Legal

Privacy Policy

Effective October 8, 2026

SHSAT Practice Test (shsatpracticetest.net) is a free SHSAT practice website for New York City families. It is run by the SHSAT Practice Test team (“SHSAT Practice Test”, “we”, “us”). This policy explains what information we collect, why, how long we keep it, and how to have it deleted.

SHSAT Practice Test is independent. It is not affiliated with or endorsed by NYC Public Schools, the NYC Department of Education or Pearson.

The short version

Your child’s score history is saved in your browser on your device.
Answers to practice questions are sent to us without a name or email, only to find questions that are too easy, too hard or unclear.
Students never create accounts or give us an email. Parent accounts are optional, and a child’s profile is only a nickname and a grade.
We do not sell personal information, share it for advertising, or show ads. We use no analytics or advertising trackers.
You can delete what we hold at any time: on My Progress, on your account page, or by writing to [contact email: to be added].

1. Information we collect

1.1 Score history saved on your device

When your child takes a practice test or answers topic questions, the results are saved in your browser’s local storage on that device. This is what My Progress and the score calculator show:

Test history: the date and time, the estimated score, the number of ELA and math questions answered correctly, the minutes used, accuracy by topic, and for each question: which question it was, the answer given, whether it was right, and the seconds spent on it.
Topic practice: the number of questions answered and answered correctly in each topic, and the last 500 answers with the same details.

This copy stays in the browser until it is erased. Browsers can erase it on their own: Safari after about 7 days without a visit, and any browser when you clear its site data. To erase it yourself, use “Erase my saved results” on My Progress. If you have a parent account and pick a child on this browser, the history saved here becomes that child’s, and each child’s copy is kept apart.

1.2 Answers sent to us without a name

To find practice questions that are too easy, too hard or unclear, and to set each question’s difficulty from real answers, the browser also sends your child’s answers to our database:

A random browser ID. The first time an answer is sent, the browser makes a random code of 16 letters and numbers and keeps it in local storage. It lets us read one browser’s answers together. It is never shown and is not linked to a name, email or IP address.
For each finished practice test: a random test ID; the questions shown and their version; each answer as your child left it (a typed answer is kept only when it looks like a number or a math expression; anything else, such as a name, is saved as “[removed]”); whether it was right; the seconds spent on each question; when the test started and ended; the minutes used; whether time ran out; which subject came first; and the estimated score.
For each topic practice question: the question and its version, the answer (typed answers as above), whether it was right, and the seconds spent on it.

Like every web request, an upload reaches our server with the device’s IP address and browser details, but we do not save them with the answers. If the browser is offline, the answers wait in local storage and are sent the next time a page on the site opens.

Bot check. We may ask the browser to run Cloudflare Turnstile before answers or a problem report are saved, so bots cannot fill our database. Turnstile loads only when something is about to be sent, usually finishes on its own, and once in a while asks you to tick a box. Cloudflare processes technical signals from the browser for this check, as described in its Turnstile Privacy Addendum. When the check passes, our server gives the browser a signed pass that lasts up to 2 hours, kept only in that browser tab.

1.3 Problem reports

If your child uses “Report a problem with this question”, we save which question it was and its version, where the report came from, the reason chosen, the browser ID, and the time. The form has no box for typing details.

1.4 Parent accounts and Pro (optional)

The test and questions work without an account. A parent or guardian can create an account to keep each child’s results in one place and to buy Pro.

The parent: your email address; if you sign in with Google, your Google account ID (we ask Google only for your email, not your name or photo); when you created the account and confirmed that you are a parent or guardian, 18 or older; when you last signed in.
Signing in: a 6-digit code we email you, stored only as a scrambled hash for 10 minutes, or Google sign-in. Each signed-in browser gets a random session token in a cookie; we store only its hash, for 60 days after last use.
Each child: a nickname and, if you give it, a grade. We ask for a nickname, not a full name. Tests and answers taken on a browser where you picked that child are saved under that child’s profile, as described in section 1.2, so you can follow their progress.
Pro: when Pro is on sale, payments are handled by Polar (Polar Software, Inc.), our reseller and merchant of record, under its own buyer terms and privacy policy. Polar sends your receipt. We receive the order number, the amount and currency, the email used at checkout, and the date your Pro season ends. We never see your card number.
Emails we send you: sign-in codes and one note when your account is created. No marketing.

1.5 Waitlist sign-ups

If you join a waitlist, we store the email address you enter, which list you joined (free accounts, Pro, or tools for tutors and teachers), which of our pages you signed up on, and the date and time.

1.6 Hosting, security and logs

The site is hosted on Cloudflare. Like any web host, Cloudflare processes technical information to deliver pages and protect the site from abuse, including your IP address, browser type, the pages you request and the time of each request.

Logs. Cloudflare’s per-request logs for our server are turned off. We keep only messages our code writes, such as error reports, which never include an IP address, for up to 7 days.
Spam protection. We count how many requests come from the same IP address within 60 seconds and block rapid repeats. The address is not stored with anything.

1.7 Cookies

We use no analytics, advertising or social media trackers. It sets cookies only for parent accounts, and only when you sign in: a session cookie that keeps you signed in (60 days), and short-lived cookies while you sign up or sign in with Google (15 minutes or less). They are strictly necessary and never used to track you elsewhere. Cloudflare may set strictly necessary security cookies to tell people from bots.

2. How we use information

Answers and problem reports: only to find and fix questions that are too easy, too hard, unclear or wrong, and to set question difficulty from real answers.
Parent accounts: to sign you in, keep each child’s results, show their progress, and provide Pro.
Waitlist emails: only to tell you when the product you signed up for opens, and to answer your messages.
Technical information: only to deliver the site, keep it secure and stop spam.

We never use a child’s information to contact the child, show ads, build an advertising profile, or make decisions about a child. We do not sell or rent personal information.

Service providers: Cloudflare hosts the site and our database and sends our sign-in emails; Google signs you in if you choose Google; Polar handles Pro payments. They may use the information only to provide their services to us, except as their own policies describe for their services (for example, Cloudflare’s Turnstile).
Legal reasons: if the law requires it, or to protect the safety of our users or the public.
If the site changes hands: the information may move with it, and the new owner must follow this policy or ask for your permission first.

4. How long we keep information

We keep personal information only as long as we need it for the reason we collected it, never indefinitely. A scheduled job deletes expired records every day.

Information	Kept until
Answers, tests and problem reports from browsers without an account	12 months after they are sent, or sooner if you erase them on My Progress. A browser ID that sends nothing for 12 months is deleted with everything under it.
Parent accounts, children’s profiles and their results	While the account is used. Removing a child or deleting the account deletes them at once; an account nobody signs in to for 24 months is deleted automatically.
Sign-in sessions and codes	60 days after last use; codes 10 minutes.
Pro purchase records	Kept for our accounts; your email is removed when you delete your account. Polar keeps its own payment records.
Waitlist emails	Until 12 months after the product you signed up for launches, or until you ask us to delete them.
Logs	Up to 7 days.
Score history on your device	Until you or your browser erase it.

Deleted information can remain in our database provider’s backups for up to 30 more days before it is gone for good.

5. Your choices and rights

Parent account: on your account page, remove a child’s profile with all of that child’s results, or delete your whole account. Both take effect at once.
Erase practice results: “Erase my saved results” on My Progress deletes the history in your browser and every answer and report sent under its browser ID.
Waitlist and other requests: write to [contact email: to be added] to see, correct or delete what we hold about you or your child. We answer within 30 days.

Depending on where you live, you may have more privacy rights. Contact us and we will help.

6. Children’s privacy

SHSAT Practice Test is for parents and guardians, and for students using it with their family’s permission. Students do not need to give any personal information to use the practice test or questions, and they cannot create accounts.

The random browser ID is a persistent identifier. Without a parent account, we collect it, with the answers sent with it and the IP address of each request, only to support our internal operations: to keep the questions accurate, to let you erase everything a browser sent with one button, and to protect the site from spam and bots. We keep it to these uses: it is not linked to a name, email or account; we never use it to contact a student, show ads or build a profile; only the operator can open the database, through an admin area that requires sign-in, and our admin tools review answers question by question.

A child’s profile in a parent account is created by the parent, who confirms they are a parent or guardian, 18 or older, and receives an email confirming the account. A parent can review or delete a child’s information at any time, as described in section 5.

If you believe a child gave us personal information without a parent’s permission, write to [contact email: to be added] and we will delete it.

7. Security

The site is served over HTTPS. Sign-in codes and session tokens are stored only as hashes. Only the operator can open the database, through an admin area that requires sign-in with an approved email address. No method of storage or transmission is completely secure, but we work to protect the information we hold and keep as little as we can.

8. Where information is processed

Cloudflare runs a global network, so information may be processed outside New York or outside the United States.

9. Changes to this policy

If we change this policy, we will post the new version here with a new effective date. If a change affects how we use parents’ emails, we will email account holders before it takes effect.

10. Contact us

Operator: [operator name: to be added]
Email: [contact email: to be added]
Mail: [mailing address: to be added]
Phone: [phone number: to be added]

For questions about the SHSAT itself (registration, test tickets, accommodations or results), contact your school counselor or NYC Public Schools at SHSATassessment@schools.nyc.gov. We cannot help with those.