Privacy policy.

This Privacy Policy describes how ISSB Preparation, a project of Athens Academy, Islamabad, Pakistan (“we”, “us”, “our”, or “the Platform”) collects, uses, stores, and protects personal information when you visit our website or use any of our services (collectively, the “Services”).

We are an independent preparation platform with the mission of making quality education accessible to candidates preparing for Pakistan's armed-forces selection process. We are not affiliated with the Inter Services Selection Board, the Pakistan Armed Forces, or any government body.

If you have any questions or requests regarding this Privacy Policy or the handling of your personal data, please contact us:

By using the Platform you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein. This Privacy Policy is incorporated by reference into our Terms & Conditions.

We collect only the information necessary to operate the Platform and deliver the Services to you. The categories of information we collect are set out below.

2.1 Account information.

When you register for an account you provide your full name, email address, and a password (stored as a one-way bcrypt hash — we never store or see your plaintext password). You may also provide an optional mobile phone number in the format 03XXXXXXXXX; when provided, this is used for payment verification and account-related communications.

2.2 Social sign-in via Google or Facebook.

If you choose to register or sign in using Google or Facebook, we receive from that provider only your name, email address, and a reference to your profile picture. We never receive or store your Google or Facebook password. We do not request access to your contacts, friends list, timeline, or any other social data. See Section 5 for more on these third-party providers.

2.3 Biodata and eligibility inputs.

The Platform's biodata and eligibility tools ask for information such as your date of birth, educational qualifications, physical measurements, and branch of interest. This information is used solely to generate your eligibility report and personalised study roadmap.

2.4 Test responses and uploaded materials.

When you participate in evaluated assessments — including psychometric practice tests, written exercises, picture-story submissions, and handwriting samples — your responses and uploaded images are received and stored temporarily for the purpose of evaluation. Once evaluation is complete and your report has been generated, the raw submitted material is permanently deleted (see Section 4 — Data Retention).

2.5 Payment receipt images.

If you upgrade to a paid plan, you upload an image of your payment receipt or transaction confirmation for manual verification by our team. This image is stored only until verification is complete, after which the image data is permanently deleted. The outcome of the verification (approved or declined) is retained as the permanent payment record.

2.6 In-house usage analytics.

We collect in-house usage analytics — such as pages visited, features used, and session timing — for the purpose of understanding how the Platform is used and improving it. These analytics are tied to an anonymous device identifier generated on your device; they are not linked to your name or email address except in aggregate. Our own analytics are built and run in-house. Separately from our analytics, third-party vendors, including Google, may collect data through cookies and similar technologies in order to serve advertising on our public pages, as described in Sections 5.4 and 10.

2.7 Device and security information.

When you create an account, sign in, or use the Platform, we record a device identifier (a security cookie stored in your browser), a fingerprint of your browser and device (derived from technical characteristics such as screen, browser and system settings), your browser and operating system type, and the IP address you connect from. We use this information only to secure accounts and to detect and prevent fraud — for example, fake or altered payment receipts, and attempts to return under a new account after access has been withdrawn. It is not used for advertising and is not sold or shared with third parties.

We use the personal information we collect for the following purposes only:

• To operate the Platform — creating and managing your account, authenticating your identity, and providing access to the features included in your plan.
• To evaluate your submissions — processing your test responses and uploaded materials using automated assessment technology under the supervision and review of our expert panel, and generating your evaluation report.
• To verify payments — reviewing your uploaded payment receipt, activating or managing your paid plan, and contacting you by phone or WhatsApp where payment verification requires direct communication.
• To communicate about your account — sending you transactional notifications (report ready, payment approved, account security alerts) and infrequent updates about material changes to the Platform or these policies.
• To personalise your experience — generating your study roadmap, tracking your progress, awarding XP and badges, and tailoring content recommendations based on your activity.
• To improve the Platform — using anonymised, aggregated analytics data to identify technical issues, understand usage patterns, and develop new features.
• To comply with legal obligations — retaining records we are required to keep under Pakistani law and responding to lawful requests from public authorities.

We do not use your account data (your name, email, phone number, test responses, or evaluation reports) for advertising or profiling for commercial purposes, and we will not sell, rent, or trade it to any third party. Advertisements that may appear on our public pages are served by third-party vendors (see Section 5.4) using their own cookies and similar technologies; those vendors do not receive your account data from us.

We follow a data-minimisation policy: sensitive raw submission data is deleted as soon as its purpose has been fulfilled. The table below summarises our retention periods.

Deletion of raw submission data is irreversible. The evaluation report — not the raw material — is the permanent record retained on our systems. We believe this approach minimises privacy risk while ensuring you retain access to your feedback.

Certain payment and transaction records may be retained beyond the periods above where required by applicable Pakistani law or for the resolution of disputes.

We share personal data with third parties only where strictly necessary to operate the Platform. We do not sell, rent, or trade your data. The limited categories of third parties we work with are described below.

5.1 Infrastructure providers.

Your data is stored on servers operated by reputable cloud infrastructure providers — including our database host and our web hosting provider — under data processing agreements that require them to protect your data and use it only for the services they provide to us. These providers are located in or accessible from data centres in the Asia-Pacific region.

5.2 Google (optional sign-in).

If you choose “Continue with Google”, your browser communicates directly with Google. We receive only your name, email address, and a profile picture reference from Google's OAuth service. Google's handling of your data during that authentication flow is governed by Google's own privacy policy at policies.google.com/privacy.

5.3 Facebook / Meta (optional sign-in).

If you choose “Continue with Facebook”, your browser communicates directly with Meta Platforms. We receive only your name, email address, and a profile picture reference from Facebook's OAuth service. We request only the minimum permissions (email and public_profile) and do not access your friends list, timeline, messages, or any other Facebook data. Meta's handling of your data during authentication is governed by Meta's Data Policy at facebook.com/privacy/policy.

5.4 Advertising.

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our site and/or other sites on the Internet.

You may opt out of personalised advertising by visiting Google's Ads Settings. Alternatively, you can opt out of some third-party vendors' uses of cookies for personalised advertising by visiting www.aboutads.info.

For more information about how Google uses data when you use our site, see How Google uses data when you use our partners' sites or apps.

We implement technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure:

• Encrypted transport — all communication between your browser and our servers uses TLS (HTTPS). We do not accept unencrypted HTTP connections.
• Hashed passwords — passwords are stored using bcrypt with a cost factor of 12. Plaintext passwords are never stored or logged.
• Access-controlled storage — uploaded files (handwriting samples, picture-story images, payment receipts) are stored in private, access-controlled object storage. They are never publicly addressable and are served only to authorised users via time-limited, signed requests.
• Uploaded files are never executable — files you upload are validated for type and content before storage and are served only as data, never executed as code.
• Rate limiting — our API endpoints apply per-IP and per-user rate limits to protect against brute-force and denial-of-service attacks.

While we take these measures seriously, no system is completely secure. We cannot guarantee the absolute security of your data and encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorised access to your account.

The Platform and the mobile app are intended for candidates preparing for Pakistan's armed-forces selection process, who must generally be at least seventeen (17) years of age to be eligible. The Platform is not directed at children under thirteen (13), and you must be at least 13 to register. Users between 13 and 17 may only use the Platform with the express consent of a parent or legal guardian.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account without parental consent, please contact us at admin@prepareissb.com and we will delete the account and associated data promptly.

You have the right to request deletion of your account and the personal data we hold about you. To submit a data deletion request, please contact us using one of the methods below:

• In the mobile app — open Settings and choose “Request account deletion”. You can cancel a pending request from the same screen.
• Email — send a message to admin@prepareissb.com with the subject line “Data deletion request”. Please include the email address associated with your account so that we can verify your identity.
• WhatsApp — message us at +92 334 2997799 from the mobile number registered to your account (this helps us verify your identity quickly).

We review deletion requests within 7 days. Once we have verified your identity and approved the request, sign-in stops and we delete your account and associated personal data promptly, and in any event within 30 days. You will receive a confirmation message. Full details of what is deleted and what is kept are on our Delete your account page, which applies to both the website and the mobile app.

Please note that certain records may be retained beyond this period where required by applicable Pakistani law or for legitimate payment-audit purposes (for example, the outcome of a payment verification). Raw submission data (handwriting images, test responses, interview transcripts) may already have been deleted before your request arrives, in accordance with our standard data-retention policy described in Section 4. Where a payment receipt was rejected as fake or altered, we keep a fraud-prevention record of the account, the device(s) and the IP address involved even after the account is deleted, so that the same device cannot be used to obtain access fraudulently again.

If you signed in with Google or Facebook, you can also revoke the app's access to your account directly in your provider's settings:

• Google — visit myaccount.google.com/permissions, find “ISSB Preparation”, and click Remove.
• Facebook — visit Facebook Settings → Apps and Websites, find “ISSB Prep”, and click Remove. Note that revoking provider access does not automatically delete your ISSB Preparation account or its associated data — please also submit a deletion request using one of the methods above.

Subject to applicable law, you have the following rights with respect to your personal data:

• Access — you may request a copy of the personal data we hold about you.
• Correction — you may update your name, phone number, and password via your account settings page at any time. If you need to correct your email address, please contact us.
• Deletion — you may request deletion of your account and personal data as described in Section 8.
• Objection — you may object to any use of your personal data that you believe is not covered by this Privacy Policy by contacting us.

To exercise any of these rights, contact us at admin@prepareissb.com. We aim to respond to all requests within 30 days. We may ask you to verify your identity before processing any request.

We use a small number of strictly necessary cookies and browser storage mechanisms to operate the Platform:

• Session cookie — an encrypted, HTTP-only cookie that keeps you signed in during your session. It is deleted when your browser session ends (or on sign-out).
• CSRF token — a security token included in forms to prevent cross-site request forgery.
• Anonymous device identifier — a randomly generated identifier stored in your browser's local storage for in-house analytics purposes. It contains no personal information and is not shared with any third party.
• Security device cookie — an HTTP-only cookie, kept for up to one year, that identifies your browser to us for account security and fraud prevention. It contains no personal information and is not shared with any third party.
• Cookie notice preference — a value stored in your browser's local storage that remembers you have dismissed the cookie notice, so it is not shown again.

In addition, third parties, including Google, may place and read cookies on your browser, or use web beacons or IP addresses to collect information, as a result of ad serving on our website. You can opt out of personalised advertising as described in Section 5.4. Third-party cookies may also be set by Google or Facebook during their respective OAuth flows (which you initiate by choosing to sign in with those providers).

This Privacy Policy is governed by and construed in accordance with the laws of the Islamic Republic of Pakistan. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of competent jurisdiction located in Islamabad, Pakistan.

We may update this Privacy Policy from time to time. When we do, we will post the revised policy on this page and update the “Last updated” date at the top. For material changes — such as new categories of data collected or new uses of existing data — we will make reasonable efforts to notify you via the email address or phone number on your account.

Your continued use of the Platform after a revised Privacy Policy has been posted constitutes your acceptance of that revised policy. If you do not agree with any change, please stop using the Platform and, if you wish, submit a data deletion request as described in Section 8.

The Prepare ISSB mobile app (iOS and Android) is another way to use the same service. You sign in with the same account, and the same data described in this policy is held about you whether you use the website or the app. This section describes what the app collects in addition to the website, and where the rest of this policy applies unchanged.

13.1 What the app collects beyond the website.

• Device identifier and optional device fingerprint — an identifier generated by the app on your device, and an optional device fingerprint. They are used only to prevent abuse and scam re-registration and to enforce one free trial per device. They are not used for advertising.
• Approximate location for usage analytics — for anonymous usage analytics, our server derives an approximate location (country and city) from the IP address of your connection. This is never GPS or precise location, and the app never asks for location permission.
• App version and platform — the app version and whether you use iOS or Android, so that we can support and update the app.
• Push-notification token — collected only if you allow notifications, and used only to tell you that feedback or a payment decision is ready. It is removed when you sign out.
• Photos of handwritten answer pages — photos you choose to upload, taken with the camera or picked from your gallery, for psychologist review.
• Audio and video recordings — audio for the Lecturette test and video for the Mock Interview test, recorded in the app and submitted only when you choose to submit them. They are stored in private, access-controlled storage provided by Supabase (Tokyo region) and are visible only to the staff who review them.
• Crash diagnostics — if the app crashes we receive, through Sentry (our crash-reporting provider), your device model, operating-system version, the app version and the error details. This does not include your test content.
• In-house usage analytics — which screens you view and when you start or finish a test, run by us. The app contains no advertising identifiers, no third-party advertising SDKs and does not track you across other companies' apps or websites.
• In-app purchases — if you buy access in the app, we store the store (Apple or Google), the product, the price and currency and the store's transaction number against your account. We never receive your card details; Apple or Google takes the payment. We keep this record as our financial record. Refunds are handled by the store.
• RevenueCat (purchase validation) — our service provider that checks your purchase receipt with the store. It receives the store transaction, the product and the price, and does not receive your name, e-mail address or phone number.

Card details are handled only by Apple or Google. Access can also be arranged on the website.

13.2 Permissions the app asks for.

• Camera — to photograph your handwritten answers and to record interview answers.
• Microphone — to record your Lecturette and your Mock Interview answers.
• Photos — to choose a picture of your handwritten pages from your gallery.
• Notifications — to tell you when feedback or a payment decision is ready.
• Face ID or fingerprint (biometrics) — optionally, to unlock the app on your device. Biometric data is handled by your phone's operating system and never leaves your device; we never receive it.

You can decline or later withdraw any permission in your phone's settings. The features that need it will then be unavailable, but the rest of the app keeps working.

13.3 Retention.

Recordings and uploaded pages are deleted after the psychologist's review is saved; the written report and score are kept as your permanent record. Recordings you start but never finish submitting are deleted after 7 days. Push-notification tokens are removed when you sign out. All other retention periods are those in Section 4.

13.4 Account deletion in the app.

In the app, open Settings and choose “Request account deletion”, or e-mail admin@prepareissb.com. We review requests within 7 days. Your profile, test answers, reports, recordings and device links are deleted; payment and receipt records required for accounting are kept in anonymised form, and staff audit logs are kept. See Section 8 and the Delete your account page.

13.5 Age and contact.

The app is intended for candidates aged 16 and over and is not directed at children under 13 (Section 7). For any privacy question about the app contact admin@prepareissb.com.