Privacy policy

Version 2026-09-25. Written to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). When you agree to this policy we record the version and the time.

What we collect and why

• Email address — to create your account, send you sign-in codes, and contact you about the beta and your plan.
• If you choose to sign in with Google: the name, email address and profile picture link Google shares with us, kept with your account. Google’s sign-in tokens are stored encrypted and are not used for anything else.
• Sign-in sessions — the IP address and browser (user agent) each session started from, to keep you signed in and to protect accounts from abuse; and a count of recent sign-in attempts per IP address, to slow down guessing. The same kind of count, per IP address, limits how often error reports and waiting-list sign-ups can be sent; each count is kept for a minute after the last request and deleted within an hour.
• Planned test date, target level and first language — to plan your preparation and time reminders.
• Your last sound and microphone check — whether it worked, when, and in which browser — so a practice test does not ask twice.
• Your practice tests — the answers you choose, the text you write, how long each Speaking recording ran, and when each section started and ended — to run the test’s clocks on our server, score it and show you your report. The report, with your answers and texts, is kept with your account.
• Your responses — to score them and show you feedback. For Speaking, that is the recording of your voice and the text our speech recognition makes of it, with word timings. See Speaking recordings below.
• Questions you flag on your reports — which question, the reason you pick and your note if you write one — so that the question is checked automatically and you can see the outcome. See Flagged questions below.
• Your plan and its quota — whether you are on the free plan, a subscription or a pack, and which of your practice tests and section practice used your free test, your plan’s weekly quota or a pack, and when — to give you what your plan includes and keep to the quotas on the pricing page.
• If you buy a plan: payments are processed by Stripe (see who processes your information). On Stripe’s checkout page, Stripe collects your name, email address, billing address and payment method; your card details go to Stripe, not to us. We keep the Stripe customer reference for your account, your plan or pack with its status and dates (purchase, renewal, cancellation, expiry), Stripe’s identifiers for your subscription and payments, and — if you ask for the refund on your first purchase — when you asked and when it was refunded, with Stripe’s reference of the refund, so it is applied once — to give you the plan you paid for and to answer questions about a payment.
• Your CELPIP® test result, once you have it — only if you choose to enter it, with a separate, explicit consent, to measure our accuracy. Published only in aggregate. See Your CELPIP® test results below.
• Basic usage events without cookies — to see whether the product works. They are counted with Umami Cloud (servers in the United States and the European Union); the query part of a page address is never sent, and a browser’s Do Not Track setting is respected. No advertising trackers.
• Page-load measurement without cookies — Cloudflare Web Analytics, from Cloudflare, which runs the website: each page view counts the page address, the referring site, the browser, operating system and device type, the country and how fast the page loaded. It sets no cookies, stores nothing on your device and does not fingerprint your browser; we see only totals.
• Error reports without personal data — to find and fix what breaks. See error logs below.

Cookies

Only the sign-in cookies: one holds your session, a second holds a signed copy of it for up to five minutes so pages load faster. Both are strictly necessary, cannot be read by page scripts (httpOnly), are sent only over HTTPS, and end when you log out or after 30 days without use. No tracking or advertising cookies.

Speaking recordings

• What: the audio of each Speaking answer you record in a practice test, and the text our speech recognition makes of it, with the time each word was said.
• On your device: while you record, and until the recording has reached our storage, it is kept in your browser’s storage on this device, so a lost connection or a closed tab does not lose your answer. The audio is removed from the device once it is uploaded.
• Where: the audio goes from your browser straight to a private Backblaze B2 storage bucket in the European Union (the Netherlands). To make the text, our server runs speech recognition (the Whisper model) on Cloudflare Workers AI, on Cloudflare’s network, which includes locations outside Canada. Cloudflare does not keep the audio or the text for this and does not use them to train models. The text and the word timings are stored with your practice results in our database.
• How long: the audio is deleted automatically 30 days after it is uploaded — within 32 days at the latest, because our storage deletes on a daily schedule. If you delete your account sooner, its recordings are deleted with it (see Deleting your account). The text stays with your practice results until you delete your account.
• If nothing was recorded — for example, you started with a microphone that did not work — the task is marked as not scored and no audio is sent anywhere.

Waiting list and beta cohort

• What we store: your email address, the planned test date if you gave one, whether you agreed to share your result, and the time you signed up. Nothing else is stored with it — no IP address, no device identifier (only the short-lived per-IP count described under sign-in sessions, which is not linked to your entry).
• Why: to invite you to the beta and, only if you agreed, to ask for your result after your test so we can measure our accuracy. Results are published in aggregate only. Joining the list does not create an account.
• Where: in Cloudflare’s key-value storage, replicated across Cloudflare’s network, which includes locations outside Canada. Your address is stored under a hashed key so it never appears in a listing.
• How long: until you ask us to remove it, or twelve months after the beta closes, whichever comes first.
• Removal: deleting your celpip9 account removes the entry for the same address at once. Without an account, write to privacy@celpip9.com from the address you signed up with; the entry is deleted within 30 days.

Error logs

• Our server: when our server code fails, sign-in included, it writes one log entry — what failed (the error’s name and message), the page path without the part after “?”, and the kind of request. Anything in the message that looks like an email address, an IP address, an identifier, a long number or typed text is removed first. Cloudflare’s per-request logs, which would record full addresses and IP addresses, are turned off.
• Your browser: on in this version of the site. When it is on and a page breaks, the page sends a report to our own server — never to another company — with the error’s name, message and code location after the same removal, the page path without the part after “?”, whether it happened during a practice test, your browser family (for example Safari) and whether you are on a phone. Never your answers, recordings, email address, cookies or your browser’s full identification string.
• Where and how long: Cloudflare Workers Logs, in our Cloudflare account; Cloudflare’s network includes locations outside Canada. Entries are deleted automatically within seven days.
• Why: to find and fix problems, especially ones that interrupt a practice test. Error logs are not used to identify anyone, and not for analytics or advertising.

Your CELPIP® test results (optional)

• What we store: the test date, the level you enter for each component (0 to 12; any can be left blank), which of your practice tests here came before it if you choose one, and when you entered it. We never ask for your CELPIP® account, your test or candidate number, or the score report itself.
• Why: to compare the levels test takers receive with the levels we estimated before their test, and so measure how accurate our estimates are and correct them where they drift.
• What is published: only totals across test takers — the average difference between our estimate and the reported level, and how many results it is based on — and only once at least 30 test takers have shared. Never an individual result. The comparison uses a one-off extract that holds no name, email address, account identifier or date; it is kept for the calculation only, not in our code repository.
• Consent: a separate choice, asked on the Progress page before anything is stored, and not needed for anything else in celpip9. We record the version of the consent text and the time.
• Where: with the rest of your account in Cloudflare’s D1 database (see below).
• How long: until you delete the result, turn sharing off, or delete your account. Turning sharing off deletes every result you entered, at once. Totals already published are not recalculated.
• Who sees them: you, on your Progress page, next to our estimates. We work only with the de-identified extract described above.

Flagged questions

• What we store: the question you flagged, from which of your practice tests, the reason you picked, your note if you wrote one, when you flagged it, and how the check ended.
• Why: every flagged question is re-solved automatically by an independent AI solver that sees only what a test taker sees — never your note, your answers, your name or your email address. If the check does not confirm the answer key, the question stops counting in new tests. How many people flag a question is also part of the answer statistics that take a question out of scoring. No one at celpip9 reviews flags one by one.
• Where and how long: with the rest of your account in Cloudflare’s D1 database, until you delete your account. It is part of “Download my data”.
• What stays after your account is deleted: our log of decisions about questions — that a flag was opened and closed, under the flag’s own random number, with the reason code you picked. It holds no account, no note and no answer, so nothing in it links to you.

Consent

We ask for consent when we collect personal information: when you create an account, or — if you signed in with Google or with a new address on the log-in page — on your first visit, before anything else. Sharing your test result is a separate consent. You can withdraw consent at any time: withdrawing the result-sharing consent deletes the results you reported; withdrawing consent to this policy means deleting your account.

Who processes your information, and where

• Cloudflare — runs the website, measures page loads (Web Analytics, above), keeps the error logs described above, and stores accounts, sessions, profiles, consents and practice results in its D1 database. The database’s primary location is in North America, outside Canada; Cloudflare does not guarantee the exact location. While a practice test is open, its answers and texts are held in a record of their own on Cloudflare (a Durable Object), usually in a location near where you started the test.
• Resend — sends the sign-in and account-deletion code emails, from the United States, and keeps them in its logs for 30 days.
• Google — only if you choose to sign in with Google.
• Stripe, Inc. — processes payments if you buy a plan: checkout, subscriptions, the customer portal where you cancel, invoices and sales tax. It receives your name, email address, billing address and payment method, and processes them in the United States and elsewhere under Stripe’s privacy policy. It is not used if you stay on the free plan.
• Umami Cloud — the usage counts described above (United States and European Union).
• Backblaze B2 — stores audio files in the European Union (the Netherlands): the Listening recordings and, for 30 days, your Speaking recordings.
• Cloudflare Workers AI — speech recognition for your Speaking recordings (see Speaking recordings).
• Anthropic — its Claude models score your Writing and Speaking responses, in the United States. It receives the task and the text of your response (for Speaking, a transcript of the recording), never your name or email address. Each score and what it cost are kept with your account; the cost records stay after an account is deleted, with nothing that links them to you. Its models also re-solve questions that test takers flag; for that they receive the question and its text only (see Flagged questions).

Your information is therefore processed outside Canada, mainly in the United States and the European Union, where courts, law enforcement and national security authorities may be able to access it under the laws there.

How long we keep it

• Your account and everything in it: until you delete the account.
• Your plan, its payment references and which tests used its quota: with your account, until you delete it. Stripe keeps its own records of your payments, invoices and tax for as long as the law requires them.
• CELPIP® test results you entered: until you delete them or turn sharing off, which deletes them at once — or until you delete the account.
• Speaking audio: 30 days after upload (32 at the latest); its text stays with your account.
• Sign-in and account-deletion codes: ten minutes, stored only in scrambled (hashed) form, and deleted once used.
• Sessions: until you log out, or 30 days without use.
• A practice test’s own record on our exam server: until about an hour after the test ends and its report is saved to your account; it then deletes itself. A test left unfinished is closed 24 hours after it started. If a report cannot be saved, saving is retried for about a day and the record is deleted seven days later. A test you discard ends without a report; that you started it stays with your account, because it counts toward your plan’s tests.
• After a deletion: see deleting your account below.
• Records of any breach of security safeguards: 24 months, as PIPEDA requires.

Deleting your account

In Settings, choose “Delete my account and data” and enter the 6-digit code we email to your address, so that nobody else using your browser can do it. An account that has not yet agreed to this policy is deleted without a code.

Deleted at once

• From our database: your account, sign-in sessions and any linked Google sign-in, profile, consents, practice tests and their reports, your Writing and Speaking responses as sent for scoring with their scores, sound and microphone check, the results you reported, the questions you flagged with your notes, and any pending sign-in or deletion code.
• Your plan: an active subscription is cancelled at Stripe at once, so nothing more is charged, and our billing records — your Stripe customer reference, your plan and packs, which tests used their quota, and any refund you asked for — are deleted from our database.
• Your waiting-list entry for the same email address, with any repeat sign-ups.
• The records of your practice tests on our exam server, including a test still open (its clock stops for good and nothing from it is scored or saved).
• Your Speaking recordings in our file storage (their text goes with your practice data above).
• What celpip9 kept in the browser you delete from. Other browsers you used keep their local copy (the list of your practice tests; earlier versions of the site also kept your plan choice there) on that device, no longer linked to any account, until you clear the site’s data there.

What remains for a short time

• Database recovery history: our database provider (Cloudflare D1) keeps a point-in-time history of the whole database for 30 days on our plan, and it cannot be switched off. We would use it only to recover the whole database after a failure, never to read or bring back a single account.
• Emails: the code emails we sent you, with your address, stay in our email provider’s (Resend) logs for 30 days.
• Cost records: what scoring your responses cost us (the day, the task type, the amount) stays in our spending ledger, with nothing that links it to you.
• Question decisions: the log entries for flags you opened (a random flag number, the question and the reason code), with nothing that links them to you — see Flagged questions.
• Server logs: we record that an account was deleted, without your email address or account id, in the same logs as errors; entries are deleted automatically within 7 days.

If you bought a plan, Stripe keeps its own records of your payments, invoices and tax, as the law requires it to; see Stripe’s privacy policy. Deleting your account does not refund the current period unless the refund terms apply.

If you signed in with Google, Google keeps its own record that you allowed celpip9 to see your name and email address until you remove celpip9 from the third-party access list in your Google Account; we keep nothing from it. Aggregated, de-identified statistics are not affected.

Your rights

You can have a copy of your data, correct it, or have it deleted. In Settings, “Download my data” gives you at once a file with everything we store about you — our database, table by table, your waiting-list entry, and any practice test our exam server still holds (open, or closed less than an hour ago); sign-in tokens and codes are left out because they are credentials, not information about you. You can correct your details in Settings and delete your account there (above). Requests by email are completed within 30 days. Contact: privacy@celpip9.com.

AI processing

Responses are processed by AI models from third-party providers under contracts that prohibit training on your data. Speech recognition of Speaking recordings is described under Speaking recordings. We do not sell personal information.