Privacy notice

Optional growth measurement

Only after you choose Allow measurement, English Test Coach uses a random site-specific cookie for up to 30 days to understand the journey from public samples and free practice to a verified new account and a first saved practice completion. Our private Growth Engine, hosted on Cloudflare, receives a random visitor reference, event type, time and an allowlisted public page path. It receives no names, emails, writing, scores, payment details, full referring addresses, search queries or advertising identifiers. Unknown acquisition sources remain unknown. One visit per public page per day is counted, so these observations are not a complete traffic total.

Choose Privacy choices at the bottom of any page, then Turn off or No thanks, to stop future collection and cancel pending deliveries. Previously delivered pseudonymous events remain in the Growth Engine for up to 90 days. On this website, the visitor reference expires after 30 days and associated delivery records are removed during hourly maintenance. Minimal account-linked first-signup and first-completion markers prevent duplicate counts and remain until account deletion; they contain no learning content. Account export and deletion cover these local account-linked records. Global Privacy Control and Do Not Track requests disable optional collection. Declining does not affect free practice, sign-in or saved work.

When enabled on this website, the same Allow measurement choice also loads Google Analytics 4 (Google) and Microsoft Clarity (Microsoft). Nothing from either tool loads before you allow it, or when Global Privacy Control or Do Not Track is on. Google Analytics receives the public page path you visit, page title, approximate location, device and browser details; it never receives query strings or private account pages, and Google signals and ad personalisation are off. Clarity records clicks, scrolling and page layout on public guide pages to show how people use them, with text inputs masked; it never runs on the writing, speaking, vocabulary-writing or lesson-practice pages, or on account pages. These providers may process data outside the UK and EEA. Their cookies (_ga, _clck, _clsk) last up to 13 months. Choosing Turn off removes these cookies from this site and stops both tools.

What English Test Coach processes

We process your account email, writing prompts, essay text, generated feedback, revisions, listening score summaries, usage records, subscription status, and limited security information such as rate-limit identifiers.

Why it is processed

This information is used to provide writing feedback, save your history, enforce allowances, maintain security, support subscriptions, and diagnose service failures.

Operational analytics

When operational monitoring is enabled, English Test Coach sends PostHog the type of operation, whether it completed, failed or was blocked, and a broad response-time range. Each operation receives a new random identifier unrelated to your account or other requests. This monitoring does not send writing, questions, feedback, scores, images, recordings, email addresses, account identifiers, browser addresses, cookies or network addresses. It does not use browser tracking, session replay, advertising identifiers or person profiles. Delivery is limited and best-effort, so these counts are not a complete usage or billing record. Operational monitoring delivery to PostHog is currently disabled. Enabled delivery remains subject to capacity and availability; this status does not certify a particular event was sent.

Product measurements

A separately enabled measurement system can keep your first measured sign-in, first saved-writing completion, first checkout visit, first verified paid status and daily writing-activity flags in Cloudflare, linked to your account. These records contain no submitted content or scores and are included in private account export and deletion. They help measure whether people reach useful feedback and return to write again. When delivery is enabled, PostHog receives fixed daily totals and seven-day group totals, not your identity or individual activity trail. Published aggregate snapshots remain after account deletion because they have no account-level entries to remove; unreported account detail is removed. A first measured sign-in is not a historical signup count, and missed observations or deleted accounts can affect totals. No additional AI call, email or payment is triggered. Account-linked activity collection is currently disabled. Daily aggregate delivery to PostHog is currently disabled. These settings do not replace approval of the applicable lawful basis, retention and public launch.

On-device spelling review

The editor downloads its spelling checker and British/American dictionaries from English Test Coach on Cloudflare. Spelling review runs on your device in a separate browser worker; it does not send your writing to a spelling or AI service. Ignored words are kept only for this open writing-format session. Choosing a suggestion changes your draft locally and can be undone. The existing device backup and signed-in cloud-draft sync still apply to any draft changes; spelling review does not create an assessment or use an AI allowance.

Service providers

Cloudflare provides application hosting, database infrastructure and Workers AI inference for the free writing-assessment preview. Clicking AI analysis sends your question, writing and any Academic Task 1 image to Cloudflare. Signed-in assessments can retain the original image privately as described below; guest images are not saved to history. Topic planning sends only the question and writing format. Detailed vocabulary feedback sends the selected topic, language function and three submitted sentences; its result stays in the open page and is not saved to an account. Study revision sends the submitted question, response and any required Task 1 image; preview revisions remain in the open report. The Generate and save action on an owned saved report stores generated text and explanations alongside the original in D1; the revision does not replace the assessment image, and cached revisions do not trigger inference. No paid provider fallback is used. Stripe processes checkout and subscription information when paid plans are enabled; English Test Coach does not store complete payment-card details.

Assessment saving and duplicate requests

Signed-in assessment saves require the same session to remain valid after generation. Saved reports, matching practice completion and monthly-action completion are recorded together. A short-lived hashed request fingerprint prevents simultaneous identical assessments and contains no raw writing or image text. Repeating a completed assessment is a new AI action. Shared attempts still count after provider or storage failure; an expired account session is never silently converted to a guest assessment.

Connection recovery

The signed-in editor creates a random request reference before sending an AI assessment. Cloudflare D1 stores its account owner, hashed submission fingerprint, generated report identifier, status and timing so a lost response can be checked without running AI again. A used reference cannot start another assessment. Your device stores only the reference and its creation time under your account; this reminder is removed after a confirmed result or dismissal. Reconnecting checks for the exact saved report automatically for up to three minutes, without replacing your current draft. It does not guarantee background completion or retry a failed assessment. Guest results are not covered. Request metadata remains with the account until account deletion; account export includes the reference, report identifier, status and times, but not the internal fingerprint.

Saved original task images

A signed-in Academic Task 1 assessment pins the exact original image to its saved text report, then saves its bytes privately in Cloudflare R2 when available. Image-save failure does not erase a saved text report; its status is shown separately and the exact original can be retried without AI. Images can be reopened, downloaded and deleted. Up to 100 active images, 200 MiB per account and 1 GiB shared image storage are supported. Deleting an essay or account also requests image removal. Empty storage markers prevent delayed uploads from restoring deleted bytes; Account offers recovery when deletion is interrupted. Account export contains metadata and private download paths, not image bytes or storage keys. Older reports without a pinned image cannot accept a replacement as a verified original. Device and cloud drafts still exclude images; open and downloaded copies are not remotely erased.

Sign-in and sessions

You can create an account with your name, email and password, or use a single-use email code. Passwords are stored only as salted, memory-hard hashes, never plain text. Resend processes your address and code to deliver verification, sign-in and password-reset messages. D1 stores hashed verification values, destination, pending account details and attempt/expiry times; codes are valid for ten minutes and pending credential values are cleared when used. Expired requests are removed during subsequent sign-ins or maintenance. A temporary Secure, HttpOnly cookie binds verification to your browser. When Google sign-in is configured, Google supplies your verified email, name and a stable account identifier; we retain that identifier for account linking, not Google access or refresh tokens. An additional email check may be required. We request no access to your mail, files or contacts. A separate Secure, HttpOnly session cookie identifies your browser; only its hash is stored in D1. Sessions last at most eight hours. Customer sign-out revokes this browser session, and resetting your password revokes all sessions. Cloudflare Access remains for owner/private protection; signing out of an Access-created session also ends that Access sign-in. Deleting account data removes credentials and pending email challenges and revokes all English Test Coach sessions. Local drafts and notes remain on the device after sign-out.

Guest preview

Guest essays and reports are not saved to account history. Download your report before leaving. Guest drafts and planning notes are stored only on the device. Hashed network identifiers and attempt counters are stored in Cloudflare D1 to enforce daily limits. Do not submit sensitive personal information to this preview.

Device draft backups

The editor keeps the question, answer, writing format and target band together in a device-only backup, separate from cloud records. Guest and account backups use separate storage. Existing older-format backup text is retained during migration; an empty current backup prevents cleared text from reopening automatically. Older device text remains until account-device cleanup or removal of the browser's site data. Unreadable backups and detected conflicting copies pause device saving and offer recovery controls. This is not a complete version history or a guarantee against simultaneous writes from multiple tabs. Task images and planning notes are not included.

Mobile app and connected apps

The Android and iPhone app stores downloaded teaching material and writing backups on your device, with guest and account drafts kept separately. App sign-in tokens use the device's secure credential storage. Mobile cloud drafts are saved when you choose Save to cloud; opening a task or typing does not request an AI assessment. Connecting ChatGPT gives it the permissions you approve: reading saved writing, drafts and study progress, saving drafts and practice completion, and, if separately included, requesting a metered writing assessment. Requested tool results are sent to ChatGPT and handled under the policies and settings of your OpenAI account. Public teaching material can be used without account access. English Test Coach stores hashed app credentials, consent, permission scopes and expiry in Cloudflare D1. Access tokens last up to one hour and connections up to 30 days. You can revoke a connection in Account → Connected apps; mobile Disconnect also requests revocation. Password reset and account deletion revoke app access. Revocation and deletion do not erase work already downloaded, copied into a ChatGPT conversation or retained on a device.

Cloud writing drafts

For verified accounts, English Test Coach checks the exact question after a short pause and automatically saves a changed, non-empty response plus its writing format and target band to D1. Task images, planning notes and AI reports are excluded. An empty device response can load an existing cloud draft automatically; differing non-empty copies require your choice and are never overwritten automatically. A failure or timeout pauses sync without retrying silently. Clearing removes the cloud text, retains a version marker to prevent stale restoration and pauses sync for that question. Up to 50 active drafts and 500 total question slots are supported. Drafts and cleared markers are included in account export and removed by account deletion.

Cloud planning notebook

For verified accounts, English Test Coach checks the cloud copy after device notes load and automatically saves changed, non-empty planning notes after a short pause. It stores the exact question, format, structure and notes in D1 without the essay, image or AI processing. An empty device automatically loads an existing cloud copy; differing non-empty copies require your choice and are never overwritten automatically. A failed save pauses sync instead of retrying silently. Clearing erases the cloud text, retains a version marker to prevent stale restoration and pauses automatic sync for that question. Cloud copies and cleared markers are included in account export and removed by account deletion. Up to 100 active plans and 1,000 total question slots are supported.

Speaking practice

Optional microphone recordings begin only after you click Record and grant browser access. Recording and playback initially stay on your device. Choosing Transcribe on a take sends a locally converted audio copy to Cloudflare Workers AI for English speech recognition, using one attempt from the same daily pool as writing. Nothing uploads automatically by recording, and no paid fallback or automatic retry is used. A cancelled upload may already have reached Cloudflare and consumed an attempt. The transcription request itself does not persist audio or text. If you later choose Save current text review while signed in, the selected transcript and your edits are stored in D1 as part of that private snapshot; that text-only action excludes audio. Choosing Save review and recordings separately uploads the captured audio to private Cloudflare R2 storage. Recordings, automatic transcripts and your edited transcripts remain in this tab until you remove the take, leave or change sets; downloads can retain both the original automatic text and your edits. Recognition can omit words or errors and is not pronunciation or fluency assessment. Preparation notes, manual reconstructions and self-review are not sent to AI. They are included only when you explicitly save a private text-review snapshot. Local transcript checks count only visible words, typed filler expressions and linking markers; they do not analyse audio, pronunciation, meaning or grammar accuracy. Speaking-course choices and notes remain only in page memory. For signed-in learners, checking a lesson saves only its identifier, best score and completion/update times in D1; it never saves choices, notes, transcripts or audio. Leaving, refreshing or switching sets clears the relevant page session. Downloaded files remain on your device.

Saved speaking reviews

Save current text review stores a fixed snapshot of the selected original speaking set, timed stages, preparation notes, self-ratings, reflections, manual reconstructions, recording references and automatic/edited transcript text in Cloudflare D1. Pronunciation assessments and IELTS scores are not stored. Audio is stored separately only when you choose Save review and recordings. Later edits do not update an earlier snapshot. Up to 50 active reviews and 500 snapshot identifiers are supported. Deleting a review erases its text and requests removal of attached audio. Minimal deletion markers prevent delayed uploads from restoring removed work. If audio removal is interrupted, the private speaking-history page offers Finish audio deletion even after the text review is gone. Account export includes these records and markers; account deletion removes them. Copies already downloaded or open on a device are not remotely erased.

Personal vocabulary

Choosing Save phrase or Save word stores your word, meaning, example, original context, source reference and learned status in private Cloudflare D1 storage. No AI is used. You can save words from English Test Coach vocabulary lessons, select or type phrases from a listening transcript, or add your own entry. Up to 300 active entries and 1,500 entry identifiers are supported. Conflicting versions require your choice. Deleting a word erases its text and keeps a minimal version marker to prevent a delayed request from restoring it. Account download includes saved entries and markers; account deletion removes them. Open edits are page-only until a save is confirmed, and downloaded copies remain on your device. Definitions and learned status are personal notes, not verified language assessments.

Vocabulary progress

Vocabulary answers and your own sentences remain only in the open practice page. After a signed-in learner completes a round, D1 stores only each allowlisted phrase identifier, whether it has ever been matched, and first-check/update times. Account progress never stores the submitted answer or sentence.

Writing-course progress

Writing-lesson quiz choices and exercise writing remain only in the open page. For signed-in learners, checking a lesson saves only its allowlisted identifier, best score and completion/update times in D1. The submitted choices and exercise response are never included.

Progress overview

The private progress overview reads your existing practice, listening, course and vocabulary records. It does not create a combined score, send this activity to AI or treat unavailable records as zero. Suggested next steps use deterministic incomplete or lower saved checks and are not IELTS diagnoses.

Listening practice

Prepared audio is served from English Test Coach on Cloudflare. Answers, corrections and audio activity stay in the open page and are never uploaded or sent to AI. For signed-in complete-practice attempts only, English Test Coach automatically saves the total raw mark, four section marks, elapsed seconds, whether the timer ended, and date in private D1 history. Signed-out results are not stored. Up to 100 summaries are retained, included in account export and removed by account deletion. Audio does not autoplay and no microphone is requested.

Vocabulary practice

Recall answers, marks and example sentences stay in page memory. The three-sentence writing activity also stays local unless you explicitly request detailed feedback. That action sends only the selected topic, language function and three sentences to Cloudflare AI, uses the shared free attempt pool and keeps the result in the open page; it creates no account record and makes no automatic retry. Search terms appear in page URLs, so do not use search for private writing.

Writing essentials

Lesson choices, knowledge-check results and short practice writing stay in page memory. They are not uploaded, sent to AI or saved. Downloads remain on your device.

Storage and control

Signed-in essays, reports, cloud writing drafts, planning notes, listening score summaries, speaking lesson progress, saved speaking reviews and explicitly uploaded recordings, personal vocabulary entries, vocabulary progress and writing lesson progress are stored for account history. Account export includes these records, and account deletion removes them. Individual saved essays can also be deleted from the dashboard; active cloud drafts can be downloaded or cleared from the private draft library and cleared from their matching editor. Retention periods and the production support contact must be confirmed before public launch.

Account downloads

A private account export reads your saved records from Cloudflare in small requests and assembles the download in your browser. It does not send records to AI or save an extra export in cloud storage. Keep the page open and avoid changing saved records while preparing the file; the download is not a point-in-time database backup. A prepared-file link remains available until you leave the page or start another export. Files already downloaded remain on your device. The export contains saved recording metadata and private download paths, not audio bytes. Download WAV files separately from each private speaking review before deleting them. Unsaved device-only work is not included.

Account email

When account email delivery is enabled, verified sign-in can queue a setup message through Resend. Verified subscription changes can queue billing updates, and completed AI actions can trigger a monthly allowance notice. These do not enrol you in marketing or send another sign-in code. We send your email address and the account message, which may include subscription status or a completed-action count, never card details, writing, feedback or scores. Billing messages are not payment receipts. A private preview restricts delivery to the configured owner test address. Delivery records and pending message text appear in account exports; accepted message text is removed locally. Deletion removes queued messages and address-linked message records. Email already accepted by the provider, delivered to a mailbox or in flight cannot be recalled by deleting English Test Coach data. Provider retention and the lawful basis for account email require review before activation.

Email delivery safeguards

Signed delivery notifications update message status. A permanent bounce or spam complaint pauses account emails for that product and deployment environment. English Test Coach retains a hashed recipient fingerprint, opaque delivery keys, suppression reason and timing after account deletion so a late complaint cannot be bypassed by recreating an account. These records contain no raw address, message text or learning content, but are pseudonymous personal data, not anonymous data. Your private export includes your retained delivery keys and suppression records, including after signing in again. Shared webhook receipts contain only event references, types and processing times. Message bodies, tracking pixels, opens and clicks are not collected through this endpoint. The retention schedule and lawful basis for these safeguards require approval before activation.

Your choices

Do not submit information you do not want analysed. Depending on where you live, you may have rights to access, correct, delete, restrict, or export personal information. The account page provides self-service export and deletion.

Operational recovery

An explicitly configured owner account can review unfinished checkouts against Stripe and uncertain account-message delivery against Resend. This cannot create another charge, resend a message or guess that a missing payment failed. Email recovery checks the original recipient, sender, message and delivery tags; provider text is used for matching but is not added to the audit, and confirmed message text is removed locally. A bounce or complaint keeps account email paused. Recovery retains a minimal audit: product and environment, hashed account and operator fingerprints, an opaque target reference, request fingerprint, action, outcome and time. It contains no card details, writing or raw email address. These pseudonymous safeguards remain after account deletion to prevent duplicate recovery; your private export includes records about your account without the operator or internal request fingerprint. Retention and lawful basis require approval before activation.

Billing and account deletion

Deleting account data does not cancel a subscription. Resolve or cancel an unfinished or unpaid subscription through Manage subscription first. To prevent old payment notifications from restoring a deleted billing record, English Test Coach retains an account fingerprint and the deletion time. The marker contains no writing, raw email address, Stripe identifiers or payment details, but is pseudonymous security data, not anonymous data. Its retention period and lawful basis must be approved before paid launch.

Unfinished checkouts

Before opening Stripe, English Test Coach saves one checkout reference, its offer and return settings, status and timing in private D1 storage. This lets retries reuse the same checkout. Card details are entered at Stripe and are never stored by English Test Coach. An unfinished or unconfirmed checkout must be resolved before account deletion; you can close an open checkout from Account. A record is removed after confirmed expiry, or after checkout completion and subscription reconciliation, not merely because local time elapsed. If the result remains uncertain beyond the safe Stripe retry period, a billing review is required before another checkout can be created.

Important launch requirement

This draft is not a substitute for legal review. The business identity, contact details, lawful bases, retention schedule, international-transfer terms, and jurisdiction-specific rights must be completed before public launch.

Saved audio storage and removal

Explicitly saved speaking takes are converted to WAV and stored in private Cloudflare R2 storage. D1 stores ownership, recording identifiers, checksums, sizes, durations and save/deletion status. Up to 100 active recordings and 200 MB per account are supported, with a shared preview capacity limit. Older recordings are not removed automatically to make room. Up to 2,000 recording identifiers, including deletion markers, are retained per account. Audio deletion replaces the file with an empty, non-personal storage marker so a late upload cannot restore it. These empty markers must not be expired while delayed uploads could still arrive. Account deletion ends all sessions before audio cleanup; if cleanup fails, sign in again and open speaking reviews to finish the already requested deletions without deleting new work. Copies already downloaded or open on a device remain there.