Privacy notice

Who is asking

Momentum is run by Momentum, who decides what happens to the information described here. Questions, requests and complaints go to vinnie5224@gmail.com, and are answered by a person.

This notice is issued in English and Bahasa Melayu, as section 7(3) of Malaysia's Personal Data Protection Act 2010 requires. A Chinese version is offered because the app is read in Chinese; where the three differ, the English and Malay are the ones that were written first.

What Momentum records

Everything below is something you typed, uploaded, or did in the app, apart from what Google passes on if you choose to sign in with it. Momentum does not buy information about you, and collects nothing else from other services.

• Your account. Your email address, and a password you never send us in a readable form — Supabase Auth holds it hashed, and Momentum cannot read it. A name, if you give one; it is optional and only used to greet you. If you choose Continue with Google instead, there is no password: Google passes on your email address, your name and a link to your profile picture, Supabase Auth keeps them with the account, and the name is used as one you typed would be. The picture is not shown anywhere in Momentum.
• Your setup. Exam board, qualification, target exam year, weekly study hours, timezone, and interface language. These set the defaults so the app does not ask again on every device.
• Your studying. The subjects and syllabus points you add, the status you give each one, when reviews fall due, study sessions and how long they ran, tasks, goals, grade targets, flashcards and how you answered them, past paper scores and dates, and difficulty ratings.
• Papers and questions. Papers you build in the exam builder: the questions on each and their order, what you asked for when you built it, how it prints — header, footer, numbering, the words you change on the paper, and a cover with a school name and logo if you add them — the templates you keep of that, and each sitting, with the marks you give yourself, the time it took and any notes. The questions you save in Topical, and the ones you mark done. And questions you write yourself: the question, its chapters, marks, time, difficulty, answer and mark scheme, and any pictures you attach.
• Multiple-choice practice. Each set you sit under MCQ practice: its questions and their order, the letter you chose for each, whether it was right, how long it took, the ones you flagged, any reason you gave for a wrong answer, and whether you logged it as study. Your mistakes to put right and how each chapter is going are worked out from these.
• Classes and teachers' tests. If you teach: the classes you make, the tests you share — their questions, time limit, due date and what students see — and their links. If you join a class or sit a teacher's test: the name you give that teacher, when you joined, and your answers, score and time on their tests.
• Files you upload. Notes attached to a subject — PDF, Word, PowerPoint, plain text, Markdown, or an image, up to 20 MB each — and pictures on flashcards and in questions you write, up to 5 MB each. They go in private buckets that only your own session can read.
• Reminder records. Whether you want the daily email, and for each one sent: the date, how many items it named, and the delivery id the mail provider returned. This is what stops the same reminder being sent twice and what decides to stop sending to someone who never opens them.
• Ordinary server records. Requests to the site are logged by the host in the normal way. Page views and loading speed are measured by Vercel Analytics, which is served from this domain, sets no cookies, and reports totals rather than individuals.

Why, and on what footing

Momentum records these things to run the account you asked for: to show the right syllabus, work out what is due, and keep your work between visits. Under the PDPA this is processing for a purpose you were told about and agreed to when you signed up; for readers in the UK or EU, it is performance of the contract between us rather than consent — which matters, because someone under 16 cannot give that consent on their own.

Reminder emails are the exception. Those are sent because you left them switched on, and every one carries a link that switches them off without signing in. Turning them off does not affect the account.

One thing is shared with another account, and only because you choose it. When you join a teacher's class or sit a test a teacher shared, that teacher sees the name you gave, your email address, and your answers, score and time on their tests — and, in a class, that you are a member. Leaving a class stops anything new showing; what you handed in stays with the teacher, as handed-in work does, until you delete your account or the teacher deletes that attempt — which takes it out of your account too, and lets you sit the test again.

Momentum also counts how each multiple-choice question is answered across everyone — how many answered it, how many got it right, and how often each letter was chosen — without recording who. Those counts show how hard a question is and hold nothing about you, so they stay when an account is deleted.

Momentum does not profile you, does not make automated decisions about you, and does not advertise. Nothing here is sold, and nothing is shared with anyone for their own purposes.

Who else handles it

Three companies process data on Momentum's instructions and on nobody else's. They are not permitted to use it for themselves.

• Supabase — the database, sign-in, and the file bucket. Your account, your studying and your uploads live here, in the ap-southeast-1 region (Singapore).
• Vercel — hosting and the analytics described above. The app runs in the sin1 region (Singapore).
• Brevo — sends the reminder emails. It receives your email address and the text of the mail, which names the subjects and how many items are due. Brevo is based in France, so if you have reminders switched on, your email address is handled in the European Union. If that matters to you, turning reminders off stops it.

Google is involved only if you choose Continue with Google. It confirms who you are and passes Momentum your email address, name and profile picture. Google is not working on Momentum's instructions here: it knows that you signed in to Momentum, and handles that under its own privacy policy. You can remove Momentum from the apps connected to your Google account at any time, and signing up with an email address and a password leaves Google out entirely.

Beyond these, information is disclosed only where the law requires it, and you would be told unless telling you is itself prohibited.

How long it is kept

For as long as the account exists. Momentum is a record of work done over years, and quietly deleting a syllabus you filled in eighteen months ago would defeat the point of it.

You can delete any multiple-choice set of your own whenever you like, and its answers go with it. An attempt at a teacher's test is the exception: the test gives each student one sitting, so it is that teacher who can delete it.

When you delete your account, the deletion is immediate and complete: the account row is removed and every table keyed to it goes with it — subjects, topics, sessions, tasks, goals, flashcards, papers, multiple-choice answers, classes, reminder records — along with the files in your bucket. A teacher's results lose your answers with it; a teacher who deletes their account takes their classes and tests with them, while your own record of a test you sat stays yours. There is no recovery afterwards, so export first if you want a copy. Backups taken before the deletion age out on the host's own cycle.

What you can do about it

Under the PDPA you may ask for a copy of what is held about you, ask for anything wrong to be corrected, withdraw consent to a purpose, ask that processing be limited, and complain to the Personal Data Protection Commissioner if the answer does not satisfy you. If you are in the UK or EU, you have the equivalent rights under the GDPR, including portability and erasure, and may complain to your own supervisory authority.

Two of those do not need asking. Download everything in Settings gives you the whole account as a JSON file, immediately. Delete account, in the same place, removes it. Anything else — a correction, a question about a purpose, a complaint — goes to vinnie5224@gmail.com, and you will get an answer within 21 days, which is what the PDPA allows.

How it is kept

Every table carries the id of the account that owns the row, and every query filters on it; a separate layer of database row-level security scopes what a browser's own key can reach, so the two would both have to fail for one account to see another. The one exception is a teacher's results, which read only the answers given to that teacher's own tests, by students who chose to sit them. The notes bucket is private and is read with your session rather than an administrative key. Traffic is encrypted in transit. Passwords are stored hashed by Supabase Auth and are not visible to Momentum or to Momentum.

No system is beyond reach. If a breach happens that puts you at risk, you will be told what happened, what it affects, and what to do about it.

Cookies

Three things are stored in your browser, all of them necessary and none of them tracking you:

• The sign-in cookies Supabase sets, which are what keep you signed in.
• momentum-locale, which remembers the language you chose. It holds one of three words, lasts a year, and cannot be read by scripts.
• momentum-theme, which remembers light or dark. It is kept in your browser's own storage and never sent to the server.

There is no advertising, no third-party tracker, and nothing that follows you to another site — which is why Momentum does not put a cookie banner in front of you.

Age

Momentum is for students aged 13 and over. If you are younger than that, please do not create an account; if one is created anyway and we learn of it, it will be deleted.

If you are between 13 and 18, it is worth telling a parent or teacher that you use it, and they may contact vinnie5224@gmail.com on your behalf about anything in this notice.

Changes to this notice

If what Momentum does with your information changes, this page changes with it and the date at the top moves. A change that materially affects you will be said in the app, not left here to be discovered.