mockJLPT Privacy policy
How we handle your personal information under Japan's Act on the Protection of Personal Information (APPI). Last updated 24 September 2026.
Who we are
mockJLPT (mockjlpt.com) is operated by Ayan Sengupta (セングプタ アヤン), sole proprietor, trading as mockJLPT, Japan. Contact for anything in this policy: hello@mockjlpt.com.
What we collect
- Account: your email address. If you sign in with Google, also your name and profile picture from Google.
- Sign-in security: session records, including the IP address and browser type used to sign in, kept by our authentication provider to keep your account secure.
- Your profile (optional): if you choose to add them on your profile page, a display name, profile picture, school or organisation, country, native language and the JLPT level and sitting you're aiming for. They are visible only to you, used to tailor the service and to understand our users in aggregate, and you can change or delete them at any time. Profile pictures are cropped and re-encoded in your browser, which removes location data, before they are uploaded.
- Your tests: the answers you give, time spent per section, and your results. A test started without an account is stored anonymously and linked to your account only if you sign in to see the result.
- Purchases: which level you unlocked, the amount, the date and Stripe's reference. Stripe collects your card details and billing country or address directly; we never see or store your card number.
- Messages: anything you send to hello@mockjlpt.com.
- Technical data: standard server logs (IP address, browser, pages requested) kept briefly by our hosting provider for security and troubleshooting.
Why we use it
- To let you sign in, take tests, save your progress and show your results and history.
- To process payments, unlock what you bought, issue invoices and meet tax and accounting obligations.
- To answer your messages and send the emails the service needs (sign-in codes, purchase receipts from Stripe).
- To keep the service secure, prevent abuse and fraud, and fix problems.
- To improve the tests using aggregated, non-identifying statistics (for example, which questions are most often missed).
We do not sell your personal information, do not show advertising, and do not send marketing email without your consent.
Service providers and transfers outside Japan
We use the following providers to run the service. They process your information on our behalf and only for the purposes above. Several are based in, or store data in, the United States, which does not have a comprehensive federal privacy law equivalent to the APPI; each provider maintains its own privacy and security programme (see their privacy policies).
| Provider | Purpose | Location |
|---|---|---|
| Neon (Databricks) | Database and sign-in (accounts, sessions, test results, purchases) | United States |
| Cloudflare | Website hosting, security, audio and image delivery and storage (including profile pictures), cookie-free analytics | United States (global network) |
| Stripe | Payments, tax calculation, invoices and receipts | Japan and United States |
| Resend | Sending sign-in code emails | United States |
| "Continue with Google" sign-in (only if you choose it) | United States |
We do not otherwise provide your personal information to third parties unless you agree, or the law requires or permits it (for example, a lawful request from a public authority).
Schools
A school that uses mockJLPT for its classes acts as the controller of its students' information; we process it on the school's instructions under the school terms. A school may create student accounts by name and student ID without an email address: such an account carries a technical address on our own domain that receives no mail. Teachers and school admins can see their students' names, IDs, test results, review pages and activity dates, reset their passwords, move them between classes and remove them. Students can ask their school, or us, to delete their account. When a school's licence ends, its staff keep read access to the gradebook for 30 days, after which student accounts the school created are deleted.
Cookies and browser storage
We use only the cookies needed to keep you signed in. The test page also stores your in-progress answers in your browser so a test can resume after a reload. Our analytics (Cloudflare Web Analytics) uses no cookies and does not identify you.
How long we keep it
- Account, profile and test data: until you delete them. The profile page deletes your profile details, or your whole account; you can also ask us to delete it.
- Anonymous test attempts that are never linked to an account are deleted after 90 days.
- Purchase and invoice records: 7 years, as required by Japanese tax law, even if you delete your account.
How we protect it
All traffic uses HTTPS. You sign in with an email code or Google, so we hold no password for you; student accounts a school creates use a password, which our authentication provider stores only as a salted hash. Access to the database and provider dashboards is restricted to the operator. Card details are handled only by Stripe.
Your rights
You can ask us to disclose, correct, add to, delete or stop using the personal information we hold about you, or to delete your account, by emailing hello@mockjlpt.com from the address on your account. We may ask you to confirm your identity and will reply within 30 days.
Children
If you are under 18, use mockJLPT and make purchases only with the consent of a parent or guardian.
Changes
We will post any change to this policy on this page with a new date, and tell account holders by email about significant changes.