Wrongbook is a personal side project run by an individual (Calin Nedelcu, Romania), not a company. For data-protection purposes that individual is the controller of your data. Contact: hello@wrongbook.ink.

• Your email address — to send one-time sign-in codes and to identify your account. It is the only thing you are asked for.
• Your study activity — answers, the mistakes they produced, your review schedule, progress, and the optional exam date and weekly hours you enter.
• Ordinary server logs kept by the hosting provider (IP address, request time, user agent), used for security and debugging.

No passwords (sign-in is by emailed code), no payment details, no advertising or cross-site tracking, and no analytics product of any kind.

• To run your account — signing you in, saving progress, scheduling reviews, showing your own analytics. Legal basis: performance of a contract (GDPR Art. 6(1)(b)) — the service you asked for.
• To keep the service working and safe — rate-limiting sign-in codes, server logs, abuse prevention. Legal basis: legitimate interests (Art. 6(1)(f)).

Your data is never used to profile you for advertising, and is never sold or rented.

Three providers process data on Wrongbook's behalf, each only to run the service:

• Neon — the Postgres database holding your account and study data. Currently hosted in the United States (AWS us-east-1).
• Vercel — hosting and serverless execution, plus the server logs described above.
• Google (Gmail SMTP) — delivery of sign-in code emails only.

Because the database and hosting are in the United States, personal data of users in the European Economic Area is transferred outside the EEA. Those transfers rely on the providers' standard contractual clauses and, where applicable, their certification under the EU–US Data Privacy Framework.

Two cookies, both strictly necessary, so there is no consent banner: a sign-in session cookie (an opaque token that keeps you logged in) and a subject-preference cookie (Mathematics or Physics). No advertising or cross-site cookies are set.

Your account and study data are kept for as long as the account exists. Sign-in codes are stored only as a salted hash and expire after ten minutes. Server logs are kept for a short period by the hosting provider.

You can permanently erase your account and everything attached to it from the Account page. Deletion is immediate and cannot be undone.

You have the right to access, correct, export, restrict or object to the processing of, and delete your personal data. Deletion is self-service on the Account page; for anything else, email hello@wrongbook.ink and you will get a reply within 30 days.

If you are in the EEA and think your data has been mishandled, you can complain to your national supervisory authority — in Romania that is the ANSPDCP.

Wrongbook is meant for people preparing to sit the CSCA exam, who are typically 16 or older. If you are under 16, please only use it with a parent's or guardian's permission — in several EEA countries their consent is legally required for a service like this. If you believe a child under 16 has an account without that permission, email hello@wrongbook.ink and it will be deleted.

This policy may change. Any material change is reflected in the “last updated” date, and if the change affects how your data is used you will be told by email before it takes effect.