Privacy Policy

SmartPrep Labs LLP ("SmartPrep Labs", "we", "us", or "our") provides the Norskprøven Mock Exam mobile application (the "App"). This policy explains what information the App processes, why it is processed, and the choices available to you.

1. Information we process

Account and profile information

• A Firebase user ID and authentication provider. The App creates an anonymous session for core functionality.
• Email address, display name, and provider account information when Google or Apple supplies them after you choose to link an account.

Learning and user content

• Selected level and written-language preference, practice and mock configuration, answers, attempts, completion history, progress, feedback, and quota use.
• Typed Norwegian answers, speaking recordings, handwriting images, and recognized text when you choose the corresponding feedback or recognition feature.

Purchases, diagnostics, and security

• An app-specific RevenueCat customer identifier, product, entitlement state, purchase environment, and relevant store event identifiers. We do not receive full payment-card details.
• Optional usage analytics such as named screens and coarse feature outcomes, plus app-instance, device, session, and lifecycle metadata. Answer text, recordings, scans, name, and email are excluded from our analytics allowlist.
• Optional sanitized diagnostics such as an error type or code, stack trace, app version, platform, and device diagnostics. Learner answers and contact details are not intentionally attached.
• Rate-limit counters, App Check signals, idempotency records, and audit events used to protect the service. A one-way user-ID hash is used when the original identifier is not operationally required.

Analytics and crash diagnostics are disabled by default. You can enable or disable them separately in Settings > Privacy & data.

2. Why we process information

We process account, learning, content, and subscription information to provide the requested service, synchronize progress, restore access, evaluate practice responses, transcribe speech, recognize handwriting, administer subscriptions, prevent abuse, and maintain reliable billing. Optional analytics and diagnostics are processed only after you opt in.

Automated feedback is an educational estimate. It is not an official score and does not make a decision with legal or similarly significant effect.

Your permission for AI processing

The permission and withdrawal controls described here are introduced in version 1.0.7. Availability of that update depends on your store and rollout. If you use an earlier version and do not want AI processing, do not use AI feedback, transcription or photo-recognition features.

In version 1.0.7 and later, before you use AI feedback, speech transcription or photo recognition, the App asks for your permission to send the relevant typed answer, recording or transcript, photo or scan, exam-task context and generated feedback to the providers named below for transcription, text recognition, educational feedback and report-quality review. Permission for AI processing is separate from microphone, camera, analytics and crash-reporting choices. If you decline, that request does not upload your evidence, start AI processing or reserve or charge a feedback allowance. You may continue using features that do not require AI processing.

You can withdraw permission for future requests in Privacy & data. A retry also requires current permission. Withdrawal does not undo processing already completed or delete saved answers and reports; account deletion is a separate control described below.

3. Service providers

Depending on the feature you choose, information is processed by the following providers. Quality review can involve a second provider even when the primary request succeeds:

• Google Firebase and Google Cloud for authentication, database, storage, server functions, App Check, optional Analytics and Crashlytics. Google Cloud Vertex AI receives photos or scans for primary text recognition, and answer text, transcripts, exam context and generated reports for fallback evaluation and report-quality review;
• Groq receives speaking recordings for primary speech transcription;
• OpenAI receives answer text, transcripts, relevant exam context and generated reports for primary evaluation, correction and quality review, and may receive recordings for fallback transcription or photos and scans for fallback text recognition;
• RevenueCat for subscription and entitlement synchronization;
• Apple App Store or Google Play for purchase processing and store-account management.

These providers process information under their applicable terms and data-processing commitments. OpenAI, Groq and Google Cloud publish business data-processing terms describing processing under customer instructions, confidentiality and security safeguards. Their published terms also address the use of subprocessors. Details are available in the OpenAI Data Processing Addendum, GroqCloud Data Processing Addendum and Google Cloud Data Processing Addendum. These terms describe the providers' commitments; our use of each service and its configured controls determines which provisions and retention arrangements apply. Processing may occur outside your country. Where required, we rely on an adequacy decision, contractual safeguards, or another lawful transfer mechanism.

We do not sell personal information, use learner content for personalized advertising, or enable cross-app advertising tracking.

4. Storage, retention, and deletion

• Account-linked learning data, recognized text, and feedback are retained while the account remains active or while reasonably needed to provide the service, satisfy legal obligations, resolve disputes, prevent fraud, and protect the service.
• A cloud speaking recording is removed after its evaluation is saved. If processing fails before then, the protected upload may remain for retry or until account deletion.
• A handwriting source image is removed after the OCR request completes; cleanup is also attempted after a failed request.
• Local drafts and recordings stay on the device. The App removes old recording files on a best-effort basis after 90 days and keeps the recording cache within 200 files and 250 MB.

Using Profile > Delete account and cloud data removes the Firebase Auth account, the account-linked user tree, synchronized attempts and evaluations, and files in the protected user storage path. Limited billing, fraud, and security records may remain where reasonably necessary, with the original Firebase user ID replaced by a one-way hash when possible.

Deleting the App or the learning account does not cancel a store subscription. Subscription cancellation is managed separately in your Apple or Google store account. Full deletion instructions are available on our Delete Account page.

5. Your choices and rights

• In version 1.0.7 and later, grant or withdraw permission for future AI processing in Privacy & data, separately from optional analytics and crash-reporting choices.
• Review and edit recognized handwriting before saving it.
• Manage or cancel a subscription in the applicable store account.
• Delete the account and cloud data in the App or request deletion through the web process.
• Request access, correction, deletion, restriction, objection, or portability by emailing support@smartpreplabs.com. We may need to verify the request.

Applicable data-protection law may also provide the right to complain to a supervisory authority.

6. Children and security

The App is not directed to children below the digital-consent age applicable in their country. If you believe a child has provided personal information without valid authorization, contact us.

We use authenticated owner-bound storage paths, server-side authorization, rate limits, integrity checks, and encrypted network connections. No system can be guaranteed completely secure.

7. Changes and contact

We may update this policy when the App, providers, or law changes. We will show a new update date and provide any additional notice required by law.