ExamPal lets you write a real past paper by hand and get it marked. To do that we have to handle some of your information. This page says what, why, and what you can do about it, in plain words.
The short version
- We collect your email and password (or your Google sign-in), and the work you do on papers: your handwriting, typed answers, marks and feedback. You can also try a little marking and Pal without an account. Then a copy of your writing is sent to our servers.
- To mark your writing and to answer Pal, we send your page images and your questions to Google's Vertex AI. We do not use your writing to train models ourselves.
- We use PostHog analytics to count visits and find errors, and to watch a small sample of sessions. We do not sell your information and we do not show ads.
- Work from a visit without an account is deleted 30 days after your device last visited. For an account, email us to see, correct or delete your information.
- If you are under 18, this page is for you too. Ask a parent, guardian or teacher if you are unsure about signing up.
Who we are
ExamPal is a service for students sitting Cambridge exams (IGCSE, O Level, AS Level and A Level). We are the people who decide what happens to your information when you use it.
You can reach us at support@tryexampal.com. Our full company details will be added here.
What we collect and why
When you make an account:
- Your email address, and a password (stored by our sign-in provider, not readable by us), or your Google account's email, and the name and picture Google shares if you choose Google sign-in.
- A name, only if you choose to add one in Settings.
- Answers to the short questions after sign-up: your level, your subjects, the exam series you are aiming for, how many hours a week you can study, where you first heard of ExamPal, and whether you want marketing emails.
- Where you came from: the first page you landed on, the campaign tags in the link you followed, and the website that sent you. Your browser keeps this until you sign up, and then it is saved with your account.
- We do not ask for your date of birth, age, school or phone number.
When you sit a paper or practise a topic:
- Your handwriting, saved as pen strokes (the path of the pen and where on the page it was), so we can mark it and show it back to you.
- Answers you type, the options you pick on multiple choice questions, and what you write in table cells.
- Your marks, the feedback explaining each one, and the dates and times of your attempts.
- Your conversations with Pal, our study helper, including the questions you ask it.
- Your settings, such as your preferred pen and whether Pal sits beside you.
- Reports you send us about a mark or a question, and the note you add.
When you use ExamPal without an account:
- Your writing and typed answers are kept in your browser. When you ask for a mark, or ask Pal, the pen strokes and answers for that paper are sent to our servers, because the marker and Pal need to see them. They are kept there under a random code for your device, not under your name.
- Our server gives your browser a random device code, signed so it cannot be forged. We use it to count the free marks and Pal questions your device has used, and to find your work again.
- We keep a scrambled (hashed) version of your network address, so that nobody can use up the free allowance by clearing cookies, and we keep what kind of browser you use, such as a normal browser or an automated script. We do not store your network address itself, and the scrambling cannot be turned back into it.
On every visit, signed in or not:
- Analytics: which pages you open, what kind of device and browser you use, roughly where you are, errors you hit, and steps such as opening a paper, starting practice or opening the price page. We do not put your email, your name, your answers or what you type to Pal into analytics.
- Visits are also recorded as a replay of what happened on the page, starting after the first 15 seconds, and any visit that opens the checkout is recorded. On a paper, the replay shows the question page, your handwriting and the answers you type, so we can check that marking is accurate. Sign-in, payment and account fields are hidden, and so is the Pal conversation.
- Ordinary server logs, such as your network address and the time of a request, which our hosting and cloud providers keep to run and protect the service.
We use this to run the service you asked for: to let you sit papers, mark them, show your progress and bring you back to where you left off. We also use it to keep the service working and safe, for example to fix errors and stop misuse, and to understand which parts of ExamPal are used so that we can improve them.
You can browse and sit public past papers without an account. Sitting one by itself sends us nothing about your writing. It is sent when you ask for marking or ask Pal (see Cookies and local storage).
How AI marking uses your writing
When you hand in a paper, or ask for a mark on a part, we turn your page into an image and send it, with the question and its official mark scheme, to Google's Vertex AI (the Gemini models). The model reads your working and says which marks you earned and why. Pal works the same way: what you ask it, the question you are on, and your working on the page where that helps, are sent to the model to produce an answer. This is the same with and without an account.
- We use it only to mark your work and to answer you. We do not use your writing, answers or conversations to train or improve any model ourselves.
- The marking runs through Google's global Vertex AI service, so your page image may be processed outside the region where we store your account data.
- The model can get a mark wrong. If you think it has, tell us at support@tryexampal.com.
Google handles that data under its own terms for Google Cloud, which also apply.
How long we keep it
With an account, we keep your account and your work for as long as you have an account, so you can look back at old papers and see your progress. We have not set automatic deletion periods for accounts yet, and we will not keep your information longer than we need it.
There is no delete button that works yet. To delete your account or any of your work, email support@tryexampal.com. When an attempt is deleted, its pen strokes, typed answers, marks and Pal conversation go with it.
Without an account, the copy of your writing and Pal conversation on our servers is deleted 30 days after your device last visited. The device code and its allowance counts are deleted 365 days after your device last visited, and the counts kept for each scrambled network address after 30 days. The copy in your own browser stays until you clear your browser's site data for ExamPal.
We have not set a deletion period for feedback reports, email records, or analytics and replays held by PostHog. Payment records are held by Paddle.
Your rights
Wherever you live, you can ask us what we hold about you, to correct it, or to delete it. If you are in the UK or the EU, the law (UK GDPR and EU GDPR) also gives you the right to:
- get a copy of your information, in a form you can take elsewhere;
- have wrong information corrected;
- have your information deleted;
- ask us to limit how we use it, or object to a particular use;
- withdraw your consent, where we rely on it;
- complain to your data protection regulator. In the UK that is the Information Commissioner's Office (ico.org.uk).
To use any of these, email support@tryexampal.com. We may need to check it is really you first, and we will answer in the time the law allows.
Work from a visit without an account is tied to a random code in your browser, not to your name, so we may not be able to find it for you. It is deleted automatically, as described above.
Children and teenagers
Many students who use ExamPal are under 18. We collect only what the service needs, we do not show ads, and we do not ask for your date of birth, school or phone number. Analytics, described above, apply to every visitor, whatever their age.
Our sign-up does not check your age. If you are young, please ask a parent, guardian or teacher to help you sign up.
If you are a parent or guardian and want to see or delete your child's information, email support@tryexampal.com.
Keeping it safe
Your connection to ExamPal is encrypted. Requests about a signed-in student's work are checked against their sign-in, and attempts are tied to the account. Visitors without an account can reach only the guest part of our server, which uses the device code instead and has daily limits. Passwords are handled by our sign-in provider and are not visible to us. Network addresses are kept only in scrambled form for the guest allowance.
No online service can promise to be perfectly secure. If something goes wrong that affects your information, we will tell you and the regulator where the law says we must.
Changes to this policy
If we change this policy in a way that matters, we will change the date at the top and, for big changes, tell you in the app or by email before it starts.
Contact
Questions, requests or worries about your information: email support@tryexampal.com.