Privacy Policy

Last updated: November 2, 2026

This policy explains how PastExam (“PastExam”, “we”) handles information on pastexam.net. We built PastExam to work with as little personal information as possible: we do not ask for your email address, phone number, real name or date of birth.

1. Information we collect

1.1 Account information

• Username — not shown next to the files you upload by default (see section 3).
• Password — stored only as a one-way bcrypt hash. We never store your password itself.
• Country, college and major (in the UK and Australia, your university and course; in New Zealand, your university and degree; in Spain, your university and grado; in the US you may choose “Undeclared”) — these decide which archive you can access.
• Sharing and privacy settings — whether you share your notes beyond your major and whether your username is hidden.

Because we do not collect an email address, we cannot recover your account if you forget your password.

1.2 Content you upload

• The PDF files you upload (up to 25 MB each, up to 3 files per account).
• The file name and size, course name, course code, year and your optional description.
• A digital fingerprint (MD5 hash) of each file, used to detect duplicate uploads.
• How many times each file has been opened.

1.3 Activity on the service

• Upvotes and downvotes you give.
• Share links you create.

1.4 Technical information

• Session token — a random value created when you log in. It expires after 7 days or when you log out.
• Strictly necessary cookies — session_token keeps you logged in (it cannot be read by JavaScript); lang remembers the site language; cookie_consent remembers your cookie choice; PHPSESSID is a temporary technical session cookie. These are required for the site to work and are used without consent.
• Optional cookies — Google Analytics cookies (_ga, see section 3). They are set only if you choose “Accept” in the cookie banner shown on your first visit. If you reject or make no choice, Google Analytics is never loaded and sets nothing.
• Failed login attempts — when a login or account-deletion password check fails, we record the username that was tried, your IP address and the time, to block password-guessing attacks. These records are only used for 15 minutes and are cleared out regularly after that.
• Server logs — our hosting provider and Cloudflare keep standard access logs (IP address, time, requested page, browser information) for security and troubleshooting.

2. How we use information

• To create your account and keep you logged in.
• To apply the core rule of PastExam: by default, files are available only to registered students at the same college and in the same major. Mutual sharing you turn on in Settings is added to this rule.
• To store your files, review them before they are published, and show them to those students (and, if you turned sharing on, to the students described in section 3).
• To review reports, remove content that breaks our rules, and close accounts that violate them.
• To protect the service against abuse, spam and attacks.
• To understand, in aggregate, how the site is used (Google Analytics).

3. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

• Other students: the files you upload are visible to registered users at the same college and in the same major. By default, students in other majors, at other colleges, and logged-out visitors cannot see them.
• Mutual sharing (optional, off by default): in Settings → Sharing and privacy you can share your approved notes with other majors at your college and/or the major with exactly the same name at other colleges in your country. Sharing is mutual: only students who turned on the same setting and have an approved note in their own major see your notes, and you see theirs. They can open your notes but cannot vote on them. When you turn the setting off, your notes are no longer shown to them. Logged-out visitors never see them.
• Your username is hidden by default: your notes show “Anonymous” instead of your username and title. If you choose to show it in Settings, it is visible to the students who can see your notes.
• Service providers that run the service for us:
  • our web hosting provider, which stores the site and database;
  • Cloudflare R2, which stores the PDF files you upload (data centers in Europe);
  • Cloudflare, which delivers and protects traffic to pastexam.net, and runs the Cloudflare Turnstile security check on the sign-up form only to stop automated fake accounts. When you open the sign-up tab, your IP address and browser information are processed by Cloudflare to tell whether you are a human; this is not used for advertising or tracking and, being strictly necessary for security, does not depend on your cookie choice (Turnstile privacy notice);
  • Google Analytics, which receives the pages you visit and browser/device information to produce visit statistics. We load it only after you accept cookies; if you reject or ignore the banner it is never loaded. You can change your decision at any time: Change cookie choice. Rejecting also removes any earlier Google Analytics cookies from your browser. You can additionally opt out with Google’s browser add-on.
• Legal requests: we disclose account information or server log records only when required by a valid court order, subpoena or other legal process.

4. How long we keep information

• Account and uploaded files: until you delete them or your account.
• Session tokens: 7 days at most.
• Failed login records: used for 15 minutes, then cleared out regularly.
• Server logs: deleted on our providers’ routine rotation schedule.
• When you delete your account, your account record, every PDF you uploaded (removed from our storage), your votes and share links are deleted immediately and permanently.

5. Your choices and rights

• Download your data: Settings → Download my data gives you your account details, your uploads and your votes as a JSON file.
• Delete your account: Settings → Delete My Account.
• Correct or ask about your data: write to [email protected].

California residents

If you live in California, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect and how we use it, to access and delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. The categories we collect are described in section 1 (identifiers such as your username and IP address, the content you upload, internet activity on our site, and education information such as your college and major); the purposes are in section 2 and the recipients in section 3. You can use the tools above or write to us; we will not treat you differently for exercising these rights. Because we do not collect contact details, we may ask you to prove that you control the account (for example by logging in) before acting on a request.

United Kingdom and European Economic Area residents

If you use PastExam from the UK or the EEA, the UK GDPR or the EU GDPR applies to our use of your information. PastExam is the controller; you can reach us at [email protected].

• Why we may use your information (legal bases): to provide the account and archive you sign up for (performance of our contract with you); to keep the service secure, prevent abuse and handle reports (our legitimate interests); and to comply with legal obligations such as valid court orders. Analytics cookies are used only with your consent, which you can withdraw at any time from the cookie banner.
• Your rights: access, correction, deletion, restriction, objection, and data portability. The tools in this section cover access, portability and deletion; for anything else write to us.
• Complaints: you can complain to the UK Information Commissioner’s Office (ico.org.uk), the Spanish Data Protection Agency (aepd.es) or the data protection authority in your EEA country.
• International transfers: our hosting provider and Cloudflare may process your information in the United States and other countries outside the UK and EEA.

6. Security

• Passwords are hashed with bcrypt.
• Traffic to pastexam.net is encrypted with HTTPS.
• Uploaded files are not stored at any public address. Each request is checked against the access rule above, and only then do you get a signed link to that one file, valid for at most 4 hours.
• Uploads are checked to be real PDF files.

No system is perfectly secure. Please do not reuse a password you use anywhere else.

7. Children

PastExam is for college students and is not directed at children under 13. We do not knowingly collect information from children under 13; if we learn that a child under 13 has an account, we delete it.

8. Changes to this policy

If we change this policy we will update the date at the top of this page. For significant changes we will also show a notice on the site.

9. Contact

Questions or requests about privacy: [email protected].