Legal
Privacy Policy
Last updated October 10, 2026
We collect as little as we can: what we need to run your account, your practice and your subscription. We do not sell your information, we do not show ads, and we do not use tracking cookies.
1. Who we are
Soraga is run by Joshua James Cooper, an individual based in the United Kingdom ("we", "us"), who is the controller of your personal information under UK data protection law. Questions about privacy: support@soragalabs.com.
2. What we collect
| What | Details | Why |
|---|---|---|
| Account | Your email address and a password (stored only as a secure hash by our authentication provider). If you use Google sign-in, we receive your email address and a Google account identifier. | To create and secure your account. |
| Practice | The questions you are shown, your answers, the time taken, your sessions and results, and any problem reports you send. | To run practice and timed sections, show your results and history, and never repeat a question. |
| Subscription | Your plan, trial dates and payment status. Payment is handled by Paddle, our reseller: Paddle collects your card details and billing address; we only see your plan, payment status, country, and the card brand and last four digits. | To run your trial and subscription. |
| Messages | What you write when you email us. | To answer you. |
| Technical | IP address, browser and device type in server logs. | Security, fraud prevention and fixing faults. |
We do not ask for your name, date of birth, phone number, postal address, or anything about your military status, and you never need to give it to us.
3. How we use it
- To provide Soraga: your account, practice, timed sections, results and history.
- To run your free trial and subscription, and to send service emails (account confirmation, password reset, trial ending, receipts, cancellation). These are part of the service; we do not send marketing emails.
- To improve questions using answer statistics across all students (for example, how often each option is chosen). These statistics do not identify you.
- To keep Soraga secure and to prevent abuse, such as repeated free trials or account sharing.
- To meet legal obligations, such as keeping payment records.
Under the UK GDPR (and the EU GDPR where it applies), our legal bases are: performing our contract with you (account, practice, subscription), our legitimate interests (security, abuse prevention, improving questions), and legal obligation (tax and accounting records).
4. Who we share it with
Only with providers that run parts of Soraga for us, under contracts that limit them to that purpose:
- Supabase: database and authentication.
- Cloudflare: website hosting, security and bot protection, and cookie-free visitor statistics that do not identify you.
- Resend: sending service emails.
Paddle (Paddle.com) is our reseller and merchant of record: it sells the subscription on our behalf, takes payment and handles sales tax and VAT. Paddle uses your payment details as an independent controller under its own privacy notice.
We may also disclose information if the law requires it, or to protect our rights or someone's safety. We do not sell personal information, and we do not share it for advertising.
5. Where it is stored
Our providers may store information in the United States and other countries. Transfers from the UK are protected by the UK International Data Transfer Agreement or Addendum, the UK–US data bridge, or equivalent safeguards.
6. How long we keep it
- Account and practice data: while your account is open. When you delete your account, it is removed within 30 days.
- Payment records: as long as tax and accounting law requires (typically up to 7 years).
- Server logs: up to 30 days.
- Problem reports: kept to improve questions, with your account details removed when your account is deleted.
7. Your rights and choices
You can, at any time:
- Download your data and delete your account from your Account page.
- Change your email address and password from your Account page.
- Ask us to access, correct, delete or restrict your information, or object to how we use it, by emailing support@soragalabs.com.
You can also complain to the UK Information Commissioner's Office (ico.org.uk) or the data-protection authority where you live. Depending on where you live (for example, California or the EU), you may have further rights. We will not treat you differently for using them. We respond within one month.
8. Security
Connections are encrypted, passwords are stored only as hashes, card details never reach our servers, and access to data is limited to what is needed to run Soraga. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
9. Age
Soraga is for people aged 16 and over. It is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.
10. Changes
If we change this policy, we will update the date above, and for significant changes we will email you before they take effect.
11. Contact
Email support@soragalabs.com. We reply within 2 business days.