Privacy policy
What we store, why, and how to make us delete it. Written to be read — the plain-language box in each section is not a substitute for the text, but it is accurate.
What we collect
You can take the whole test without giving us anything at all.
Taking a test anonymously requires no account and no personal data. Your answers are scored on our server and the result is returned to your browser; nothing is written to our database unless you are signed in.
If you create an account we store the email address and password you register with (the password as a hash, never in readable form), and optionally the name you want printed on your certificates. Each attempt you finish while signed in is stored with its score, CEFR band, per-skill breakdown, the questions you got wrong, and the time it was taken.
If you write to us through the contact form we store your message, the topic you picked, the question code if you gave one, and your email address if you left one.
Our servers keep standard request logs — IP address, time, page requested — for a short period to spot abuse and to make rate limiting work. These are not joined to your account.
Cookies we set
Four cookies, all of them necessary. Analytics is cookieless, and turning it off means the script is never loaded.
Essential cookies keep you signed in and remember the answer you gave the consent panel. They are set without asking, because the site cannot do those two things otherwise.
Analytics is self-hosted Umami. Its script is loaded only after you switch analytics on, and it sets no cookies and no identifiers of its own — it records the page, the referrer, the screen size and the country, all aggregated. Switching analytics off stops the script being loaded at all.
Preferences — remembering your language track and starting difficulty between visits — is offered in the panel but is not yet implemented: with the switch on, nothing is currently stored. When it ships, the cookies it uses will be listed in this table and the consent version will be bumped, which asks you again.
Results you have not saved to an account live in your browser's session storage, not in a cookie, and are gone when you close the tab.
| Cookie | Purpose | Kept |
|---|---|---|
| ml_consent | Your answer to this panel | 6 months |
| __Secure-authjs.session-token | Keeps you signed in | 30 days |
| __Host-authjs.csrf-token | Protects the sign-in form from forged requests | Session |
| authjs.callback-url | Where to send you back to after signing in | Session |
How we use it
To score your test, to keep your history, and to find bad questions.
Your answers are used to work out your level and to show you what you got wrong. Aggregated across everyone, they also tell us which questions are ambiguous or mis-keyed — that is how the pool gets better, and it is the only profiling we do.
Your email address is used to sign you in and, if you write to us, to answer you. We do not send newsletters, and there is nothing to unsubscribe from.
We do not sell anything to anyone, we run no advertising, and we do not use your answers to train models for third parties.
Who else sees it
Our own servers, and no analytics company.
The site and its database run on our own infrastructure in the European Union. Analytics is a self-hosted Umami instance we operate ourselves — no data goes to Google Analytics or any comparable service.
A certificate you share is public by design: anyone holding the verification code can see the name on it, the band, the score and the date. That is the point of a verification link, and you can revoke a certificate at any time by writing to us.
We disclose data to no one else, unless we are legally required to and can confirm the requirement is genuine.
Your rights
Ask, and you get a copy or a deletion. Within 30 days, usually far sooner.
Under the GDPR you can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Write to privacy@my-level.in from the address on the account, or use the "Privacy request" topic on the contact page.
Deleting your account removes your attempts and your profile. Verification links for certificates issued before the deletion stop resolving, so tell us if you would rather keep a specific one alive.
Contact messages are kept for 12 months and then deleted. Attempts are kept until you delete your account.
If you think we have handled your data badly, you can complain to the data protection authority in the EU country where you live.
Changes
If the cookie set changes, the panel asks you again rather than assuming.
When this policy changes materially we update the date at the top of the page. Where the change affects what cookies are set, the consent version is bumped, which invalidates your stored answer and asks you again — silence is not treated as agreement.
Earlier versions of this document are available on request.
Questions about this section?
privacy@my-level.in