in plain text
• Session token authentication with automatic expiration
• Access controls limiting data access to authorized personnel only
• Regular security reviews

No method of transmission over the internet or electronic storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. If you suspect your account has been compromised, contact us immediately at support@ocstudy.com.

11. Cookies & Local Storage

We use a small number of essential cookies and local storage tokens to operate the Service:

• Session cookie: A secure, HttpOnly cookie keeps you signed in (some pages also keep a copy of the session token in local storage). Sessions expire after inactivity or when you sign out.
• Preference settings: Local storage remembers choices such as your language, theme, and selected tab.

We do not use third-party advertising cookies, cross-site tracking cookies, or any cookies for behavioral profiling. We do not currently use analytics cookies that share data with third parties.

You can clear cookies and local storage at any time through your browser settings. This will log you out of the Service.

Do Not Track

We honor browser Do Not Track (DNT) signals. When DNT is enabled, we limit data collection to what is strictly necessary to operate the Service and do not engage in cross-site tracking. Because our Service does not engage in behavioral advertising, DNT has minimal practical impact on your experience.

12. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and personal data
• Portability: Request your data in a portable format
• Objection: Object to certain processing of your data
• Restriction: Request we limit processing in certain circumstances

To exercise any of these rights, email privacy@ocstudy.com with your request. We will respond within 30 days. We may verify your identity before fulfilling your request.

We will not discriminate against you for exercising your privacy rights.

13. FERPA

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records at institutions that receive federal funding. OC Study is not a school or educational institution and does not receive federal education funding, so FERPA does not directly govern our platform.

However, we voluntarily align with FERPA's principles: we treat student performance data as confidential educational records, we do not share it without parental or student consent (as applicable), and we support parents' and eligible students' rights to access and correct their own data.

14. State-Specific Privacy Rights

Depending on the state you reside in, you may have additional privacy rights under applicable state law. We honor these rights regardless of whether your state's law technically applies to us, because we believe privacy is a right, not a compliance checkbox.

California (CCPA / CPRA)

California residents have the right to: (a) know what personal information we collect, use, disclose, and sell; (b) delete personal information we hold; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information; (e) limit use of sensitive personal information; and (f) non-discrimination for exercising these rights. We do not sell personal information, including information about minors, and we do not share it for cross-context behavioral advertising. California residents may also request information under the "Shine the Light" law (California Civil Code § 1798.83) about categories of personal information disclosed to third parties for their direct marketing purposes. We do not make such disclosures. Submit California-specific requests to privacy@ocstudy.com with the subject line "California Privacy Request."

Virginia, Colorado, Connecticut & Other State Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with active consumer privacy laws have the right to access, correct, delete, and obtain a portable copy of their personal data, as well as to opt out of targeted advertising and the sale of personal data. We do not engage in either practice. To submit a request, email privacy@ocstudy.com. We will respond within 45 days (extendable by an additional 45 days with notice). If we deny your request, you have the right to appeal by emailing us with the subject line "Privacy Rights Appeal."

Nevada

Nevada residents may opt out of the "sale" of personal information under Nevada SB 220. We do not sell personal information as defined under Nevada law, but you may submit a verified opt-out request to privacy@ocstudy.com.

International Users

Our Service is directed at users in the United States. If you access the Service from outside the United States, your data will be processed in the US and subject to US law. We do not target or knowingly collect data from individuals in the European Economic Area or United Kingdom. If you are located in such a jurisdiction and believe your data has been collected, contact us for deletion.

15. Data Breach Notification

In the event of a data breach that compromises personal information, we will:

• Notify affected users and, where applicable, parents or guardians of affected minor users within 72 hours of discovering the breach, or as soon as reasonably practicable given the circumstances
• Notify relevant regulatory authorities as required by applicable state and federal law
• Notify any linked school districts or institutional partners whose students' data was affected
• Provide a clear description of: (a) the nature of the breach; (b) categories and approximate number of records affected; (c) likely consequences; (d) measures taken or proposed to address the breach

We will not delay breach notification on the grounds that an investigation is ongoing unless law enforcement specifically requests a delay. Breach notification will be sent to the email address on your account and/or posted prominently within the Service.

16. Third-Party Links & Services

Our Service may contain links to third-party websites, tools, or resources (such as College Board, Khan Academy, or other educational reference sites). These links are provided for your convenience and do not constitute an endorsement. We have no control over the content, privacy practices, or data collection of third-party sites, and this Privacy Policy does not apply to them.

We encourage you to review the privacy policy of any third-party site before providing personal information. We are not responsible for the privacy practices or content of any third party.

Any third-party service providers we engage to operate our Service (payment processors, email delivery, etc.) are bound by contractual obligations to process data only as directed by us and to maintain appropriate security measures. We do not allow service providers to use your data for their own purposes.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, particularly changes that affect how we handle children's data, we will notify you by email and/or by displaying a prominent notice within the Service at least 14 days before the changes take effect.

For changes that require fresh parental consent under COPPA, we will obtain that consent before the change takes effect for accounts with users under 13.

The date at the top of this page always reflects when this Policy was last updated.

18. Contact Us

For privacy-related questions, data requests, or COPPA concerns, please contact us: