What we collect, why, and how to control it.

1. The short version

We collect the minimum data needed to run CSE Reviewer System: a Google email so you can sign in, your study activity so we can show your progress and rankings, and payment confirmation from PayMongo if you upgrade to VIP. We do not sell your data, we do not run ads, and we do not share your data with marketing third parties. You can request deletion at any time.

2. Who runs this

CSE Reviewer System is operated independently from the Philippines. Contact: support@csereviewer.top.

We are not affiliated with the Civil Service Commission. Authoritative information about the actual examination lives at csc.gov.ph.

3. What we collect

When you create an account and use the Service, we collect:

• Google account profile. Your email address, display name, and profile picture from your Google sign-in. We do not see your Google password.
• Study activity. The practice questions and mock exams you attempt, your answers, your scores, your bookmarks, achievements, and timing data. This is what lets us show you progress charts, place you on the leaderboard, and power Smart Drill weak-area targeting.
• Payment confirmation (VIP only). If you upgrade, PayMongo processes the transaction. PayMongo shares with us only the confirmation that the payment succeeded plus an internal payment reference. We do not see your card number, GCash PIN, or bank credentials. PayMongo's own privacy policy applies to the data they collect during checkout.
• Standard server logs. Approximate IP address, browser type, and the pages you load, kept for ~30 days for security and debugging.

4. What we do with it

We use your data to:

• Operate the Service — show you the right content, save your progress.
• Run social features — display your name and badges on the leaderboard and chat.
• Verify payments and grant VIP access.
• Detect abuse, prevent fraud, and respond to support requests.
• Improve content — anonymous aggregate data (e.g. “question X has a 22% correct rate”) helps us calibrate difficulty.

We do not sell your personal data. We do not share it with advertisers. We do not use it to train third-party AI models.

5. Who we share it with

The Service relies on a small set of trusted infrastructure providers:

• Supabase — hosts our Postgres database and authentication. Your account row, study data, and bookmarks live there.
• Vercel — hosts the website itself and processes server logs.
• PayMongo — processes VIP payments. Receives only what is needed to complete your transaction.
• Google — authenticates your sign-in. Receives only the OAuth flow, not your activity on the Service.
• Cloudflare — protects the Service from spam and abuse via Turnstile.

We may disclose data to law enforcement when legally required (e.g. a valid Philippine court order). We push back on overbroad requests.

6. Visibility on the leaderboard

By default, your display name and your study progress are visible to other signed-in users on the leaderboard and may appear in chat. If you don't want to be publicly visible, edit your display name in Profile to something pseudonymous, or email us to opt out of the leaderboard entirely.

7. Cookies and similar technologies

We use a small number of cookies, all strictly necessary:

• Authentication session cookie (Supabase Auth).
• Your theme preference (light/dark) stored in localStorage.
• PWA install-prompt dismissal flag in localStorage.

We do not use third-party tracking cookies, advertising pixels, or analytics services that profile individual users.

8. Data retention

We keep your data for as long as your account is active. If you delete your account (see Section 9), we delete or anonymise your personal data within 30 days. Payment records are kept for 7 years per Philippine tax and accounting regulations, with personal identifiers stripped where legally permitted.

9. Your rights

Under the Philippine Data Privacy Act (R.A. 10173) and standard privacy practice, you can:

• Access — request a copy of all data we hold about you.
• Correct — update any inaccurate information, including your display name from the profile page.
• Delete — request permanent deletion of your account and personal data. VIP refunds (if within 7 days) are issued separately.
• Export — get a JSON dump of your progress data on request.
• Object — opt out of leaderboard visibility.

To exercise any of these, email support@csereviewer.top. We respond within 7 business days and complete most requests within 30 days.

10. Children

The Service is intended for users 18 and older (legal age for civil service examinations in the Philippines). We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email us and we will close it.

11. Security

We protect data with: HTTPS everywhere, row-level security on the database, encrypted secrets at rest, principle-of-least-privilege access for the team, and signed webhook verification for payments. No system is perfectly secure; if we ever experience a breach affecting your data, we will notify you within 72 hours per applicable law.

12. Changes to this policy

When we make material changes we will update the “Last updated” date at the top and notify users on the dashboard or by email. Minor edits (typos, clarifications) won't trigger a notification.

13. Contact

Privacy questions, access requests, deletion requests — email support@csereviewer.top. For complaints we can't resolve, you may also escalate to the National Privacy Commission of the Philippines (privacy.gov.ph).