Privacy Policy

Last updated October 11, 2026

NextPoint helps students practice for the ACT. This page explains what we collect, why, who helps us run the service and the choices you have. We do not sell personal information and we do not show ads.

Who we are

“NextPoint”, “we” and “us” mean the team that runs this website. NextPoint is independent and not affiliated with ACT, Inc. Questions about this policy go to nextpoint.act@gmail.com.

What we collect

• Account details. The name you enter, your email address and a password. Our server passes your password to Supabase for sign-in; Supabase stores it in a protected, hashed form, and we do not store the password ourselves. If you choose Google or Apple sign-in, we receive the name and email that provider shares.
• Profile and goals. Whether the account is for a student or a parent, grade level, current and target ACT scores, test date, focus subject, how many days and minutes you plan to study, a daily problem goal and an optional note about why the goal matters (up to 300 characters). All of this is information you choose to give us.
• Practice data. Your answers, whether they were correct, time per question, hints used, the confidence and “why I missed it” tags you add, drill, section and test results, your Daily review schedule, saved in-progress sessions, your study plan and the sessions you check off.
• Billing details. Payments are handled by Stripe. We never see or store your card number. We keep your Stripe customer and subscription identifiers, plan, status and billing period.
• AI features. When you ask the AI tutor, we send OpenAI the question (with its passage and choices), the correct answer, the answer you chose, the explanation you already saw, your message (up to 500 characters) and the recent conversation. For AI study-plan advice we send your plan settings and practice statistics, not your name or email. We ask OpenAI not to store these requests.
• Technical data. Our hosting provider records standard server logs such as IP address, browser type, pages requested and errors. We also use privacy-friendly page-view analytics that do not use cookies and do not follow you across other websites.

How we use it

• To run NextPoint: grade your answers, schedule your Daily review, estimate scores, build your study plan and show your progress.
• To take payments, manage your subscription and send account emails such as confirmation and password-reset links.
• To keep the service secure, prevent abuse and fix problems.
• To improve the questions, explanations and product, using combined data where possible.
• To meet legal obligations.

Who we share it with

We share data only with service providers that help us run NextPoint, and only as needed:

• Supabase for our database and sign-in.
• Cloudflare Turnstile for security checks on email sign-in, registration and account-email requests. Cloudflare processes technical information such as your IP address and browser details to detect bots.
• Vercel for hosting and page-view analytics.
• Stripe for payments.
• OpenAI for the AI tutor and study-plan advice.
• Google and Apple, only if you choose to sign in with them.
• Desmos, whose graphing calculator loads from desmos.com when you open it. Desmos can see your IP address and browser details, as any website you load a script from can.
• Google Gmail for sending account emails through our configured email delivery service.

We may also disclose information when the law requires it, to protect people or the service from harm, or as part of a sale or reorganization of NextPoint. We do not sell personal information and we do not share it for advertising.

Cookies and browser storage

We use only what the site needs to work: cookies that keep you signed in, a short-lived cookie that remembers where to send you after you sign in, a cookie that stores your time zone so “today” matches your day, and browser storage that saves a practice set you have started. We do not use advertising or cross-site tracking cookies.

Students and children

NextPoint is for people aged 13 and older. We do not knowingly collect information from children under 13, and we delete it if we learn we have. If you are under 18, please use NextPoint with a parent or guardian’s permission. A parent or guardian can email us to review or delete a student’s data.

How long we keep it

We keep your data while your account is open. If you ask us to delete your account, we delete or anonymize your personal data, except records we must keep by law, such as payment records.

Your choices and rights

• You can update your goals and profile in Settings and manage or cancel your plan on the Billing page.
• You can ask us to give you a copy of your data, correct it or delete your account by emailing nextpoint.act@gmail.com.
• Depending on where you live, such as California, the European Economic Area or the United Kingdom, you may have additional rights, including to object to or limit some processing. We will respond within the time the law requires.

Security

Traffic to NextPoint is encrypted with HTTPS. Our database uses row-level security, so each account can read only its own records, and answer keys stay on the server until you submit an answer. No online service is perfectly secure, so please use a strong password you do not use anywhere else.

International use

Our providers may process data in the United States and other countries.

Changes

If we change this policy in a meaningful way, we will update the date above and, for significant changes, tell you by email or on the site.

Contact

Email nextpoint.act@gmail.com or visit the contact page. See also our Terms of Service.