Privacy policy
CrackIt is an exam-practice app made by Olaoluwa Michael (legal name Micheal Aroja Olaoluwa, trading as Holaoluwakintan) in Nigeria. He is the data controller, the person responsible for your data. Contact: michaelolaoluwagab@gmail.com.
1. Using CrackIt without an account
Your scores, streak, topic results, saved questions, Daily 10 results and settings are stored only on your phone (browser or app storage). We do not receive them, apart from the anonymous counts in section 7, which hold no progress and no identity.
2. If you sign in with Google (optional)
What we get from Google: your name, email address and profile photo. We use them only to show your account and to keep your progress tied to you. We never see your Google password.
What we store: your practice progress (mock scores and history, streak days, topic results, saved and wrong questions, daily goal, Daily 10 results) and any practice packs you buy, so they work on any phone you sign in on.
Legal basis: you ask us to save your progress when you choose to sign in, so we process it to provide that service (contract) and with your consent. You can withdraw by deleting your data (section 12).
3. Daily 10 and the school leaderboard
The Daily 10 is the same 10 questions for every student each day. Playing it needs no account. Posting your score to the weekly leaderboard needs a Google sign-in, so that each student can post once per day.
When you post, we store on our server: the date, your score, the questions you answered, the school name you typed or picked (optional), your account ID and a short code made from it (your email is not stored on the leaderboard). The leaderboard shows other students only your first name and the initial of your surname, your points and your school, never your email, phone number or photo. Weekly totals per school are added up from the students who named that school. Scores are re-checked on our server and kept for the current and past weeks so the boards work; you can remove them at any time with "Delete my CrackIt data" (section 12).
4. Payments
Optional Post-UTME practice packs cost a one-time fee shown before you pay. Packs cannot be bought inside the CrackIt Android app on Google Play. Payments are processed by Paystack. You type your email and card or bank details into Paystack, not into CrackIt; we never see or store card details. We keep the payment reference, the pack and the amount so your purchase works on all your phones, and Paystack keeps its own payment records as the law requires. See the Terms and refund policy. Packs are not sold through Google Play billing.
5. Rewarded ads in the Android app (Google AdMob)
The CrackIt Android app can show an optional rewarded video ad: on a free practice question you may tap "Watch a short ad for a 50/50" to remove two wrong options. An ad appears only when you tap that button, never during mocks, exams, the Daily 10 or paid packs, and ads never unlock paid packs. The website in a browser shows no ads.
Ads are served by Google AdMob. To show and measure ads, Google may collect your device's advertising ID, IP address, approximate location derived from it, device type and settings, app name and version, and ad interaction data (which ads were shown, viewed or tapped). Google uses this data under its own policies: How Google uses information from ads and AdMob and data. You can reset or delete your advertising ID and opt out of ad personalisation in your phone's settings (Settings → Google → Ads). From the ad we only receive a one-time code saying the ad finished, which we keep for about 15 minutes to grant the 50/50.
6. Admission checker and question reports
The scores and grades you type into the admission chance checker are processed on your phone and are not sent to us. If you tap "Report a problem" on a question, we receive the question ID and the note you type (and your account ID if you are signed in) so we can fix the question.
7. Anonymous usage counts
To see whether CrackIt is helping students, we count visits and a few actions: opening a page, starting or finishing a test or the Daily 10, sharing, turning on reminders and tapping a pay button. Each count holds only the event name, the page (with any codes removed), the exam mode (JAMB, WAEC or NECO), a rounded score band for finished tests, whether it was the phone's first visit that day, and whether CrackIt was opened as an installed app. We use no cookies, no analytics companies and no user ID for this; your name, email and IP address are not stored with these counts. If your browser sends "Do Not Track" or "Global Privacy Control", nothing is counted. Counts are stored in our database (Supabase) for at most 24 months. Legal basis: our legitimate interest in improving the app.
8. Reminders, score cards and invite links
Reminders are off unless you tap "Remind me" and allow notifications; they are shown by your own phone and we receive no notification token. Score cards are drawn on your phone; your first name appears only if you tick "Show my first name", and you choose where to share them. Challenge and Daily 10 links carry the date or question numbers, the score and, if you chose it, your first name. When you are signed in, links you share also carry a short code made from your account number so we can credit you for friends who join; it does not include your name or email.
9. Who else handles your data
We do not sell your personal data. We share it only with these service providers, who process it on our instructions:
| Provider | What for | Where |
|---|---|---|
| Google (Sign-In) | Optional sign-in | Global |
| Google AdMob | Optional rewarded ads in the Android app only (section 5) | Global |
| Supabase | Database and file storage for accounts, progress, leaderboard and anonymous counts | European Union |
| Paystack | Payments | Nigeria |
| Cloudflare | Website and app hosting | Global network |
Because some providers store or process data outside Nigeria, your data may be transferred abroad. We only use providers that protect data with encryption and access controls, as the Nigeria Data Protection Act 2023 (NDPA) requires. CrackIt collects no contacts, precise location, camera, microphone or files.
10. How long we keep it
- Progress and account data: until you delete it, or 2 years after your last sign-in, whichever comes first.
- Leaderboard entries: until you delete your data (the weekly boards show the current and past weeks).
- Purchase records: for as long as you keep your account, so your packs keep working.
- Question reports: until the question is fixed, then at most 12 months.
- Anonymous usage counts: at most 24 months. Ad reward codes: about 15 minutes.
- Data on your phone stays there until you clear it.
11. Children and age
CrackIt is for students preparing for the UTME, WASSCE and NECO exams, usually aged 15 and over; on Google Play the app is listed for ages 16 and over. It is not directed at children under 13 and we do not knowingly collect personal data from anyone under 13; if we learn that we have, we delete it. If you are under 18, please ask a parent or guardian before you sign in, post to the leaderboard, watch an ad or buy a pack. A parent or guardian can ask us to see or delete a child's data at any time by email.
12. Your rights and deleting your data
Under the NDPA you can ask to see a copy of your data, correct it, delete it, move it to another service, or object to how we use it, and you can withdraw consent at any time. Email michaelolaoluwagab@gmail.com; we reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Delete in the app: Account → Delete my CrackIt data. This erases your progress, leaderboard entries and purchase records at once. Your Google sign-in record (name and email) is removed when you email us from that address; we do it within 7 days. Steps are also at crackit-ng.pages.dev/delete-account. Not signed in: clear the app's storage, or use Progress → Reset progress, or uninstall the app.
13. Security
All traffic uses HTTPS. Sign-in uses Google with a secure code exchange (PKCE). Each account can only read its own data, leaderboard files are written by our server only, and payment secrets stay on our server. If a breach ever affects your data, we will tell you and the Nigeria Data Protection Commission as the law requires.
14. Changes
If we change this policy we will update the date above and, for important changes, show a notice in the app.