Privacy Policy

Effective date: October 21, 2026. The English and Vietnamese versions of this policy have the same content and equal validity.

This Privacy Policy explains how Mocklet processes information when you use the Mocklet website and Android application. Mocklet provides Digital SAT and PSAT practice, attempts, scoring, explanations, history, and progress tracking.

Mocklet is operated by SCOREWISE LABS ONE MEMBER COMPANY LIMITED, which is responsible for the processing described here. Business registration no. (tax code): 0319717546. Registered office: 12 Subdivision No. 18A Nguyen Huu Tho, Nha Be Commune, Ho Chi Minh City, Vietnam. Email: support@mocklet.app. Phone: (+84) 988 777 118.

Information we process

Account information: name, email address, internal user identifier, email-verification status, linked sign-in methods, year of birth, and preferred language.
Registration consent records: your agreement to the Terms of Service and this Privacy Policy, stored with the policy version, language, time, IP address and user agent.
Authentication and security information: password hashes, Google account identifiers used for sign-in, session and CSRF tokens, login events, IP address, user agent, and security-event records.
Learning activity: practice and test attempts, selected answers, timing, completion state, scores, result snapshots, skill mastery, recommendations, progress history, and Miu AI study coach usage and saved reviews.
Notification information: if you allow push notifications in the Android app, the device's push token, an installation identifier, your notification preferences, and delivery and open status of notifications.
Subscription information: payment provider, product or price ID, provider customer/subscription/transaction references, subscription state, entitlement period, renewal state, billing country and currency, transaction totals, refund status, and account-linking identifier.
Payment-card information: Mocklet does not receive or store your full payment-card number, CVV or card authentication data. These are entered on Creem's checkout or in Google Play and handled by those providers.
Technical information: request identifiers, diagnostic logs, service errors, and basic connection metadata needed to operate and protect the service.

How we use information

To create and authenticate accounts, and to apply the age rules in the Terms of Service.
To save attempts, answers, results, and progress.
To generate scoring, mastery, practice recommendations and Miu AI explanations.
To prevent abuse and automated registrations, investigate failures, protect accounts, and maintain service reliability.
To send account-verification, password-reset and other essential account messages, and, if you choose, study reminders and push notifications.
To verify purchases, grant paid access, restore entitlements, prevent purchase abuse, and reflect subscription lifecycle changes.

Consent

When you register, you tick an unticked box to agree to the Terms of Service and to this Privacy Policy, including the processing of your personal data described here. Mocklet records that agreement as described above. Study reminder emails, push notifications and website analytics are optional and are off until you choose them. You may withdraw consent at any time by changing those settings, by deleting your account, or by contacting us; withdrawal does not affect processing already carried out, and some features cannot work without the data they need.

Service providers and sharing

Mocklet does not sell personal information. Information may be processed by infrastructure and email-delivery providers acting on Mocklet's behalf. Resend delivers Mocklet's emails and receives the recipient address and the message content. Google Identity Services processes Google sign-in.

Google Gemini (Miu AI study coach): when you ask Miu for an explanation, Mocklet sends Google's Gemini API the question content (text, answer choices and question images), the correct answer, whether your answer was correct, your entered answer for student-produced math questions, and the requested language. For a Miu study review, Mocklet sends a summary of your completed-practice results, such as skill mastery, growth and recommendations. Mocklet does not send your name, email address or account identifier to Gemini.

Cloudflare Turnstile (bot check at registration): the email registration form uses Cloudflare Turnstile to check that the sign-up is made by a person. Turnstile runs in your browser and collects technical browser and device signals. Mocklet sends Cloudflare the resulting check token and your IP address to verify the result.

Firebase Cloud Messaging (push notifications): if you allow notifications in the Android app, Mocklet uses Google's Firebase Cloud Messaging to deliver them. Firebase receives your device's push token and the notification content (title, text, link inside Mocklet, category and expiry time), together with internal delivery identifiers. You can turn notifications off in the app or in Android settings.

Website billing through Creem: Mocklet sends your account email, name when available, selected product, and internal account/order references to Creem to create checkout and link the purchase to your account. Creem collects checkout details such as billing address and payment information. We receive payment, customer, subscription, transaction, renewal and refund references or status needed to verify access, reconcile purchases and resolve billing issues. Practice answers and learning history are not sent as checkout metadata.

Creem processes billing data under its Privacy Notice, including transaction administration, fraud prevention and legal obligations. Mocklet is responsible for its account, learning and entitlement processing. Creem's privacy roles depend on the processing activity; its notice describes controller, joint-controller and processor roles. Payment and privacy requests about Creem-held records may be directed to support@creem.io.

Limited transaction details, including account email, plan, amount and provider references, may be included in internal payment notifications to Mocklet support using Resend. Access is for billing administration and troubleshooting. This is separate from Creem's customer receipt.

Mobile billing: Google Play processes Android purchases. It provides Mocklet with the purchase and subscription information required to verify and maintain access, and processes payment information under its own privacy terms. The iOS app has not been released.

Information may also be disclosed when required by law or reasonably necessary to protect users, the service, or legal rights.

Cookies and local session storage

Mocklet uses essential session and CSRF cookies for authentication and security. The Android app stores its session-cookie payload encrypted with a key held by Android Keystore. Mocklet does not use these essential authentication cookies for advertising.

Optional website analytics

With your permission, the Mocklet website uses Google Analytics to measure public-page visits, links followed between public guides, approximate reading engagement, and privacy-safe product events such as starting registration, beginning or completing practice, and viewing an explanation. Mocklet does not send email addresses, authentication tokens, answer selections, question content, full visited URLs, or raw user identifiers in these events. You may decline analytics without affecting the service. Your preference is stored in your browser.

Security

Mocklet uses HTTPS in transit, password hashing, limited-lifetime sessions, CSRF protection, rate limiting, server-side authorization, and encrypted Android session storage. No security method can guarantee absolute protection.

Retention and deletion

Mocklet keeps personal data only as long as needed for the purposes in this policy or as required by law:

Account and learning data (profile, attempts, answers, results, progress, flashcards and Miu history): kept while your account exists. After your account is deleted, this data is removed from our systems, including backups, within 30 days.
Payment records and invoices: kept for 10 years, as required by Vietnamese accounting law, even after your account is deleted.
Records of your agreement to the Terms and policies, and purchase contract records (including the purchase confirmation records described below): kept for 3 years after the contract ends.
Security logs (sign-in events and IP addresses): kept for 12 months.
Email reminder preferences: kept until you change them or unsubscribe.

Records needed for an ongoing dispute or a request from a competent authority may be kept until that matter is resolved.

Deleting your account. You can delete your account yourself on the account-deletion page. If an auto-renewing plan is active, you must cancel automatic renewal first. Deletion is permanent and cannot be undone, and any remaining Premium time is not refunded, except where the Cancellation and Refund Policy or the law provides otherwise. If you ask us by email to delete your account, we complete the deletion within 7 working days.

Mocklet blocks deletion while automatic renewal is on because deleting a Mocklet account does not by itself cancel Creem or Google Play billing. Creem and other payment providers may retain transaction records under their own retention policies and legal obligations; a Mocklet deletion request does not automatically delete a Creem Customer Portal account.

Mocklet may retain a non-identifying deletion receipt containing a random receipt ID, deletion time, deletion method, and categories removed. It contains no email address, name, username, or user ID and cannot be used to restore the deleted account.

International processing

Creem, Resend, Google (Gemini, Firebase Cloud Messaging, Google Analytics, Google sign-in and Google Play) and Cloudflare may process the information described above on servers outside Viet Nam. Creem and its providers process billing information as described in Creem's Privacy Notice. Contact Mocklet about data we hold and Creem about data it holds. Requests are assessed under applicable privacy law, including any required retention and identity verification.

Your rights and how to exercise them

Under Vietnamese personal data protection law, you may:

be informed about how your data is processed;
access your data and receive a copy of it;
correct inaccurate data;
ask us to delete your data;
ask us to restrict processing, or object to processing;
withdraw consent;
complain, report or bring a claim.

How to make a request: email support@mocklet.app from your account email, or use the contact page, and say which right you want to exercise. You can update some account information and delete your account yourself in the app. We may ask you to confirm your identity before acting. A parent or legal guardian may make a request for a user under 16, and such requests are handled first.

Response time: Mocklet responds within 7 working days of receiving your request. If the law requires us to keep certain data, we tell you which data and why.

Complaints: if you are not satisfied with our response, reply to it or write to support@mocklet.app. You may also complain to the competent Vietnamese state authority for personal data protection or bring a claim in court.

Your choices

Review and update account information available in the app.
Change a password or use password reset for eligible accounts.
Turn study reminder emails and push notifications on or off.
Sign out to remove the local session.
Permanently delete the account and associated data.

Children

People under 13 cannot register for Mocklet.
Users under 16 should use Mocklet with the knowledge and consent of a parent or legal guardian.
A parent or legal guardian can contact support@mocklet.app to review, correct or delete the child's data. These requests are handled first.

Changes

Each version of this policy shows its effective date. For a change that is adverse to you, Mocklet emails you at least 15 days before it takes effect, as described in the Terms of Service.

Privacy inquiries

For privacy questions, contact support@mocklet.app. For account deletion, use the account-deletion page.

Billing support requests retain the contact email, message, receipt time, response deadline and investigation history. Provider verification records retain limited order identifiers, entitlement state and a hashed purchase-token reference. Authorized support staff use these records to investigate requests; they are covered by the billing-record review and retention policy below. Do not include passwords, reset links or card credentials in a support request.

Purchase confirmation and dispute records

We keep a timestamped record of the plan and price presented, renewal disclosure, your affirmative confirmations, and copies or identifiers of the policies presented when a purchase is initiated. Android displayed-price records come from the app and are kept separate from provider-verified payment amounts. We also maintain limited provider transaction references and cancellation records for billing investigation.

These records are used for contract administration, billing support, fraud prevention and the establishment, exercise or defence of legal claims, subject to applicable law. They may be shared with the relevant payment provider, bank, authorized advisers, or competent authorities when necessary for a particular billing request or dispute. They are not used as marketing consent.

Purchase confirmation records are kept for 3 years after the contract ends, and payment records and invoices for 10 years, as set out in Retention and deletion. Records needed for an ongoing dispute or a legal obligation may be kept until that matter is resolved. Account deletion does not remove these limited billing records. A pseudonymous account reference can still be personal data and is protected accordingly. Requests about retained records can be sent to support@mocklet.app.