Privacy Policy

Effective July 19, 2026

What we collect

• Account: your email and name from your sign-in provider (Google) or the email you sign in with.
• Study data: your answers, timing, and the ability estimates computed from them.
• Readiness-check leads: the email you provide to view results, and campaign (UTM) parameters.
• Product analytics: anonymous usage events identified by a random ID — never question content, answers, or free text.
• Anti-abuse: rate-limit counters and salted one-way hashes of IP addresses (we do not store raw IPs for retake enforcement).

What we never do

• Sell your data.
• Email you marketing without opt-in. Every marketing email has an unsubscribe link.
• Put your email or name on shared result pages — share links are anonymous by design.

Cookies and local storage

• An essential session cookie keeps you signed in (httpOnly, secure — JavaScript cannot read it). No advertising cookies, ever.
• Your theme preference (light/dark) is stored in your browser's local storage.
• PostHog analytics stores a random identifier in your browser to count usage. It is never joined to your email.

Processors

We rely on: Vercel (hosting), Neon (database), Stripe (payments — we never see card numbers), Resend (email), PostHog (analytics), Sentry (error monitoring), Google (sign-in), Upstash (rate limiting), Cloudflare (DNS and email routing). Data is processed and stored in the United States.

Your rights

Wherever you live, we honor requests to access, correct, export, or delete your personal data — email [email protected] from your account address. We respond within 30 days. If you are in the EU/UK or California, these requests also cover your rights under GDPR/UK GDPR and the CCPA.

Children

The service is intended for adults preparing for professional certifications and is not directed at children under 16. We do not knowingly collect data from children.

Retention and deletion

Study data is retained while your account exists. To delete your account and data, email [email protected] — deletion completes within 30 days.

Security

All traffic is encrypted in transit; answer keys are never sent to your browser before you answer; payment details never touch our servers. Found a vulnerability? See security.txt — we take reports seriously.