The short version
- We collect only what JambCBT needs to work: how you sign in, your username and subjects, your practice results and your payments.
- Your email is never shown to other students. Your username and scores are, on leaderboards and challenges.
- We never see your card or bank details. Paystack handles payments.
- We don’t sell your information, and there are no ads.
- You can delete your account yourself, at once, in the app: Account → Delete account.
- A few JambCBT staff can look up your account to help you or stop abuse. They never see your password or your answers, and everything they do is recorded.
- You can ask us to see or correct your information at any time: hello@jambcbt.app.
1. Who we are
JambCBT (“we”, “us”) is an app for practising for the JAMB UTME: past questions with worked solutions, timed CBT mocks and challenges against other students. It runs at jambcbt.app. This policy explains what information we collect when you use it, why, and the choices you have. We follow the Nigeria Data Protection Act 2023.
JambCBT is not affiliated with, or endorsed by, the Joint Admissions and Matriculation Board (JAMB).
2. What we collect
When you sign in
- Email address and password, if you sign in with email. Google’s sign-in service keeps your password in a scrambled (hashed) form. We never see it.
- Google account details, if you continue with Google: Google tells us your name, email address and profile picture, and we use them only to recognise you.
- Your username, your location (the state or state capital you pick, or outside Nigeria) and the four JAMB subjects you choose.
Before you sign in
So you can look around, JambCBT gives your browser a random guest ID. It isn’t linked to your name or email.
While you practise
- Your CBT mocks, Practise Quizzes and challenges: answers, scores, time taken and points.
- How many free CBT mocks, Practise Quizzes, recorded challenges and study sessions you’ve used.
- Challenges you create, and your place on their leaderboards.
When you pay
- What you bought (for example, Premium Monthly), the amount, the date, whether it succeeded and how you paid (card, bank transfer or USSD).
- If a parent or guardian pays through an “Ask a parent to pay” link, the email address they give Paystack for their receipt.
Paystack collects your card or bank details on its own secure page. We never see or store them.
If you turn on notifications
- A notification token for each device where you turn them on (up to five): an ID your browser makes so we can send to that device. It isn’t your phone number.
- Which kinds of notification you want (news, new challenges, streak reminders, payments). We use your subjects to send only the challenges that match them.
If you use Refer & Earn
- Your referral code, and who signed up with it. If you signed up with a friend’s link, we keep whose link it was.
- What you’ve earned and withdrawn.
- When you ask to withdraw: the bank or wallet, the account number and the account name to pay you into.
What we don’t collect
We don’t use advertising trackers, we don’t build advertising profiles, and we don’t collect your location, contacts or photos.
3. How we use it
| What we do | Information used | Why we’re allowed to |
|---|---|---|
| Sign you in and keep your account | Email and password, or Google details; username, location, subjects | To provide the service you asked for |
| Mark your mocks, keep your results and points, run leaderboards and challenges | Answers, scores, times, points, username | To provide the service |
| Give you Premium or a subject change you paid for, and keep a record of it | Payment details listed above | To provide the service, and the law on keeping financial records |
| Send the notifications you turned on | Notification tokens, your choices, your subjects | Your consent, which you can withdraw by turning them off |
| Run Refer & Earn and pay you what you’ve earned | Referral code and sign-ups, earnings, bank details you give | To provide the service you asked for |
| Count free trials, prevent abuse and keep JambCBT secure | Guest ID, account and usage records | Our legitimate interest in a fair, secure service |
| Answer you when you contact us | Whatever you send us | Your request |
We don’t send marketing messages. We only email you to reset your password or to answer you, and we send only the notifications you turn on.
4. What other students see
Other students can see your username and your scores, points and times on leaderboards and challenges, and the username of anyone who created a challenge. They never see your email, name from Google, location, payments or bank details. An “Ask a parent to pay” link shows only your username and the Premium plan you chose. Choose a username you’re happy for other people to see.
5. Who we share it with
We don’t sell your information. We share it only with the companies that run parts of JambCBT for us, and only what each one needs:
- Google (Firebase and Google Cloud) hosts the app, the database and the sign-in service. Google also serves some of the app’s code files, handles “Continue with Google”, sends password-reset emails, and delivers the notifications you turn on.
- Paystack processes payments. When you pay, Paystack receives your account’s email address so it can send you a receipt (if your account has no email address, we give it a JambCBT address linked to your account instead). For parent payments, Paystack receives the email the parent enters.
We may also share information if the law requires it, to protect people’s safety, or to investigate fraud or abuse.
6. Who at JambCBT can see it
A small number of JambCBT staff (moderators and admins) help run the app. To answer you, give Premium by hand (for example, when a payment went through but Premium didn’t arrive) or deal with abuse, an admin can look up an account by username, email or account ID. They then see its username, email address, how it signs in, when it joined, its Premium and its points. They never see your password, your location or your answers, and they can’t change your points or results. To pay a Refer & Earn withdrawal, an admin sees the bank details on that request. Moderators can remove a challenge that breaks our terms.
Every staff action is recorded: who did it, what, to which account, when and why. We use those records only to trace mistakes and misuse.
7. Where it’s kept
JambCBT’s database and servers are in Google Cloud’s Belgium region (europe-west1), so your information is kept outside Nigeria. Google protects it under strict security and data-protection terms, and we make that transfer in line with the Nigeria Data Protection Act. Paystack processes payments in Nigeria.
8. How long we keep it, and deleting your account
- Your account and practice results: for as long as you have an account.
- Payment records: for six years, as Nigerian tax and accounting law requires, even if you delete your account.
- Refer & Earn withdrawal requests: kept with the payment records, even if you delete your account.
- Notification tokens: until you turn notifications off, sign out on that device or delete your account. Tokens that stop working are deleted automatically.
- “Ask a parent to pay” links: stop working after seven days.
- Guest IDs that never sign in: may be deleted at any time, as they hold nothing but the ID.
- Records of staff actions: while they’re needed to trace mistakes and misuse. They hold account IDs, not contact details.
- Our server logs, which may include an account ID but not your name or email: deleted after 30 days.
Deleting your account
You can delete your account in the app at any time: Account → Delete account, then type your username to confirm. It happens at once, and it can’t be undone. We delete:
- your profile: username, location and subjects;
- your points, results, study record, quiz history and free trials, and any Premium you have (time left on Premium isn’t refunded; see our terms);
- your place on the leaderboard and on every challenge’s leaderboard;
- challenges you created that nobody has played, and any “Ask a parent to pay” links;
- your Refer & Earn code and balance (withdraw what you’ve earned first);
- notifications on all your devices;
- your sign-in: your email and password, or the link to your Google account. (Sign-in is shared with other apps from the same makers; if you also use one of them, your sign-in stays for that app, but JambCBT forgets it.)
A few things stay. Payment records stay for six years, as the law requires; they show what was bought, the amount and the date, linked to an account ID, not your name or email. Refer & Earn withdrawal requests stay with them, so a request you made can still be paid. Challenges you created that other students have played stay until they end (a week after they were created), so those students keep their results; they show “by Former student” instead of your username.
Deleting also clears JambCBT’s data from the browser you delete it on. If you can’t sign in, email us from the account’s email address, or tell us its username, and we’ll delete it for you.
9. What’s kept on your device
JambCBT stores a few things in your browser so the app works well: that you’re signed in, your light or dark theme, your study progress, questions you’ve already downloaded (so they aren’t downloaded again), whether you’ve installed the app and whether notifications are on. We don’t use cookies for tracking. You can clear all of this in your browser’s settings; you’ll just need to sign in again.
10. Students under 18
Many JAMB candidates are under 18. If you are, please use JambCBT with the knowledge and permission of your parent or guardian, and involve them before you pay for anything. Parents and guardians can contact us at any time to see or delete their child’s information. JambCBT isn’t meant for children under 13.
11. Your rights
Under the Nigeria Data Protection Act 2023 you can:
- ask for a copy of the information we hold about you;
- ask us to correct it (you can change your username and subjects in the app);
- delete your account and information (in the app: Account → Delete account, or ask us);
- object to, or ask us to limit, how we use it;
- ask for your information in a format you can take elsewhere;
- complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
To do any of these, email hello@jambcbt.app from the account’s email, or tell us your username. We may check it’s really you before acting, and we’ll reply within 30 days.
12. Keeping it safe
Everything between your device and JambCBT is encrypted (HTTPS). Only JambCBT’s own servers can change your account, results, points or Premium; you can read your own records, and no one else’s. Staff get only the access their role needs, and must sign in with Google, which protects their accounts with its own security checks. Payment confirmations are checked with Paystack before any Premium is given. No system is perfectly secure, but if something ever went wrong that put your information at risk, we would tell you and the regulator as the law requires.
13. Changes and contact
If we change this policy, we’ll update the date at the top, and tell you in the app if the change is important. Questions or requests: hello@jambcbt.app.