The short version
- We collect only what JambCBT needs to work: how you sign in, your username and subjects, your practice results and your payments.
- Your phone number and email are never shown to other students. Your username and scores are, on leaderboards and challenges.
- We never see your card or bank details. Paystack handles payments.
- We don’t sell your information, and there are no ads.
- You can ask us to see, correct or delete your information at any time: hello@jambcbt.app.
1. Who we are
JambCBT (“we”, “us”) is an app for practising for the JAMB UTME: past questions with worked solutions, timed CBT mocks and challenges against other students. It runs at jambcbt.app. This policy explains what information we collect when you use it, why, and the choices you have. We follow the Nigeria Data Protection Act 2023.
JambCBT is not affiliated with, or endorsed by, the Joint Admissions and Matriculation Board (JAMB).
2. What we collect
When you sign in
- Phone number, if you sign in with a code sent by WhatsApp or SMS. We keep the number to recognise you next time. We store only a scrambled (hashed) copy of each code, never the code itself.
- Google account details, if you continue with Google: Google tells us your name, email address and profile picture, and we use them only to recognise you.
- Your username, the state you’re in (or that you’re outside Nigeria) and the four JAMB subjects you choose.
Before you sign in
So you can look around, JambCBT gives your browser a random guest ID. It isn’t linked to your name, number or email.
While you practise
- Your CBT mocks and challenges: answers, scores, time taken and points.
- How many free CBT mocks, recorded challenges and study sessions you’ve used.
- Challenges you create, and your place on their leaderboards.
When you pay
- What you bought (for example, a Monthly pass), the amount, the date, whether it succeeded and how you paid (card, bank transfer or USSD).
- If a parent or guardian pays through an “Ask a parent to pay” link, the email address they give Paystack for their receipt.
Paystack collects your card or bank details on its own secure page. We never see or store them.
What we don’t collect
We don’t use advertising trackers, we don’t build advertising profiles, and we don’t collect your location, contacts or photos.
3. How we use it
| What we do | Information used | Why we’re allowed to |
|---|---|---|
| Sign you in and keep your account | Phone number or Google details, username, state, subjects | To provide the service you asked for |
| Mark your mocks, keep your results and points, run leaderboards and challenges | Answers, scores, times, points, username | To provide the service |
| Give you a pass or subject change you paid for, and keep a record of it | Payment details listed above | To provide the service, and the law on keeping financial records |
| Count free trials, prevent abuse and keep JambCBT secure | Guest ID, account and usage records | Our legitimate interest in a fair, secure service |
| Answer you when you contact us | Whatever you send us | Your request |
We don’t send marketing messages. We only message you to deliver sign-in codes or to answer you.
4. What other students see
Other students can see your username and your scores, points and times on leaderboards and challenges, and the username of anyone who created a challenge. They never see your phone number, email, name from Google, state or payments. An “Ask a parent to pay” link shows only your username and the pass you chose. Choose a username you’re happy for other people to see.
5. Who we share it with
We don’t sell your information. We share it only with the companies that run parts of JambCBT for us, and only what each one needs:
- Google (Firebase and Google Cloud) hosts the app, the database and the sign-in service. Google also serves some of the app’s code files, and handles “Continue with Google”.
- Paystack processes payments. Paystack needs an email address for every payment, so for students we give it a JambCBT address linked to your account, not your own. For parent payments, Paystack receives the email the parent enters.
- A WhatsApp or SMS provider delivers your sign-in code. It receives your phone number and the code.
We may also share information if the law requires it, to protect people’s safety, or to investigate fraud or abuse.
6. Where it’s kept
JambCBT’s database and servers are in Google Cloud’s Belgium region (europe-west1), so your information is kept outside Nigeria. Google protects it under strict security and data-protection terms, and we make that transfer in line with the Nigeria Data Protection Act. Paystack processes payments in Nigeria.
7. How long we keep it
- Your account and practice results: for as long as you have an account. If you ask us to delete it, we delete your profile, results and points, and remove your username from leaderboards within 30 days.
- Payment records: for six years, as Nigerian tax and accounting law requires, even if you delete your account.
- Sign-in codes: deleted as soon as they’re used, and they expire within minutes either way.
- “Ask a parent to pay” links: stop working after seven days.
- Guest IDs that never sign in: may be deleted at any time, as they hold nothing but the ID.
8. What’s kept on your device
JambCBT stores a few things in your browser so the app works well: that you’re signed in, your light or dark theme, your study progress, questions you’ve already downloaded (so they aren’t downloaded again) and whether you’ve installed the app. We don’t use cookies for tracking. You can clear all of this in your browser’s settings; you’ll just need to sign in again.
9. Students under 18
Many JAMB candidates are under 18. If you are, please use JambCBT with the knowledge and permission of your parent or guardian, and involve them before you pay for anything. Parents and guardians can contact us at any time to see or delete their child’s information. JambCBT isn’t meant for children under 13.
10. Your rights
Under the Nigeria Data Protection Act 2023 you can:
- ask for a copy of the information we hold about you;
- ask us to correct it (you can change your username and subjects in the app);
- ask us to delete your account and information;
- object to, or ask us to limit, how we use it;
- ask for your information in a format you can take elsewhere;
- complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
To do any of these, email hello@jambcbt.app from the account’s email, or tell us the phone number and username. We may check it’s really you before acting, and we’ll reply within 30 days.
11. Keeping it safe
Everything between your device and JambCBT is encrypted (HTTPS). Only JambCBT’s own servers can change your account, results, points or passes; you can read your own records, and no one else’s. Payment confirmations are checked with Paystack before any pass is given. No system is perfectly secure, but if something ever went wrong that put your information at risk, we would tell you and the regulator as the law requires.
12. Changes and contact
If we change this policy, we’ll update the date at the top, and tell you in the app if the change is important. Questions or requests: hello@jambcbt.app.