Privacy Policy

DSAT AI is operated by an individual based in Uzbekistan — not a registered company. Anything on this page can be explained, changed or acted on by writing to support@dsatai.com, which reaches the operator directly.

• To have an account — your email address, a name to show on screen, and either a password (stored only as a bcrypt hash, which cannot be turned back into your password) or the fact that you signed in with Google.
• When you start — your exam date, the score you are aiming for, your school year, and, only if you choose to enter them, scores from a real SAT or PSAT you have already sat. That last one is only ever a result you were reported. We never ask you to estimate your own ability.
• If you upload one — a profile picture, stored in the database rather than on a separate file service.

This is the part that makes the product work, so it is worth being plain about. Each time you answer, we store what you chose and whether it was right, and with it:

• how long you took, and how long before your first click
• every time you changed your answer, and in what order
• which options you crossed out
• whether you flagged it, and whether you came back to it
• whether you were on a phone, tablet or laptop — the size of the window, not the device itself
• where it fell in the session, how many minutes in you were, and the hour of your local day
• when the answer is wrong, a code for the specific misunderstanding it points to

Right or wrong on its own says very little. Changing from the correct answer to a wrong one under time pressure is a different problem from never knowing it, and these are what let the two be told apart.

We do not ask which topics you are weak at, how good you are, how long you want to study, or which days suit you. All of it is worked out from what you actually do. Your timezone is read from your browser rather than requested — a study plan is a list of calendar days, so the server has to know whose midnight they are. A form asking you to rate yourself would produce a worse answer than the evidence already gives.

When you talk to Lolo, both sides of the conversation are stored, so the tutor can follow a thread across sessions and so we can tell when it explained something badly.

Conversations are kept until you delete them — there is no automatic expiry. You can delete any conversation from the tutor screen at any time, and erasing your account deletes all of them.

• Google — only if you use the Google sign-in button. We ask for your email address, your name and an account identifier, and nothing else. No access to Gmail, Drive or contacts.
• Desmos — the graphing calculator inside a test is theirs and loads from their servers when you open it, which means they can see your IP address. Never open it and they never hear from you.
• Your browser’s dictation — if you use the microphone on the tutor screen, Chrome sends that audio to Google to turn it into text. That is your browser doing it, not us, and only while you are speaking.
• Resend — the service that delivers the one email described below.
• Telegram — only if you tap the button to ask about full access. Nothing is sent until you tap it.

There is exactly one email this product sends: a reminder that you left a full-length practice test unfinished. It goes at most twice, and never again for that test. No newsletter, no weekly summary, no “we miss you”.

Every message carries a one-click unsubscribe link that works without signing in, and you can switch email back on from your profile.

There is no Google Analytics, no Meta pixel, no session recorder, no heatmap, no error-reporting service. Nothing about you is sold, rented or shared for advertising. The list above is the only reason anything leaves this system.

• Your session — set when you sign in, lasts 30 days, unreadable by scripts. It carries your account id, email and name in signed form.
• Where you came from — if you arrive from a link carrying a campaign tag, that short word is kept for 30 days so we can tell which posts brought people in. It is a tag like aug06, not an identifier for you.
• Three ten-minute cookies during a Google sign-in, deleted the moment it finishes either way.

No third party sets a cookie on this site.

Your IP address is used to count requests, so that one person cannot hammer the sign-up form. It is held in memory only — never written to the database, never written to our application logs. The web server in front of the app does keep ordinary access logs, and those contain IP addresses.

The application and the database both run in Frankfurt, Germany. If you are in Uzbekistan, your data is stored outside Uzbekistan. We do not copy it anywhere else.

• Erase your account — from your profile. The next section says exactly what that removes.
• Delete any tutor conversation, one at a time, from the tutor screen. It goes, along with every image in it.
• Remove your profile picture.
• Turn email off or back on — from your profile, or from the link in any message.
• Change your password, which signs out every other device.

Two things you cannot do yet, said here rather than left out. There is no download-my-data button — ask at support@dsatai.com and a copy will be put together by hand. And there is no password reset: forget your password without a linked Google account and that account cannot be recovered.

Deleted immediately and permanently:

• your name and email address, replaced by a marker that reaches nobody
• your password
• your profile picture
• the link to your Google account, if you had one
• every conversation with Lolo, and every image in them
• your exam date, your target score, your school year

Your practice answers and their timings are kept, along with the estimates built from them. They are what the question difficulties are calibrated from, so removing them would make the measurement worse for everyone else — and once your account is erased there is nothing left in the system connecting them to you or to any address. Your email becomes free to sign up with again.

One visible consequence: a certificate you already downloaded still verifies, and shows the name as “Deleted account”.

• Your account and study record — until you erase it.
• Tutor conversations — until you delete them or erase your account.
• Photographs sent to the tutor — 30 days, or until 50 newer ones exist.
• The campaign cookie — 30 days.

DSAT AI is for anyone preparing for the SAT — school students, university students, and teachers brushing up. We do not ask your age and we do not verify it. There is no minimum age and no parental-consent step, and this page would rather say so than claim a check that does not exist.

If you are a parent or guardian: everything here applies to your child’s account, including the tutor section — their messages and any photograph they attach go to a third-party provider. You can erase the account from the profile screen, or write to support@dsatai.com and ask for it to be done, without explaining why.

Passwords are stored as bcrypt hashes. Sessions are signed and every one of them can be revoked by signing out. Eight wrong passwords locks an account for fifteen minutes. Everything travels over HTTPS.

None of that makes a system unbreakable, and anyone who says otherwise is selling something. If we discover a breach affecting your data, we will email the address on the account and say what happened.

When the product changes, this page changes with it and the date at the top moves. A change that means something materially different for data already collected will be announced in the app, not quietly edited in here.

support@dsatai.com — for a copy of your data, to come off the leaderboard, to have an account erased, or to ask about anything above. See also the Terms of Service.