Trust and safety
We take the security of student and family data seriously. This page explains how Exam Study Hacks is built, who processes data on our behalf, and how to report a security concern.
The application is hosted on Vercel and served over HTTPS with HSTS enforced. Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and a frame-ancestors content security policy) are applied to every route.
Our database, authentication and structured data run on Supabase (PostgreSQL) in the EU (Ireland) region. Row Level Security is used to keep each user's data private.
Student progress data is private by default. There are no public leaderboards and we minimise the optional data we collect.
Passwords are handled by Supabase Auth and are never stored by us in plain text. Server-only secrets and service keys are never exposed to the browser.
Optional analytics only load after you accept analytics cookies, and analytics are never collected on admin or API routes.
Subscriptions are processed by Stripe. We do not see or store full card numbers — card data is handled directly by Stripe, a PCI-DSS Level 1 certified provider.
Transactional email is sent through Resend from an authenticated examstudyhacks.com domain (SPF and DKIM configured).
Media and document files are stored in Cloudflare R2, with public buckets limited to approved assets and private/temporary buckets for uploads and review.
We use the following processors to run the service: Vercel (hosting), Supabase (database, auth, storage), Stripe (payments), Resend (email), Cloudflare (media storage and DNS), and Google Analytics (optional, consent-based analytics).
Each processor handles data only as needed to provide its part of the service. See our Privacy Policy for how we handle personal data.
Administrative tools are restricted to named admin accounts and protected by route middleware and a server-side allowlist.
The database is backed up nightly. Uploaded source content stays in a human-reviewed staging workflow and is never published to students automatically.
If you believe you have found a security vulnerability, please email security@examstudyhacks.com with details and steps to reproduce. Please give us reasonable time to investigate and fix the issue before any public disclosure.
We welcome good-faith security research and will not pursue action against researchers who report issues responsibly and avoid accessing other users' data.