Privacy
ESATvault is a free practice site run by one person. This page explains what the site stores about you, why, who else handles it and how long it is kept.
Who is responsible
ESATvault is run by one individual, who is the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). In this page "I" and "me" mean that person. There is no company or team behind the site.
You can reach me for any question or request about your data through the contact page.
What is stored, and why
If you create an account
- Email address and password. Needed to create your account, log you in, and send you emails you ask for. The password is stored only as a secure one-way hash, never in a form anyone can read, including me.
- Username. A name you choose. It is needed so your account has a name on the site. It is not currently shown to other people, but it is designed to be visible to others, so choose one you would be comfortable sharing.
- Your settings on your account. The course you are applying for (optional), the ESAT modules you are sitting, and the day of the January sitting you chose. These personalise the dashboard and the countdown.
- Sign-in records. The authentication service keeps technical records of when you signed up and signed in, and may keep the IP address and browser details of your sign-in sessions, to keep accounts secure.
While you practise
- Practice and mock results. The questions you were given, the answers you chose, whether you flagged a question, how long you spent on each one, and your scores. This is what lets the site show your progress, resume an unfinished session, and suggest what to practise next.
- Which questions you have seen. So the site can offer you questions you have not seen yet, and so you can reset that for a module.
- Question feedback. If you report a problem with a question, the message you write is stored with the question and your account.
If you use the contact form
- Your name, email address and message, and your account if you were logged in. Used only to read and reply to your message.
- To limit spam, a one-way hash (a scrambled code) of your IP address is stored with the message, so one sender cannot send many messages in an hour. Your actual IP address is not stored with it. A hash of an IP address can still be linked back to a person with effort, so I treat it as personal data.
Combined statistics
- How students answer each question is added together across everyone: how often each option is chosen and how long answers take. These totals have no names or accounts attached, and they are only shown once enough students have answered a question. They are not personal data once combined, and they are kept after an account is deleted.
You do not need an account to browse. Without an account, the site stores no practice data about you.
Why I am allowed to use your data
Under UK data protection law I need a lawful basis for each use. Mine are:
- To provide the service you asked for (a contract): your account, your results and progress, your settings, and emails about your account such as confirming your address or resetting your password.
- Legitimate interests: keeping the site secure, preventing spam and abuse, fixing mistakes in questions, understanding which parts of the site are used so I can improve it, and keeping combined statistics. I have weighed these against your privacy and keep them to what is needed.
- Replying to you: when you send a message through the contact form, I use it to answer you.
I do not rely on consent for any of this, so there are no consent pop-ups. I do not use your data for advertising, and I do not make decisions about you by automated means that have legal or similarly significant effects. The suggestions on the dashboard are only practice suggestions.
Cookies and browser storage
- A sign-in cookie. Set when you log in, so you stay logged in. It is essential to the site working, and is not used for tracking. Without an account, no cookie is set by the site itself.
- Your settings, in your browser. Your colour theme and simulator options are kept in your browser's local storage on your own device. They are never sent to the site's servers.
- Today's daily question answer, in your browser. Kept in local storage so a reload shows your result instead of the question again. Only the latest answer is kept, and it stays on your device.
You can clear these at any time in your browser settings. Clearing the sign-in cookie logs you out.
Where your data is processed
Some of these providers are based in, or use computers in, countries outside the UK, including the United States. Where that happens, the transfer is covered by safeguards that UK law accepts, such as the UK's approved standard contract terms or an approved data-protection framework, which the providers offer as part of their service terms.
How long it is kept
| What | How long |
|---|---|
| Account, settings, results, progress, seen questions and question feedback | Until you delete your account. |
| Contact messages (name, email, message, IP hash) | Until you ask me to delete them. |
| Combined question statistics | Kept, because they no longer identify anyone. |
| Sign-in and server logs | Kept by the providers for their normal log period. |
| Browser storage | Stays on your device until you clear it. |
When you delete your account, your account, results, progress, seen questions and question feedback are removed. Contact messages you sent are not removed automatically, because they are kept in a separate place without a link to your account. They still contain the name, email and message you typed. To have one deleted, ask me through the contact page.
Security
Your password is stored as a hash. Data is sent over an encrypted connection (HTTPS). The database is set up so that logged-in users can only read their own results, and only I can see account details and contact messages. I cannot promise that no system is ever breached. If a breach put your data at real risk, I would tell you and the Information Commissioner's Office as the law requires.
Your rights
Under UK data protection law you can ask me to:
- tell you what is stored about you, and give you a copy;
- correct anything that is wrong;
- delete your data;
- limit how it is used, or object to it being used for my legitimate interests;
- give you your data in a portable form.
You can do some of this yourself. In settings you can change your username and password, and reset which questions count as seen. Under settings, account, you can delete your account yourself. That permanently removes your account, results, progress, seen questions and question feedback, and it cannot be undone.
For anything else, use the contact page. I will reply within one month. I may need to check it is really you before sharing or deleting anything.
If you are unhappy with how I have handled your data, please tell me first so I can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.
Children
You need to be at least 13 to use ESATvault, and the site is meant for students preparing for university admissions. If you are under 18, ask a parent or carer if you are unsure whether to create an account. If I learn that someone under 13 has an account, I will delete it. If you think that has happened, please tell me.
Changes
If this page changes in a way that matters, the date below will change, and I will say so on the site where I reasonably can.
Last updated: 16 October 2026.