Privacy policy

The short version

We collect the minimum needed to run a study tool: your practice activity, an anonymous device identifier, and — only when you choose to give it — your email address. We run no ads, never sell or rent your data, and use no advertising trackers (Google Analytics runs here for audience measurement only, with Google Signals and ad personalisation switched off). Payment card details never touch our servers.

What we collect, and why

• Practice activity — answers, scores, streaks, and quiz progress, so your reports and weak-area feedback work. Before you have an account this is keyed to a random device identifier stored in your browser.
• Email address — collected at exactly the places you type it: the post-diagnostic report gate, PDF downloads, checkout, sign-in, and the contact form. Used to deliver the thing you asked for and, only with your unchecked-by-default consent, occasional study guidance.
• Purchase records — handled by Stripe. We store that your account owns the simulator and the payment reference; your card number never reaches us.
• First-party analytics events— page-level product events (e.g. “quiz started”, “report viewed”) tied to the device identifier, so we can see which parts of the product help. These stay on our own infrastructure: no cross-site tracking, no advertising identifiers.
• Google Analytics 4— a third-party measurement tag from Google that records page views and the same product events, so we can see which sources bring people here. It sets its own cookies and Google processes that data as an independent controller. We disable Google Signals and ad personalisation, so it is not used to build advertising audiences or follow you across other sites. You can block it with any tracker-blocking extension or your browser’s Do Not Track setting without losing any feature of this site.

Who processes it

Infrastructure providers process data on our behalf: Supabase (database and authentication), Vercel (hosting), Stripe (payments), and Twilio SendGrid (email delivery). Each receives only what its job requires.

Email, specifically

• The consent box at the report gate is unchecked by default. Unchecked means no marketing email, ever.
• Every non-transactional email carries a one-click unsubscribe, honored immediately and permanently.
• We never buy lists, share addresses, or email people who didn’t give us their address.

How long we keep it

• Account data and practice history — kept while your account exists; deleted within 30 days of a deletion request.
• Analytics events — kept up to 24 months, then deleted or aggregated.
• Purchase records — kept as long as tax and payment rules require.
• The unsubscribe/suppression list — kept permanently; forgetting it would risk emailing someone who told us to stop.

Your privacy rights

Wherever you live, we honor the same set of rights: access a copy of your data, correct it, delete it, port it (machine-readable export), and object to or restrict processing. Send any of these through the contact form from the email on the account; we respond within 30 days, never charge for a request, and never treat you differently for making one. If your local law (for example the CCPA or GDPR) grants more, that law wins.

Children

This service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us data, tell us and we will delete it.

Your choices

• Everything free works without an account or email.
• To access, correct, or delete your data — including your account and practice history — use the contact form; we complete deletion requests within 30 days.
• Clearing your browser storage resets the anonymous device identifier.

Changes

Material changes to this policy are dated here and noted in the changelog. Questions about anything on this page: contact us.