passBPT

PASSBPT

Privacy policy

Last updated 29 October 2026

This policy explains how passBPT handles information when you visit this website, create an account, study or contact us. For privacy questions or requests, use our private contact form and choose “Privacy or account request”.

Information we collect and why

  • Account information: your email address, account identifier and authentication records, used to verify your email, keep you signed in and control access. The site owner can view account signup and last sign-in dates, verification status and membership status in a private management dashboard. If you choose password login, your password is processed by Supabase over an encrypted connection. passBPT does not store passwords in its application database. You can also use an email code.
  • Study activity: answers, saved questions, notes, the current session and demo or membership status are linked to your account so you can continue your work across visits and devices. Unsaved note drafts are also kept in this browser, separated by account and question, until they are saved. Avoid private notes on a shared browser and clear site data if needed.
  • Question issue reports: the question version, issue type, details and review status are stored privately for the passBPT team to investigate.
  • Discussions: comments, replies and reports are stored to provide and moderate shared discussions. Comments are shown under a general learner label or “passBPT team”; account email addresses are not displayed as author names.
  • Question ratings: your thumbs up or thumbs down is linked to your account. Learners see aggregate counts and their own rating; individual voter identities are not public.
  • Support: the topic and message you submit, a protected lookup reference, our response and request timestamps. An account and email address are not required to use the contact form.
  • Technical information: hosting and authentication providers may process IP addresses, browser information and request logs to deliver and protect the service. We use short-lived hashed request counters to limit misuse.

You may use all 30 free demo questions and the ten public samples without an account or email verification. An email address is required for an account; a message is required if you want us to respond to a support request. Please do not submit patient-identifying information, medical records, passwords or confidential exam material.

What other people can see

Your account email, private notes and support messages are not published. Shared comments are visible to learners who can access the relevant question. Administrators may access records when necessary to provide support, moderate discussions or maintain the service. Guest demo answers, bookmarks and session position are saved in this browser so you can return after a refresh. They are not public and are not automatically added to an account. After signing in, you can explicitly choose to copy this progress to your account; existing account answers and notes are kept. Use “Reset demo progress” or clear site data to remove this browser’s demo records. Other people using the same browser profile may see those records. Private notes and real discussions for demo questions require an optional account. The separate public sample’s answers, notes and demonstration comments also stay in the current page session and reset on reload.

Service providers and overseas processing

We use Supabase for authentication, Resend for sign-in emails, and Sites/Cloudflare for hosting and application storage. Your email address is provided to the authentication and email services to deliver login codes. Support messages and study records are stored with our application hosting service.

The Supabase project is configured in Sydney and email sending through Resend is configured in Tokyo. These settings do not mean that all provider operations, logs or support access are restricted to those locations. Service providers may process information in other countries, including the United States. These links provide general information about each provider and are subject to the applicable service agreements: Supabase and its data processing terms, Resend, Cloudflare and OpenAI.

Information may also be disclosed when required by law or when reasonably necessary to investigate misuse or protect the service. We do not sell account information or use your login email to send marketing through this website.

Study and membership reporting

For signed-in learners, we record when the free demo is first opened, which demo questions have been answered, when membership checkout is started and when a first live subscription payment is confirmed. When you choose to copy browser demo progress into your account, we also record that import and the current demo questions answered. Import timestamps record when progress was copied, not when the anonymous answers were originally given. This helps us understand where the demo and subscription process needs improvement. Earlier timed-trial records are kept separately. The private owner dashboard shows totals. These records use your internal account identifier and timestamps, without copying answer choices, private notes, question text or email addresses into the reporting records. They are kept in the website database and are not sent to advertising services.

Payments

Subscriptions use Stripe-hosted checkout and a billing portal. If you choose to subscribe, we send Stripe your account email and an internal account identifier. Stripe processes your payment details; passBPT does not store your full card number or security code. We retain billing identifiers, subscription status and confirmed payment coverage to manage membership and support. Stripe may process information overseas and use cookies for checkout and fraud prevention. Read Stripe’s privacy policy.

Cookies and local data

Essential authentication cookies keep your passBPT session signed in. These are secure, server-managed cookies. You can clear cookies or sign out; clearing them may require you to sign in again. The anonymous demo stores a bounded set of question IDs, versions, answer choices, bookmarks and session position in local storage until you reset it or clear site data. It does not store an email address or private notes. The homepage stores the last displayed demo question number in your browser tab’s session storage so a refresh can show a different question. This does not store your answer or identify you. During signup, your email address and current step can be kept in this browser tab for up to 15 minutes so a refresh does not interrupt verification. Passwords and verification codes are never saved in this browser storage. Selected study questions, versions, your position and any original session retained during retry practice are saved in the account database so you can continue across devices. First answers, separate retry answers and notes are also saved there. External reference websites apply their own policies when you visit them.

Optional website and advertising measurement

With your permission, we also record website visits, public demo use and signup steps in our own database. A random browser-session identifier lasts up to 24 hours in this tab, and a broad source category records how you reached us, such as search, advertising or a study group. We record steps such as opening the public demo, submitting a first demo answer, opening signup, requesting a code and successful email verification. Public demo measurement records only that an answer was submitted, without the question, answer choice or whether it was correct. These reports do not contain your email, password, verification code, answers, notes or full page addresses. After email verification, we link the session to your account identifier to measure demo use and membership purchases. Browser sessions are not a count of unique people.

Website measurement uses a 90-day retention window; older records are removed during routine measurement processing. The private owner dashboard shows aggregate results. We exclude known owner activity, but the figures can include unidentified automated traffic and will omit visitors who decline measurement. These first-party demo and signup events are not sent to Google.

If you choose “Allow measurement”, we load the Google Ads tag on public pages and your account page to understand which advertisements lead to a paid membership. Google may process your IP address, browser information, ad-click identifiers and advertising cookies. For a confirmed initial subscription payment, we send an invoice reference, the amount paid and currency. Refreshes use the same invoice reference to avoid duplicate conversions. We do not send your email, name, private notes, answers, discussion text or payment-card details in measurement events. We do not enable enhanced conversions, personalised advertising or remarketing, and do not load this tag on the public demo, signed-in study, administration or sign-in pages.

The tag stays blocked until you allow measurement. Declining has no effect on your demo, account or membership. Your choice is stored in this browser for up to six months; change it at any time using “Measurement settings” in the footer. Withdrawing permission stops future measurement and reloads the page. You can also clear previously stored cookies in your browser; withdrawal does not delete data already received by Google. Google may process information overseas, including in the United States. Read Google’s privacy policy and how Google uses information from partner sites.

Security and retention

We use encrypted connections, access controls and restricted service credentials. No online system can guarantee absolute security. Keep your password, email account and any private support reference secure.

Account and study records remain while needed to provide the service, and support or security records may be kept to resolve requests, investigate misuse or meet legal obligations. We assess deletion requests individually, including any necessary record retention. Deletion is not an automatic timed process, and provider backups may remain under the provider’s retention arrangements.

Access, correction, closure and complaints

You can request access to or correction of your information, account closure or deletion through the contact form. We may ask you to verify control of your account before releasing information or making changes. Save your contact reference to read our response. If we cannot fulfil a request, we will explain why.

If you are unhappy with how your information has been handled, contact us first so we can investigate. You may also seek guidance from the Office of the Australian Information Commissioner, where its jurisdiction applies.

Updates

We will update this page when our practices change. Significant changes affecting existing accounts will be brought to users’ attention through the service.

Need help? Contact passBPT.