LEGAL
LAST UPDATED: 11 JULY 2026
PasSQE is run by a small team, and we treat your data the way we'd want ours treated: collect little, explain everything, delete fast. This policy says exactly what we do. The data controller is ⟨OPERATOR⟩, contact ⟨CONTACT EMAIL⟩, ICO registration ⟨ICO NUMBER⟩.
| DATA | WHY | LEGAL BASIS | KEPT FOR |
|---|---|---|---|
| Email, password (handled by Clerk, so we never see or store passwords) | Your login | Contract | Until you delete your account |
| Full name | Real-name community; shown as “First L.” | Contract | Until you delete your account |
| SRA number | Verifying you're a real candidate | Legitimate interests (community integrity) | Until you delete your account |
| Proof-of-registration document | One-time verification for full access | Legitimate interests | Deleted the moment we decide (approve or reject), never archived |
| Optional profile fields (sitting, track, first-timer/resitter, background, provider, year of birth, gender, country) | Anonymous, aggregated community statistics (e.g. cohort averages) | Consent; every field is skippable | Until you delete your account, or we stop collecting a field |
| Study sessions, plans, streaks, XP | Your stats, the planner and the leaderboard | Contract | Until you delete your account |
| Chat messages | The lounge | Contract | Visible for 15 minutes; hidden copy kept 30 days for moderation and safety, then permanently deleted |
| Comments, reports | Blog discussion, moderation | Contract / legitimate interests | Comments persist until removed; reports kept 12 months |
We do notcollect special-category data, we don't profile you, we don't sell or share your data for advertising, and we never will.
We choose UK/EU data locations where available and appropriate safeguards where not.
We use only cookies the site needs to work: your login session (Clerk) and your own preferences stored in your browser (timer settings, chat-dock state). No advertising cookies, no third-party tracking. That's why there's no cookie banner nagging you.
UK GDPR gives you the right to access, correct, delete, restrict or object to our use of your data, and to take your data elsewhere. Email ⟨CONTACT EMAIL⟩ and we'll respond within one month. Deleting your account removes your personal data; anonymous aggregate statistics (e.g. “members studied 40,000 hours in 2026”) survive because they no longer identify you. You can also complain to the ICO (ico.org.uk), though we'd appreciate the chance to fix things first.
Traffic is encrypted (TLS), passwords never touch our servers, the database is access-restricted to the two of us, and identity documents are deleted on decision rather than stored. If a breach ever puts your rights at risk, we'll notify the ICO within 72 hours and tell you directly.
If this policy changes materially, we'll flag it on the site before it takes effect. The date at the top always tells you the current version.