Privacy Policy

Summary

We store your name and email address from Google sign-in, the practice problems you attempt, and, if you subscribe, your Stripe billing status. We do not sell your data, we do not run advertising trackers, and we do not receive your Google password or your card number. You may delete your account and all data attached to it at any time from your account page.

Who we are

Bedrock is operated by Bedrock Test Prep LLC, a Virginia limited liability company. Bedrock runs at bedrockprep.com and savemedesmos.com. For any matter arising under this policy, write to eric.wolpert@learnsatmath.com.

What we collect

Account information

Google sign-in is the only way to create a Bedrock account. When you sign in, Google provides us with your email address, your name, and your profile picture URL. That is the full extent of what we receive. We do not see, receive, or store your Google password.

Your practice activity

Each time you answer a problem, we record the problem, the answer you submitted, whether it was correct, the time you spent, the topic and difficulty, and the date and time. We also store the problems you bookmark or mark for review, your practice test attempts and scores, and your XP and rank. If you choose to log a past SAT score, we store the score, its source, and any label you give it.

Billing information

If you subscribe to Bedrock Pro, we store your Stripe customer ID, subscription ID, plan, status, and renewal date, so that the service can determine your access. Payment is processed on Stripe's hosted pages. Your card number, expiry date, and security code are never transmitted to or stored on our servers.

Problem reports

If you report a problem as broken or unclear, we store the text you submitted along with the problem it refers to and your account, so that we can correct the problem and reply to you.

Technical and usage data

We use Vercel Analytics and Vercel Speed Insights to measure aggregate page traffic and page-load performance. These services are cookieless, do not build a profile of you, and do not track you across other sites. Our hosting and database providers also retain ordinary security and error logs, which include IP addresses, for a limited period.

What we do not collect

We do not request or store your date of birth, home address, telephone number, school, or any government identifier. We do not operate advertising pixels, remarketing tags, or third-party ad trackers of any kind, and we do not purchase data about you from data brokers.

How we use it

• To operate your account and keep you signed in.
• To display your progress, streaks, analytics, XP, and rank, and to recommend what to practice next.
• To compute anonymous, aggregate statistics across all students, such as how often a problem is missed, average solve times, and your percentile standing. These aggregates do not identify any individual.
• To provide, bill for, and support Bedrock Pro.
• To correct problems you report and to improve the question bank.
• To send you occasional email about Bedrock, unless you have opted out.
• To keep the service secure, prevent abuse, and comply with the law.

If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of our contract with you (your account, your progress data, and Pro billing); our legitimate interests in a secure, functioning, and improving product (aggregate statistics, security logs, and abuse prevention); your consent (marketing email, which you may withdraw at any time); and compliance with legal obligations (tax and accounting records).

Cookies

Bedrock sets one category of cookie: the session cookie that keeps you signed in after you authenticate with Google. It is strictly necessary, because without it there is no means of maintaining your session, and it therefore does not require a consent banner. We set no advertising, remarketing, or cross-site tracking cookies. The service also uses your browser's local storage to remember interface preferences, such as whether a sidebar is open.

Do Not Track. Bedrock does not track you across third-party websites, and we do not alter our behavior in response to Do Not Track signals. No third party collects personally identifiable information about your activity across other sites through Bedrock.

Who we share it with

We share data only with the service providers required to operate Bedrock, and only for that purpose. They are:

• Supabase. Our database and authentication provider. Holds your account and all practice data.
• Vercel. Hosting, together with the cookieless analytics described above.
• Stripe. Payment processing and subscription billing for Pro. Stripe is the party that handles your card details, under its own privacy policy.
• Google. Sign-in. Google also serves the web fonts used on the site, which means Google receives your IP address when a page loads.
• Mux. Video hosting for Pro lesson videos, including playback performance data.
• YouTube.Embedded videos on the videos tab. These use YouTube's privacy-enhanced mode and load only after you click play, so no data reaches YouTube unless you choose to watch.

We may also disclose information where the law requires it, or to protect our rights, our users, or the security of the service.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use student data for targeted advertising, and we do not profile students for advertising purposes.

Email

When you create an account, you are opted in to occasional email about Bedrock, covering new problem sets, new videos, and product updates. Every such message includes an unsubscribe link, and unsubscribing takes effect for all marketing email. We may still send you essential messages about your account or a payment. Those are not marketing and cannot be opted out of while your account exists. We do not sell or rent our email list.

How long we keep it

We retain your account and practice data for as long as your account exists, because it is the data the service displays to you. If you delete your account, we delete your profile, every attempt, your bookmarks and review marks, your practice test attempts, your self-reported scores, your XP, your problem reports, and your subscription record.

Two categories of data survive deletion. Aggregate, de-identified statistics, such as how often a problem is answered correctly across all students, are retained, because they contain nothing that identifies you. Stripe also retains its own record of any payment you made, as we are required to keep transaction and tax records for several years under US law.

Your rights

You may, at any time:

• Access your data. Your practice history and statistics are on your analytics page. Contact us for anything the service does not display.
• Correct it. Contact us and we will amend it.
• Delete it. From your account page. Deletion is immediate and permanent, and we do not retain a backup copy.
• Opt out of email. Use the unsubscribe link in any message we send.

If you are in the EEA or the UK, you also have the right to object to or restrict processing, the right to data portability, and the right to lodge a complaint with your local data protection authority. If you are in a US state with a comprehensive privacy law, you have the equivalent rights that law provides. We will not charge you or degrade your service for exercising any of these rights. Write to eric.wolpert@learnsatmath.com and we will respond within 30 days.

Students under 13

Bedrock is intended for students aged 13 and over, and you must be at least 13 to create an account. We do not knowingly collect personal information from children under 13. Google accounts in the United States already require account holders to be at least 13, and Google sign-in is our only means of access.

If you are a parent or guardian and believe your child under 13 has created an account, write to eric.wolpert@learnsatmath.com and we will delete the account and its data promptly.

Bedrock is sold directly to students and families. It is not designed or marketed for use by K-12 schools, and we do not act as a school official or a school contractor.

Security

All traffic is encrypted in transit. Sign-in is handled through Google OAuth, so there is no Bedrock password to compromise. Every table holding personal data is protected by database-level row security, so one account cannot read another account's rows even in the event of an application-layer fault. Access to production credentials is limited to the operator of the service. No system is perfectly secure, and we make no claim to the contrary.

Where your data is held

Bedrock is operated from the United States, and our providers store and process data on servers in the United States. If you use Bedrock from outside the United States, you are transferring your information to the United States, where privacy law differs from that of your own country.

Changes to this policy

If we change this policy, we will update the date at the top of the page. If a change materially affects how we handle your data, we will notify you by email or in the app before it takes effect.

Contact

Bedrock Test Prep LLC, eric.wolpert@learnsatmath.com.