Privacy Notice

Last updated 28 September 2026

This notice explains what personal data pastpaper.cc collects, why, who can see it, and what you can do about it. It applies from 28 September 2026. We only collect what the Service needs to work, to protect its content, and to improve it.

1. What we collect

Account details — your email address and display name, received from Google when you sign in, whether that email is verified, Google's account identifier for you, and the date you signed up. We never see or store your Google password.
Sign-in records — the time, IP address and browser user-agent of each sign-in. From the user-agent we note your device type and browser (for example "Android · Chrome"), and from the IP address your approximate location (country, region and city).
Study activity — which questions you open; your answers (the option you chose for multiple-choice questions, and the mark you give yourself on written questions) and whether they were correct; when each of these happened; how long a question was on your screen before you answered it; your bookmarks; which hints you reveal; your mock exams (the questions, your answers, marks, score and timing); and how much of your plan's allowances (such as hints and mock exams) you have used.
Searches and filters — what you type into the question search and which course, topic, paper, year and exam-session filters you choose in the question bank, with how many questions were found. If you are signed in this is linked to your account; if not, it is stored with the same scrambled visitor code described in section 8.
Your exam goals (optional) — if you tell us on your dashboard, the exam session you are preparing for and the grade you are aiming for. You can skip this question.
How you found us — for an account created from 28 September 2026: the first page you opened before signing up, the website you came from (its domain only) and any campaign tags in the link you followed (such as utm_source).
Plans and checkout — when you open the plans page, when you open, close or complete a checkout (and which plan it was for), and when you reach a limit of the Free plan or of visitor access (for example the hint allowance or a locked exam year).
Hint ratings — if you rate a question's hints as helpful or not helpful.
Exam results (optional) — if you tell us after results day, the grade you got in a course. You can skip this question.
Why you cancelled (optional) — if you tell us after cancelling a subscription, the reason you choose and anything you write.
Your email choice — whether you agreed to receive emails about the Service (new subjects and papers, exam tips and offers), and when. You can change it any time on your dashboard.
Survey answers (optional) — if you answer our survey: the country you live in, the school you attend and which exams it teaches, roughly how many students are in your grade, roughly how much you spend on tutoring outside school each month and for which subjects and in what form, how you would prefer to pay for a plan, what else you use to study, and which new features you would like, and how you first heard about the Service. They are linked to your account, so we can offer you the free Premium trial and understand our students. They are never shown publicly.
Flashcards — the decks you create and their names, the questions in each deck, how you rate each card when you review it (Again, Hard, Good or Easy), and the review schedule worked out from those ratings.
Teacher worksheets (Premium) — the worksheets and exams you build in the Teachers tab: their titles, whether each is a worksheet or an exam, the questions you chose and their order, and when you created or last changed them. They are saved to your account so you can reopen and reprint them. We do not collect anything about the students you give them to.
Pages you visit while signed in — the address of each page on the Service you open, the website you came from (its domain only), your approximate location (see section 8) and the time, linked to your account. When you open our plans page from a link inside the Service, we also note which link it was (for example the hints limit), and pass that note to Paddle with a purchase.
Statistics we work out from the above — for example the number of questions you have answered, your accuracy, streaks, the days you were active, an estimate of your practice time, the courses you use most, and when you were last active.
Visits when you are not signed in — see section 8: recorded under a scrambled visitor code, not your name or IP address.
Referrals — your own referral code; if you signed up through another member's invite link, or paid using a founding member's discount code at checkout, which member referred you and whether your subscription is pending, active or inactive (and whether your first payment was refunded), so we can give that member their referral rewards; and, for the people you refer, the same information, so we can apply referral rewards and discounts.
Support messages — anything you send us through the in-app report and support forms or by email.
Subscription status — your plan, its status and renewal date, and identifiers linking you to your Paddle customer and subscription records.

We do not collect or store your card details. We never see them — payment information goes directly to Paddle.

2. Why we use it

To sign you in and keep your account secure.
To provide the Service: serve questions, track your progress, schedule flashcards, run mock exams, save and print teacher worksheets, and show your dashboard.
To determine what your plan gives you access to, and to apply its allowances.
To run the leaderboard (see section 4).
To understand how the Service is used, so we can fix problems and decide what to improve — for example which pages, courses and features are used, and whether people keep coming back.
To plan what we build and offer next, using survey answers if you give them.
To understand how people find the Service, where they stop before subscribing, whether they come back, which hints need improving, and whether practising here helps students' results.
To send you emails about the Service, only if you said yes. Every email will let you stop them, and so does the setting on your dashboard. We never send marketing to anyone who hasn't agreed.
To answer your support requests.
To detect account sharing, scraping and other abuse.
To detect copying or redistribution of our content, including our hints, and where it happens, to enforce our Terms of Service — which can include using these records to establish or pursue a legal claim.

We do not sell your data. We advertise the Service with Google Ads and use Google's tag to measure how well those ads work (see section 8); we never give Google your name, email address or account details. We do not make automated decisions about you that have legal or similarly significant effects.

3. Who can see it

You — your own progress, history and statistics.
The operator of pastpaper.cc — can see each account's details, activity, statistics and sign-in records (including IP addresses, approximate location and device type) in a private admin view, for the purposes in section 2.
Other signed-in users — only what the leaderboard shows (see section 4).
Service providers that run parts of the Service for us, such as Google (sign-in, and measuring our advertising — see section 8) and Paddle (payments), only as needed to run it.

Our servers are located outside your country, so your data is transferred there, over an encrypted connection, to provide the Service.

4. Leaderboard

The dashboard shows a leaderboard of who answered the most questions this week and this month. For the top places it shows your first name and the initial of your last name (as given by your Google account) and how many questions you answered. Each user can also see their own rank. Your email address is never shown. To keep your name off it, switch on Hide my name under the leaderboard: other users then see you as "Anonymous student" (you keep your place). If you would rather not appear at all, email support@pastpaper.cc and we will remove you.

5. Watermarking

Question images carry a faint "pastpaper.cc" watermark to discourage redistribution of copyright material. The watermark is the same for everyone and contains no personal data.

6. How long we keep it

We keep your account details, study history, sign-in records and page-visit records for as long as your account exists, because your progress and statistics depend on them and the records help us protect your account. If you ask us to delete your account, we delete your personal data within 30 days, keeping only what the law requires us to keep. Page views, searches and hint reveals by people who are not signed in are kept as individual records under the scrambled visitor code described in section 8, never with the IP address itself. Payment records are held by Paddle under its own retention rules.

7. Your rights

You can ask us for a copy of your data, to correct it, to delete it or your account, or to stop showing you on the leaderboard. Depending on where you live you may also have the right to object to or restrict certain processing, to withdraw consent, and to complain to your national data-protection authority.

To exercise any of these, email support@pastpaper.cc. We will respond within 30 days.

8. Cookies and visit counting

We use one essential cookie, topical_session, which keeps you signed in. While you sign in with Google we also set a session cookie that holds a one-time security code for the sign-in; it is removed when sign-in finishes, or expires after 14 days if you abandon it. They are not used for tracking or advertising, and the Service cannot work without them. Paddle may set its own cookies during checkout.

If you open the Service through a friend's referral link, we also set a pp_ref cookie holding their referral code for up to 30 days, so the referral can be credited if you sign up. It is removed when you sign in, and it is not used for tracking or advertising.

We also set two cookies that help us understand visits, without any advertising: pp_vid, a random code (containing nothing about you) that lets us recognise a return visit from the same browser, kept for about 13 months; and, on your first visit while signed out, pp_src, which remembers the first page you opened, the website you came from and any campaign tags in the link, for up to 30 days, so we can see how you found us if you sign up. pp_src is removed when you sign in. You can delete either cookie in your browser at any time.

To count how many people visit, we record each page view. If you are not signed in, we store a one-way scrambled (hashed) combination of your IP address and browser instead of the address itself, together with the pp_vid code. The same code is stored with the pages you view while signed in, so visits made signed out from the same network and browser can be matched to your account; we use this only to leave our own visits out of the site statistics. If you are signed in, the page view is also linked to your account, as described in section 1. Searches and filter choices in the question bank are recorded the same way, and so are the hints you open without an account (so we can apply the free hint allowance for visitors).

With each page view we also store your approximate location — country, region and city — worked out from your IP address. The lookup uses a location database kept on our own servers, so your IP address is not sent to anyone else for it, and for page views only the location is stored, not the address. This location is approximate: it is often your internet provider's location rather than yours. IP geolocation by DB-IP.

Google Ads. We advertise the Service with Google Ads. To measure how people who see or click our ads use the Service, every page loads Google's tag (gtag.js). It sends Google the address and title of the page you are on, the website you came from, your IP address and details of your browser and device, and it may set or read Google cookies (for example _gcl_au). Google uses this under its own policies, described at policies.google.com/technologies/ads. We never send Google your name, email address, account details or anything you answer on the Service. You can limit ad personalisation at adssettings.google.com, and you can block or delete these cookies in your browser; the Service works without them.

9. Children

The Service is aimed at secondary-school students (IGCSE and A-Level). If you are below the age at which you can consent to an online service where you live (for example, under 14 in the Republic of Korea), a parent or guardian must agree on your behalf. If you believe a child has given us data without that consent, contact us and we will delete it.

10. Changes

We may update this notice as the Service changes. The date at the top shows when it was last updated. If we make a material change, we will say so on the site.

11. Contact

The Service is operated as pastpaper.cc. For any privacy question, or to request our full legal and registration details, email support@pastpaper.cc.