1. Local-First Confidential Storage (API Keys & Candidate Photos)
NewtCBT prioritizes privacy by keeping sensitive personal assets on your own device:
- Personal API Keys: API keys entered for generation (such as Google Gemini API keys) are stored exclusively in your browser's local storage (`localStorage`). They are never uploaded, saved, or logged in central database servers.
- Candidate Profile Photos: Custom candidate photos uploaded for the NTA interface mode are stored locally in your browser's IndexedDB/local storage and are never uploaded to central database servers.
- Local Tests & Notebooks: Generated CBT tests, saved questions, and personal notes remain stored in your local browser cache (`IndexedDB`).
2. Authentication & Account Data (MongoDB Atlas)
We use Google OAuth for passwordless, secure sign-in. To maintain user accounts and profile sessions, we store minimal account data in a secure MongoDB Atlas database:
- User identity details (Name, Email address, and Google profile image URL).
- Your customized NewtCBT username and account preference settings.
3. Leaderboard Storage (Cloudflare D1)
For optional public test leaderboards and score comparisons, quantitative performance data is stored using high-performance Cloudflare D1 serverless SQL instances:
- Stored leaderboard data is strictly limited to minimal metrics: Test ID, Username, total score, accuracy, and attempt timestamp.
- No raw PDF files or full question documents are stored inside the leaderboard database.
4. PDF Processing & Render API Workers
PDF conversion, text extraction, diagram cropping, and interactive rendering take place client-side in your browser. For complex AI prompt structuring during test generation, requests pass through a serverless backend worker service hosted on Render:
- Render API workers process prompt payloads in memory to generate structured test JSON.
- No raw PDF files are stored on Render server disks.
5. Analytics & Diagnostics
To monitor site speed, diagnose bugs, and improve user experience, we utilize standard performance analytics services:
- Google Analytics: Aggregated traffic and usage metrics.
- Vercel Analytics & Speed Insights: Real-time Core Web Vitals, page load speeds, and technical error reporting.
- Analytics data is anonymized and never linked to your private test documents or uploaded PDFs.
6. Strict No-Data-Selling & Privacy Guarantee
We believe in absolute data privacy and transparency:
- Zero Unnecessary Data Collection: We do not collect extra personal information beyond what is required for core platform functionality.
- WE DO NOT SELL DATA: NewtCBT never sells, rents, monetizes, or shares user data with third-party advertisers, marketing agencies, or data brokers.
- No Privacy Exploitation: Your uploaded documents, test scores, and personal revision notes remain private to your session.
7. Live Rooms & Peer-to-Peer (P2P) Connectivity
Direct peer-to-peer (P2P) live room connections stream test state data directly between participant browser sessions. As with standard WebRTC/P2P technology, participant IP addresses are visible to connected peers during a live session. We recommend using a VPN when joining live rooms with unfamiliar peers.
8. Security & Cookie Transparency
- Encryption & Transit Security: All network traffic, authentication sessions, and API communications are encrypted in transit using industry-standard SSL/TLS (HTTPS) encryption.
- Cookie Transparency: NewtCBT uses only essential functional session cookies required for authentication and keeping you logged in. We do not use third-party advertising or cross-site tracking cookies.
9. Data Erasure & Control
You maintain full control over your stored information:
- Local Data Erasure: To wipe your local tests, notes, candidate photos, and API keys, clear your browser site data or IndexedDB in your browser settings.
- Account Session Deletion: To request complete deletion of your account session metadata from MongoDB Atlas, email us at newtcbt@gmail.com.
10. Minors & Educational Use
NewtCBT is designed for student revision. Users under 18 years of age should use the platform under the supervision and consent of a parent or guardian.
11. Contact Us
If you have any questions, feedback, or privacy concerns regarding this Privacy Policy, please contact us:
Email: newtcbt@gmail.comSocial: @newtene on Discord and Reddit
Last updated: August 2026