Privacy Policy

We collect personal information only in the situations below.

• When you create an account: your full name, your email address and a password.
• When you sign in with Google: the basic profile details Google shares with us for that purpose, such as your name and email address.
• When you confirm your email address or reset your password: we send you an email containing a one-time link.
• When you use the site: our servers and our hosting provider process the technical information needed to deliver pages, such as your IP address, your browser type and the address of the page you request. Search terms you enter are part of the page address, so they can appear in these technical logs.
• When you contact us: whatever you include in your message.

We do not currently use analytics, advertising or tracking cookies, and we do not currently offer a newsletter. If that changes, this policy will be updated.

• To create and secure your account and let you sign in.
• To send the emails you ask for, such as address confirmation and password reset, and security notices about your account.
• To run, secure and fix the site, for example to diagnose errors and prevent abuse.
• To answer messages you send us.
• To handle copyright and rights-holder notices.

You do not need an account to browse the library, search it or open resources.

If you create an account, we ask for your full name, your email address and a password. Your password is handled by our authentication provider, which stores it in hashed form; it is not kept in our own database or in our logs.

To confirm your address or reset your password, we send you an email containing a one-time link. While an address is waiting to be confirmed, it is also held in a cookie on your device for up to one hour so that the confirmation page can show it, as described in the section on cookies below.

These automated emails are sent from noreply@globalexamlibrary.com. That address only sends messages and is not a way to contact us: for help, write to support@globalexamlibrary.com.

Who handles this data for us

• Supabase hosts our database and provides account authentication.
• An email delivery service, used by our authentication provider to send confirmation and password-reset emails.

These providers may process data in countries other than your own, depending on how their services are configured.

You can choose to sign in with Google instead of creating a password. If you do, you are sent to Google to sign in, and Google shares basic profile details with us for that purpose, such as your name and email address. Your Google password is handled by Google and is never given to us.

Google’s own privacy policy applies to what Google collects when you use it.

This section applies only if you choose to sign in with Google. It explains how Global Exam Library accesses, uses, stores and shares the information Google provides when you do.

What we receive from Google

We ask Google only for the basic sign-in permissions: your email address and your basic profile. With them, Google shares your name, your email address and whether Google has confirmed it, a link to your profile picture, and an identifier for your Google account.

We do not ask for access to your Gmail, Google Drive, Google Calendar, contacts or any other Google service, and we never receive your Google password.

How we use it

We use this information only to create your account, sign you in and keep your account secure. We do not sell it, use it for advertising, or use it to train artificial intelligence or machine-learning models.

How it is stored

Supabase, our authentication provider, stores this information with your account record. We do not copy it into any other database, and the site itself uses only your account identifier and email address.

Who it is shared with

We do not share or transfer Google user data to anyone other than the service providers named in this policy that provide sign-in and host the site for us, and only so that they can do so.

Deleting it

We keep this information for as long as your account exists. When you delete your account, your account data is deleted from our side immediately. To have your account deleted, email privacy@globalexamlibrary.com.

You can also remove Global Exam Library’s access in your Google Account settings. Doing so does not delete your Global Exam Library account; to delete it, email privacy@globalexamlibrary.com.

Global Exam Library’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The cookies we set exist so that signing in works. We do not set other cookies ourselves.

• A sign-in session cookie (its name begins “sb-” and contains “auth-token”). It is set only when you sign in and keeps you signed in. On the live site it is sent only over HTTPS, and it can remain on your device for up to 400 days unless you sign out or clear it.
• A short-lived sign-in helper cookie (its name contains “code-verifier”), used only while a sign-in with Google or an email link is being completed.
• A cookie named “gel-pending-email”, which holds an email address awaiting confirmation for up to one hour.

None of these cookies is used for analytics or advertising, and we do not currently set any that are.

You can sign out at any time, and you can clear or block cookies in your browser settings. If you block them, signing in will not work.

Hosted files are kept in private storage with Cloudflare, which also hosts the site and delivers it over its network. When you open a hosted file, your browser is sent to a signed link created for that request; the link stops working after about five minutes.

We do not claim ownership of third-party materials because we link to or host them. Showing a resource here is not a statement that it is official, authentic, verified or safe; each resource’s label tells you how it is made available.

Other resources open on the examination authority’s own website, or as the authority’s own PDF. When you follow one, you leave this site, and that website’s own privacy practices apply to what it collects. We do not control other websites.

Some authorities allow links to their material but not hosting by us. For example, AQA resources are provided as links to AQA’s own website only; we do not host them.

• Your password is stored by our authentication provider in hashed form.
• On the live site, the sign-in cookie is sent only over HTTPS.
• Hosted files are kept in private storage and opened only through short-lived signed links.
• Our application logs are filtered so that secrets such as passwords and keys are not written to them.
• Access rules on our database limit what the public site can read to published catalogue data.

No online service can be completely secure, so we cannot guarantee absolute security.

We keep your account details for as long as your account exists. When you delete your account, your account data is deleted from our side immediately.

There is currently no self-service option for deleting your account. To have your account deleted, email privacy@globalexamlibrary.com.

Cookies last as described above. Technical logs are kept by our hosting providers for the periods they set.

• Browse, search and open resources without an account.
• Choose email sign-in or Google sign-in.
• Sign out at any time, and clear cookies in your browser.

You can ask us to tell you what personal information we hold about you, to correct it, to delete it or to close your account, by writing to privacy@globalexamlibrary.com. Depending on where you live, you may have further rights under local law, and we will respond as the law requires.

You must be at least 16 years old to create an account. If you believe someone under that age has created an account, please write to privacy@globalexamlibrary.com.

We will post any change on this page. This version took effect on October 3, 2026.

For privacy questions and requests, including a request to delete your account, email privacy@globalexamlibrary.com.

For other topics, including support, paper requests and copyright or rights-holder notices, see the Contact page and Rights holders and takedown requests.