Privacy

Last updated 29 August 2026

The short version. We store your email address and the practice record you create: which questions you attempted, the marks you entered, and what you flagged.

Nobody else can see it. There is no teacher dashboard, no leaderboard, no advertising, and no analytics or tracking service. You can download it all or delete it permanently, from the menu inside the app, without asking anyone.

Who runs this

Xambuster IB is run by an individual, not a company. Contact: the contact form.

What is stored

Your email address. Used to sign you in, to verify the account, and to reset a forgotten password. Nothing else. You will not receive marketing email.
Your password is handled by Amazon Cognito and is stored only as a hash. This site never receives it and cannot read it.
Your practice record: for each question you interact with, its identifier, the marks you entered, whether you flagged it, how many times you attempted it, and when you last changed it.
Server logs recording that a request happened, with your account identifier and timing. Used to find faults. Kept for 30 days, then deleted automatically.

What is not stored

No name, school, age, or date of birth.
No analytics, advertising, tracking pixels, or third-party scripts. The site loads nothing from anyone other than Amazon Web Services.
No payment details. The site is free and takes no payments.

Cookies

Only functional ones. After you sign in, three short-lived cookies are set (CloudFront-Policy, CloudFront-Signature, CloudFront-Key-Pair-Id) so the question images will load for you and not for strangers. They expire within the hour. Your sign-in token is kept in your browser's local storage so you stay signed in, and is removed when you sign out.

Who can see your record

You. The server works out whose data to read from your verified sign-in token, so one account cannot reach another's. The operator can technically access the underlying storage, as any operator can, but there is no feature that surfaces your record to anyone else, and none is planned without asking first.

Where it is stored

Amazon Web Services, in the US East (N. Virginia) region. If you are in the UK or the EU, that means your data is processed in the United States.

Your rights

See and download it. The Export button in the app returns everything held about you as a JSON file, immediately.
Delete it. The Delete button removes your practice record and your account. There is no waiting period and no email to send.
Correct it. Your record is entirely made of entries you created; change any of them by marking the question again.

One honest detail about deletion: the storage keeps previous versions of a file for 30 days as protection against accidental loss. Your deleted record is unreachable through the site immediately, and those prior versions expire automatically within 30 days. If you need them purged sooner, ask through the contact form and it will be done by hand.

Age

This site is built for IB Diploma students, who are typically 16 to 18. If you are under 16, please ask a parent or guardian before creating an account. If a parent or guardian wants an account and its data removed, ask through the contact form and it will be deleted.

Email

The only email sent is transactional: a code to verify your address when you register, and a link if you ask to reset your password. Sent through Amazon Cognito.

Content

Past-paper questions and markschemes are the copyright of their respective examination boards and are reproduced here for private study. Enquiries about that content can be sent through the contact form.

Changes

If this notice changes in a way that affects what is collected or who can see it, the date at the top changes and the change is described here.