Privacy

No analytics by default

ScoreMint does not add advertising trackers, analytics SDKs, or third-party tracking pixels in the ScoreMint web code.

• The app can run without user accounts.
• Legacy mobile-only runtime code is not loaded by the web app.
• Future analytics should be added only after privacy review and consent design.

Browser-local data

Progress, settings, saved records, workspace state, and review history are stored in this browser using scoped localStorage keys.

• web-presence:scoremint
• native-practice:scoremint
• native-library:scoremint
• native-workspace:scoremint
• native-settings:scoremint
• revenuecat-app-user-id:scoremint
• web-locale

User data controls

The /data route lets users inspect, export, import, and reset browser-local data for this app without touching unrelated localStorage entries on the same origin.

Paid features

ScoreMint offers an optional Premium subscription handled by RevenueCat Web Billing and its payment processor (Stripe). When Premium is available and you purchase it, an anonymous purchase identifier is stored in this browser (localStorage key scoremint.rc.appUserId) so the site can recognise your access on this device. ScoreMint does not see or store your card details; payment information is handled entirely by the billing provider. When no billing is configured, the app runs fully free and no purchase identifier is created.

Trademarks

ScoreMint is an independent study tool and is not affiliated with the College Board or ACT, Inc.

• SAT® is a trademark registered by the College Board, which is not affiliated with, and does not endorse, this site.
• AP® is a trademark registered by the College Board, which is not affiliated with, and does not endorse, this site.
• ACT® is a registered trademark of ACT, Inc., which is not affiliated with and does not endorse this product.

Sync and media services

Account sync and media worker proxy routes are disabled until server-side environment variables are configured. When enabled, these routes require authorization or allow-listed operations, apply rate limits, keep backend tokens server-side, reject backend URLs that fail the outbound URL policy, and reject cross-site browser POST signals before parsing request bodies.