Privacy policy

Study with Shabari (“the site”) is run by Shabari Shankar. Questions about this policy go to jshankar@mit.edu.

What the site stores

• If you create an account: your email address, an optional name, an optional MCAT test date, and a one-way hash of your password (never the password itself).
• When you practice: the answers you choose, choices you strike out, questions you flag, passage highlights, time per question and your results. Guests’ practice is linked to a random identifier in a cookie, not to a name or email.
• When you take a lesson: the answer you pick for each question, how sure you said you were, whether it was right, which common misconception it matched (if any) and the time you took. Like practice, it’s linked to your account or to the guest cookie.
• When you use the contact form: your name, email, topic, optional test date and message, plus a record of any automatic emails sent about it.
• Security records: a log of sensitive admin actions, and short-lived rate-limit counters keyed by a keyed hash of your IP address (the raw address isn’t stored).
• When you use the chat assistant: what you type, and any name, email or phone number you give it, is stored by IONOS AI Frontdesk (see below), and a summary of each chat is emailed to the site team.

Cookies

The site sets only the cookies it needs to work: a sign-in cookie if you have an account, and a guest cookie so you can resume practice without one. Both are HTTP-only. The site itself sets no cookie when you just read a page; the guest cookie is set when you start a practice set or lesson. On public pages the chat assistant’s widget loads from IONOS, and it may store data in your browser (cookies or local storage) for the chat. There are no advertising or cross-site tracking cookies, and no third-party analytics.

Visit counts

To see whether the free lesson and practice sets are useful, the site keeps a daily tally of a few events, such as “lesson started” and “lesson completed”. A tally is just a number per day: it has no cookie, account, IP address or anything else that could connect it to you. Days with fewer than five of an event aren’t shown even to the site’s admins.

Services that process data for the site

• Vercel hosts the site. Like any web host it keeps its own short-lived request logs (the page address, browser type and IP address), for one hour to one day depending on the hosting plan. Supabase hosts the database and uploaded images.
• Fonts and images are served from this site, so reading a page doesn’t contact Google or any other outside service, apart from the chat assistant below.
• IONOS provides the domains. An IONOS email account for the site isn’t set up yet, so replies come from jshankar@mit.edu.
• Calendly handles booking, and is loaded only on the booking page, under Calendly’s own privacy policy.
• The on-site chat assistant runs on IONOS AI Frontdesk. Its widget loads from IONOS (ionos.ai-voicereceptionist.com) on the public pages, never on practice tests, lessons in progress, sign-in or account pages. IONOS stores what you type, and any name, email or phone number you give it, under IONOS’s terms, and a summary of each chat is emailed to the site team. Don’t share anything in the chat that you wouldn’t put in an email.
• If error monitoring is turned on, Sentry receives technical error reports.

Your data is never sold or used for advertising.

How long it’s kept

• Account, practice and lesson data are kept until you delete your account.
• Sign-in sessions end after 30 days and are then deleted. Password reset links expire after an hour.
• Guest practice and lesson history is deleted 180 days after it was started, which is when the guest cookie that links it to your browser expires.
• Contact messages are kept while they’re useful for answering you and following up.
• Rate-limit counters expire within a day.

Your choices

• Download your data, or permanently delete your account and practice history, from Dashboard → Account.
• Guests can clear the practice and lesson history stored for their browser from the practice page.
• To have a contact message deleted, or for any other request, email jshankar@mit.edu.

Students under 18

Admissions consulting works with high-school students, many of them under 18. For anyone under 18, a parent or guardian is involved: they’re welcome on calls, and contact happens through the student’s or the parent’s email. The site isn’t directed at children under 13.

Changes

If this policy changes, the effective date above changes with it.