Privacy Policy

Aviation Exam Practice (“we”, “our”, or “us”) operates https://aviationexampractice.com (the “Site”). This Privacy Policy explains what personal information we collect, how we use it, and your rights in relation to it.

We are committed to complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Site you agree to the practices described in this policy.

1. Information we collect

Information you provide directly

• Account information — name and email address when you register.
• Payment information — if you subscribe, payment is processed by Stripe. We never see or store your card number; Stripe handles it under their own privacy policy.
• Communications — any message you send us via the contact form or support chat.

Information collected automatically

• Usage data — questions answered, scores, topics practised, and session timing. This is the core data that powers your progress dashboard and spaced-repetition engine.
• Device & log data — IP address, browser type, operating system, referring URL, and pages visited. Collected via server logs and analytics.
• Cookies — small text files stored in your browser. We use strictly necessary cookies to keep you logged in, and (with your consent) analytics cookies to understand how the Site is used.

2. How we use your information

• Provide and personalise the study platform — tracking your progress, surfacing weak topics, and calculating your exam-readiness score.
• Process your subscription and send receipts.
• Send transactional emails (account confirmation, password reset, subscription renewal reminders). We do not send marketing emails without your explicit consent.
• Improve the question bank and platform by analysing aggregated, anonymised usage patterns.
• Detect and prevent fraud, abuse or security incidents.
• Comply with our legal obligations.

3. Sharing your information

We do not sell your personal information. We share it only with:

• Supabase — our database and authentication provider. Your account data and study records are stored on Supabase infrastructure (hosted in AWS ap-southeast-2, Sydney).
• Stripe — payment processing. Stripe is PCI-DSS Level 1 certified. See stripe.com/au/privacy.
• Vercel — site hosting and analytics. Vercel Analytics collects anonymised, aggregated page-view data with no cross-site tracking.
• Cloudflare — CDN, DDoS protection, and PDF delivery. Cloudflare may process request metadata (IP, User-Agent) in accordance with their privacy policy.
• Law enforcement or regulators — if required by Australian law, court order, or to protect the safety of users or the public.

4. Data storage and security

Your data is stored on servers located in Australia (Supabase AWS ap-southeast-2). We use industry-standard safeguards including encryption in transit (TLS 1.2+), encryption at rest, and role-based access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We retain your personal information for as long as your account is active, or as required to resolve disputes and enforce our agreements. You may request deletion at any time (see section 6).

5. Cookies

We use the following types of cookies:

You can disable cookies in your browser settings. Disabling strictly-necessary cookies will prevent you from logging in.

6. Your rights

Under the Australian Privacy Principles you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Deletion — request that we delete your account and associated personal data. We will do so within 30 days, subject to any legal retention requirements.
• Complaints — if you believe we have breached the APPs, you may complain to us first (see section 8). If unresolved, you may escalate to the Office of the Australian Information Commissioner (OAIC).

7. Children

The Site is intended for student pilots aged 15 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email (if you have an account) or by a prominent notice on the Site. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Site after changes take effect constitutes acceptance of the updated policy.

9. Contact us

For any privacy-related questions, access requests, or complaints, please contact: