Privacy Policy

Last updated: September 19, 2026

This policy explains how PastExam (“PastExam”, “we”) handles information on pastexam.net. We built PastExam to work with as little personal information as possible: we do not ask for your email address, phone number, real name or date of birth.

1. Information we collect

1.1 Account information

• Username — shown next to the files you upload.
• Password — stored only as a one-way bcrypt hash. We never store your password itself.
• Country, college and major (in the UK, your university and course; in the US you may choose “Undeclared”) — these decide which archive you can access.

Because we do not collect an email address, we cannot recover your account if you forget your password.

1.2 Content you upload

• The PDF files you upload (up to 15 MB each, up to 10 files per account).
• The file name and size, course name, course code, year and your optional description.
• A digital fingerprint (MD5 hash) of each file, used to detect duplicate uploads.
• How many times each file has been opened.

1.3 Activity on the service

• Upvotes and downvotes you give.
• Reports you submit about content (the reason and any details you add).
• Users you block.
• Share links you create.

1.4 Technical information

• Session token — a random value created when you log in. It expires after 7 days or when you log out.
• Cookies — session_token keeps you logged in (it cannot be read by JavaScript); lang remembers the site language; PHPSESSID is a temporary technical session cookie. Google Analytics sets its own cookies (see section 3); it is not loaded for visitors from the United Kingdom, the European Economic Area or Switzerland.
• Failed login attempts — when a login or account-deletion password check fails, we record the username that was tried, your IP address and the time, to block password-guessing attacks. These records are only used for 15 minutes and are cleared out regularly after that.
• Server logs — our hosting provider and Cloudflare keep standard access logs (IP address, time, requested page, browser information) for security and troubleshooting.

2. How we use information

• To create your account and keep you logged in.
• To apply the core rule of PastExam: files are available only to registered students at the same college and in the same major.
• To store your files and show them to those students.
• To review reports, remove content that breaks our rules, and close accounts that violate them.
• To protect the service against abuse, spam and attacks.
• To understand, in aggregate, how the site is used (Google Analytics).

3. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

• Other students: your username and the files you upload are visible to registered users at the same college and in the same major. Students in other majors, at other colleges, and logged-out visitors cannot see them.
• Service providers that run the service for us:
  • our web hosting provider, which stores the site, database and files;
  • Cloudflare, which delivers and protects traffic to pastexam.net;
  • Google Analytics, which receives the pages you visit and browser/device information to produce visit statistics. You can opt out with Google’s browser add-on. We do not load Google Analytics at all for visitors from the United Kingdom, the European Economic Area or Switzerland (we use the country of your connection, as reported by Cloudflare, to decide).
• Legal requests: we disclose account information or server log records only when required by a valid court order, subpoena or other legal process.

4. How long we keep information

• Account and uploaded files: until you delete them or your account.
• Session tokens: 7 days at most.
• Failed login records: used for 15 minutes, then cleared out regularly.
• Server logs: deleted on our providers’ routine rotation schedule.
• When you delete your account, your account record, every PDF you uploaded (removed from our disk), your votes, share links, reports and blocks are deleted immediately and permanently.

5. Your choices and rights

• Download your data: Settings → Download my data gives you your account details, your uploads and your votes as a JSON file.
• Delete your account: Settings → Delete My Account.
• Correct or ask about your data: write to [email protected].

California residents

If you live in California, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect and how we use it, to access and delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. The categories we collect are described in section 1 (identifiers such as your username and IP address, the content you upload, internet activity on our site, and education information such as your college and major); the purposes are in section 2 and the recipients in section 3. You can use the tools above or write to us; we will not treat you differently for exercising these rights. Because we do not collect contact details, we may ask you to prove that you control the account (for example by logging in) before acting on a request.

United Kingdom and European Economic Area residents

If you use PastExam from the UK or the EEA, the UK GDPR or the EU GDPR applies to our use of your information. PastExam is the controller; you can reach us at [email protected].

• Why we may use your information (legal bases): to provide the account and archive you sign up for (performance of our contract with you); to keep the service secure, prevent abuse and handle reports (our legitimate interests); and to comply with legal obligations such as valid court orders.
• Your rights: access, correction, deletion, restriction, objection, and data portability. The tools in this section cover access, portability and deletion; for anything else write to us.
• Complaints: you can complain to the UK Information Commissioner’s Office (ico.org.uk) or the data protection authority in your EEA country.
• International transfers: our hosting provider and Cloudflare may process your information in the United States and other countries outside the UK and EEA.

6. Security

• Passwords are hashed with bcrypt.
• Traffic to pastexam.net is encrypted with HTTPS.
• Uploaded files cannot be opened by a direct link; each request is checked against the access rule above.
• Uploads are checked to be real PDF files.

No system is perfectly secure. Please do not reuse a password you use anywhere else.

7. Children

PastExam is for college students and is not directed at children under 13. We do not knowingly collect information from children under 13; if we learn that a child under 13 has an account, we delete it.

8. Changes to this policy

If we change this policy we will update the date at the top of this page. For significant changes we will also show a notice on the site.

9. Contact

Questions or requests about privacy: [email protected].