1. Who this policy covers
This policy describes how the Zenith test-preparation service (“Zenith,” “we,” or “us”) handles information on this website and in its study workspace. It covers visitors, account holders, and people contacting us. Use the Contact page for privacy requests or questions. Zenith is an independent study service, not College Board, an exam administrator, a school, or a government agency.
2. Age and children’s privacy
Account registration is for people age 13 and older. Users under 18 must have permission from a parent or legal guardian who has reviewed the Terms and this policy. Do not create an account or submit personal information if you are under 13. A parent’s permission checkbox does not make an under-13 account eligible, and Zenith does not offer an under-13 parental-consent enrollment programme.
The signup age check asks for an age range rather than a full birth date or identification document. If the check indicates an ineligible age, we do not open the account-details form. A short-lived, non-unique restriction cookie helps prevent immediately repeating the check with a different answer. We do not create an account from that check. Basic hosting and security request records may still be processed.
If you believe a child under 13 has provided information, a parent or guardian should use Contact and select “Child privacy concern.” Give only the information needed to identify the account; do not send identity documents. We will investigate, stop further account use where appropriate, and delete information collected contrary to this policy, except records we are legally required to retain. Reporting a concern does not authorize marketing to a child.
3. Information we collect and its sources
You provide account details such as your name, email, password, age range, and acceptance of our policies. Optional information includes a profile picture, school, selected exam and test date. Passwords are stored as salted hashes, not readable passwords. A profile picture you upload is stored as account content; we do not use it for facial recognition.
When you study, we store your answers, written responses, question flags, practice timing, test status, results, saved suggestions, and related progress. Summit AI conversations and support messages are stored when you send them. Account preferences, lesson completion and written lesson reflections are synced to your account when connected, with a browser copy for recovery. Unsaved test drafts and local speaking-practice recordings remain in your browser. Device-specific floating-panel placement is also remembered in that browser.
Our hosting and security services receive technical request information such as IP address, browser or device information, requested pages, timestamps, and errors. Security controls may use a hashed network identifier to limit abuse. We also receive payment confirmation and limited order information from Stripe when payments are available. We do not buy personal information from data brokers.
4. Why we use information
We use information to provide and secure accounts; save and review study work; tailor exam practice and lesson suggestions; provide the AI help you request; process and reconcile purchases; answer support and privacy requests; and investigate fraud, misuse, and technical failures. These uses do not determine admission, official exam scores, employment, or access to credit. We do not use study answers to make such eligibility decisions.
Please avoid sending government identifiers, payment-card numbers, medical information, other people’s private information, or confidential school records in chat, support messages, profile pictures, or written responses. Do not include more personal information than the feature needs.
5. Summit AI and your study context
Summit AI is an automated study tool. When you send it a message, the application may send your message, a limited recent conversation, relevant study results, and structured context from your current Zenith lesson or allowed practice question to the configured AI service. Depending on the deployment, this can be Groq, OpenAI, or an AI model reached through Neon’s AI Gateway. The provider processes that information to generate a response under its applicable service terms and data-processing arrangements.
We do not send your account password or payment-card information as tutoring context. Summit AI does not receive a video of your screen, other browser tabs, or access to your device. Avoid putting identifying details in messages. Generated suggestions and responses can be incorrect. Zenith does not itself train a foundation model on your conversations; do not assume every external provider has identical retention settings or a guaranteed zero-retention configuration. Provider processing can include safety, abuse-prevention, and reliability handling.
You can use lessons and practice without sending a chat message. The floating companion can be turned off in Settings, and assistance can be disabled for a practice session. Turning it off does not automatically erase previously saved conversations or study records; request deletion through Contact.
6. Microphone and speaking practice
Microphone use starts only after you choose a voice or recording control and your browser permits it. For chat dictation, your browser or operating system may transmit audio to its speech-recognition service. Zenith receives the resulting text when you send it. The visual sound meter runs locally. Read-aloud voices are supplied by the browser or operating system and may use that provider’s services.
Speaking-practice recordings are stored locally on your device for playback, not uploaded to Zenith for automated pronunciation scoring. The service can save that a response was recorded without receiving the audio file. You can remove local recordings through their controls where available or your browser’s site-data settings. Zenith does not use the camera, record your screen, or request precise location.
7. Service providers and other disclosures
Vercel hosts and delivers the application and processes technical requests and logs. Neon stores account and application records. Resend processes recipient addresses and account-email contents when email delivery is configured. hCaptcha processes browser and security information when its verification is enabled. Stripe processes payments and fraud checks through its secure components. The configured AI services process requested tutoring inputs as explained above. Authorized team members may access records as needed for support, service operation, security, or legal obligations.
Zenith does not sell personal information or share it for cross-context behavioral advertising. We do not operate advertising profiles or use advertising cookies. We may disclose limited information when legally required, to protect rights or security, or in a business transfer subject to appropriate privacy protections and notice where required. A disclosure to a provider is not a promise that no information leaves Zenith’s systems.
8. Cookies, browser storage, and external resources
The essential zenith_session cookie keeps you signed in for up to seven days. A zenith_checkout cookie may connect a purchase to account setup for up to 30 days. Theme and companion-preference cookies may last up to one year. The age-restriction cookie lasts up to 24 hours. These cookies are functional or security-related. Browser storage also remembers navigation, walkthrough status, lesson progress, drafts, preferences, and local audio until removed, replaced, or cleared. Clearing site data may erase locally stored work and recordings, and deleting an account alone does not clear a browser you still control.
Fonts are served with the application. External videos are not loaded until you choose “Load video”; loading connects to the video provider, such as YouTube’s privacy-enhanced player, which then receives network and browser information. External lesson links and the Desmos calculator open third-party sites with their own terms, privacy practices, and cookies. They are optional; written lessons remain available.
Zenith records first-party aggregate counts of sample interactions and coarse performance measurements (LCP, INP and CLS, grouped by mobile or desktop). These measurements do not include visitor identifiers, search text, chat messages, recordings or precise location. Optional measurement requests are skipped when Do Not Track or Global Privacy Control is enabled. Because we do not sell or share information for behavioral advertising, there is no such activity to opt out of through Global Privacy Control. If advertising or tracking practices change, we will update the notice and add required choices before starting them. You can manage local storage, cookies, microphone access, and third-party content through browser settings. Blocking essential cookies can prevent sign-in or checkout.
9. Payment information
When checkout is available, Stripe handles real payment details. Zenith does not store full card numbers or card security codes. Our records can include the payer’s email, selected exam, amount, currency, access dates, payment status, Stripe session or transaction reference, and policy acceptance connected to the purchase. Payment-provider records may be retained for tax, accounting, fraud prevention, chargebacks, and legal obligations. An animated card or receipt is a display, not proof that a charge succeeded; the confirmed payment record controls.
10. Retention and security
Account and study records are generally kept while the account is maintained so you can return to your work. A pass or preview ending does not automatically delete them. We retain support, security, and payment records only for service, dispute, fraud-prevention, accounting, or legal needs. There is not currently a fixed automatic deletion period for inactive study accounts. You can request deletion rather than waiting for inactivity.
On a verified deletion request, we remove or de-identify records that no longer need to be kept. We may retain limited records where law or a legitimate dispute or security need requires it. Provider backups and logs follow their own retention cycles; a restored backup must not be used to reintroduce account data that should remain deleted. We cannot clear browser storage on devices you control.
We use measures including HTTPS, hashed passwords, authenticated account access, and restricted administrative access. No website or transmission method can promise absolute security. If an incident requires notice, we will provide it as required by applicable law.
11. Your choices and privacy requests
You can edit profile details in Profile and manage available preferences in Settings. Use Contact to request access, a copy, correction, deletion, or restriction of account information, or to raise a child-privacy concern. Select the relevant request type and identify the account email. Do not send passwords, one-time sign-in codes, card details, or identity documents. We may ask for proportionate verification before releasing or deleting account data, and an authorized agent or guardian may be asked to establish authority.
Applicable state or international law may give you additional rights, including objection, portability, withdrawal of a consent, appeal of a request decision, or a complaint to a regulator. We will process verified requests and appeals within legally required periods and will not discriminate for exercising applicable rights. Exceptions and legal applicability vary; this policy does not assert that every law applies to every account. If you disagree with a decision, send an appeal through Contact identifying the earlier request.
12. Location and school use
Zenith is designed as a direct-to-student service operated from the United States. Hosting, database, payment, email, and AI providers may process information in the United States or other locations where they operate. Protections and available rights can differ by location; mandatory local rights still apply. We do not claim that visiting from another country waives them.
Zenith is not currently offered under a school or district student-data agreement. A teacher or school must not upload class rosters or confidential education records or enroll children under 13 through an ordinary consumer account. Schools needing institutional use should contact us before sharing student records. We do not make a blanket FERPA-compliance certification.
13. Updates and contact
The date at the top identifies the latest revision. We will post changes here and provide additional notice or obtain consent where a material change or applicable law requires it. A new notice does not authorize an incompatible new use of previously collected information without any legally required choice. Contact the Zenith team through the Contact page for questions, requests, or appeals.