Privacy Policy

Last updated: November 3, 2026

1. Who We Are

SteamTicket is an independent digital study tool operated by JAX & NOAH STUDIOS INC., a company incorporated in British Columbia, Canada on August 29, 2026. SteamTicket began as a sole proprietorship and is now operated by the company. Our support email is support@steamticket.ca. Our public business location is Kimberley, British Columbia, Canada. These pages do not mean the Paddle seller account or the Apple App Store organization has been transferred to the company.

The privacy officer of JAX & NOAH STUDIOS INC. is accountable for SteamTicket's privacy compliance and is reachable at support@steamticket.ca.

This Privacy Policy explains how SteamTicket collects, uses, discloses, stores, and protects personal information when you visit our website, create an account, buy access, use the web app, sync study progress, or contact support.

2. Paddle's Separate Role

Payments are handled by Paddle, which acts as merchant of record and authorised reseller. Paddle collects and processes payment information under its own buyer terms and privacy policy. SteamTicket does not receive full card numbers. Paddle sends us limited order information, such as your name, email, country, purchased product, order or transaction ID, tax or currency information, and refund status, so we can provide access, support, and refund assistance.

3. Information We Collect

Account information. We collect your email address, account identifiers, hashed password information, login/session information, entitlement records, and related account settings.

Purchase information. We receive limited purchase and refund information from Paddle, including your name, email, country, purchased product, order or transaction identifiers, and purchase or refund status. We do not receive your full payment card number.

Study progress. We may collect or store quiz answers, scores, mock-exam results, progress, bookmarks, course completion status, timestamps, and related study activity. Some progress is stored in your browser's local storage. If you log in or sync, progress may also be stored on our servers.

Optional exam results. The new result form saves your paper, exam month, result, optional syllabus units and relevant practice score on your device. Saving a result without research permission does not upload it. Do not submit exam questions or confidential exam content. If you separately opt in to research, the paper, month, result, chosen units, studied bank version and relevant mock score are uploaded with your account identifier. These source records are linked to your account; they are not anonymous. We use them only to compare practice performance with reported results and identify syllabus areas needing review. They do not establish that SteamTicket caused an exam result.

Older app versions used a separate, coarser result prompt. Those records are not converted into consent for the new research flow.

Local storage and authentication. SteamTicket uses browser local storage for study progress and for authentication/session tokens that keep you logged in. We may also use cookies or similar identifiers when conversion-measurement tags are active, as described below. Clearing browser data may log you out and may remove locally stored progress that has not been synced.

Analytics. We use Plausible Analytics, a privacy-friendly, cookieless analytics service, to understand aggregate site usage, for example page views, referring sources, and which free study samples are started. Plausible does not set cookies, does not collect or store personal information, does not build advertising or cross-site profiles, and does not track you across other websites. Only aggregate, de-identified usage data is processed on our behalf.

Advertising and conversion measurement. When conversion measurement is enabled (for example Meta/Facebook and Instagram, or Google Ads), we use that platform's browser tag and, where needed, a server-side Conversions API so checkout completions still count if a payment overlay or ad blocker hides the browser tag. These tools may set or read cookies and may share limited event information (such as that a course or pricing page was viewed, checkout started, or a purchase completed, together with a value and currency, a technical event ID used to avoid double-counting, and identifiers such as an ad-click ID) with the advertising platform. We may also record how you first reached SteamTicket (for example the referring site, campaign tags, or an ad-click identifier) with your account so we can understand which channels bring new users. You can limit or opt out through your browser cookie settings and through the platform's own advertising controls, such as Meta Ad Preferences or Google's My Ad Center. On the website, a Google Ads purchase conversion is sent at most once per completed Paddle transaction, with the order value, currency and transaction ID; it is not sent from the iOS or Android app. We do not sell your personal information.

Support and communications. If you contact us, we collect the information you provide, such as your name, email, message, attachments, and support history. Transactional email may be handled through Supabase.

Feedback sorting. When you send feedback or report a question, we store what you wrote. To sort those reports, we may send the feedback text to OpenAI, plus the course id and question id when the report is about a question. We do not send your email address, account id, or account name to OpenAI for this sorting, and we do not send answer keys or encrypted question-bank content. OpenAI labels the report so Jax & Noah Studios Inc. can read the important ones first. We do not send you an automatic reply.

Security and technical logs. We may collect IP address, device and browser information, event logs, error logs, and access logs for security, troubleshooting, fraud prevention, abuse prevention, and service reliability.

4. Why We Use Personal Information

We use personal information to create and manage accounts; authenticate users; provide purchased course access; verify entitlements; sync study progress; process support requests; help with refunds; send transactional messages; maintain security; prevent account sharing, abuse, fraud, scraping, and unauthorised access; improve the service; comply with legal, accounting, tax, consumer-protection, and record-keeping obligations; and enforce our Terms of Service.

We do not sell personal information. We do not send marketing email unless you give express consent where required.

5. Consent and Your Choices

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances and where we have consent or another legal basis. Your consent may be express, implied by your actions, or otherwise permitted by law, depending on the information and purpose.

You may withdraw consent, request deletion, or close your account by contacting support@steamticket.ca. In some cases, withdrawing consent or deleting information means we can no longer provide account access, synced progress, support, or proof of purchase. We may also need to keep some information where required or permitted by law, such as transaction, security, fraud-prevention, tax, accounting, or dispute records.

Research permission is optional and unchecked by default. It is separate from testimonial permission and does not affect paid access or your ability to save a result locally. To withdraw research permission for your account, email support@steamticket.ca from your account email. We verify the request and aim to process it within two business days. Withdrawal removes new-form research records from active storage and prevents pending or later uploads from opting the account back in. Local copies stay on your device until you clear them or they expire. Research re-enrolment is not automatic.

6. When We Disclose Personal Information

We disclose personal information only as reasonably needed for the purposes described in this Policy. This may include disclosure to Paddle for purchase and refund support; Supabase for database, authentication, hosting, and transactional email delivery; Meta for conversion measurement when that tag or Conversions API is enabled; OpenAI to sort feedback and question reports; technical service providers that help operate or secure the service; professional advisers such as lawyers, accountants, or insurers; authorities, regulators, or courts where required or permitted by law; and a successor if SteamTicket is sold, transferred, reorganised, or merged, subject to appropriate protections.

Service providers must process personal information only for the services they provide to us and must use reasonable safeguards. Some providers may also act as independent controllers for their own services, terms, legal compliance, fraud prevention, payment processing, or security obligations.

We do not routinely export raw exam-result records or share them with employers, regulators or advertisers. Any public research output requires a separate disclosure review. Grouped results may still carry identification risk; removing names alone does not make source records anonymous. We cannot recall information already published in an approved aggregate.

7. Where Personal Information Is Stored and Processed

SteamTicket aims to host account and progress data in Canada where practical, including a Canadian Supabase region where available. However, Supabase region availability, fallback operations, Paddle, OpenAI, email providers, and other service providers may process or store personal information outside Canada, including in the United States, the United Kingdom, the European Union, or other jurisdictions. Information processed outside Canada may be subject to the laws, courts, law enforcement, regulators, or national-security authorities of those jurisdictions.

Where we use service providers outside Canada, we take reasonable contractual, technical, and organisational steps to protect personal information.

8. Safeguards

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information. Safeguards may include HTTPS/TLS, hashed passwords, access controls, limited administrative access, provider security controls, backups, logging, monitoring, and encryption at rest where supported by our service providers. SteamTicket question banks are designed to be encrypted at rest using AES-256-GCM, with entitlement-gated access to decryption keys through an edge function.

No website, app, database, network, browser storage, or service provider is perfectly secure. You are responsible for using a strong password, protecting your device, and keeping your login information private.

9. Retention

We keep personal information only as long as reasonably needed for the purposes described in this Policy or as required or permitted by law. Account and synced progress information is generally kept while your account is active. Purchase and refund records may be kept as needed for accounting, tax, consumer-protection, dispute, fraud-prevention, and audit purposes. Support messages may be kept for a reasonable period so we can respond and maintain a support history. Local storage remains in your browser until you clear it, overwrite it, or the app removes it.

When information is no longer needed, we will delete, anonymise, or securely restrict it, subject to technical backup cycles and legal retention needs.

Raw exam-result records are kept for no more than 24 months from first server receipt, with a necessity review after 12 months and earlier deletion when no longer needed. Retries do not restart this period. New-form local results are removed by the app after 24 months from their first local save when the app next accesses them; clearing browser data removes them sooner. We retain only minimal account/event identifiers, first-receipt and erasure information to prevent old queued results from recreating deleted records. A minimal withdrawal preference is kept while the account can upload; account deletion removes these linked control records.

Local database backup copies are encrypted and access-restricted, with deletion scheduled 29 days after each copy is created. Physical deletion can be delayed while the backup computer is off or the drive is disconnected. Our database provider may retain internal recovery copies under its own policies; we have not yet confirmed their maximum retention period. A restored system must reapply deletion and withdrawal controls before research resumes.

10. Your Privacy Rights

Depending on where you live and which law applies, you may have the right to ask for access to your personal information, ask for corrections, withdraw consent, request deletion, ask questions about our privacy practices, and complain to a privacy regulator. To make a request, email support@steamticket.ca from the email address associated with your account. We may need to verify your identity before responding.

You may complain to the Office of the Privacy Commissioner of Canada. Depending on the circumstances, you may also have rights through the privacy commissioner in Alberta or British Columbia, or another applicable regulator.

11. Breach Notification

If we become aware of a breach of security safeguards involving personal information under our control, we will assess the risk and take steps required by applicable law. Where required, we will notify affected individuals and report to the appropriate privacy regulator if the breach creates a real risk of significant harm or serious injury. We will also keep breach records as required by law.

12. Children

SteamTicket is intended for working adults and adult learners. It is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to SteamTicket, contact support@steamticket.ca.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The updated date will be shown above. If we make material changes to how we handle personal information, we will provide notice and, where required, seek consent.

14. Contact

Questions, requests, or complaints about privacy can be sent to support@steamticket.ca.