Privacy Policy

1. What we collect

• Account info: email, display name, hashed password.
• Study data:certs you're tracking, topic progress, practice scores, flashcard status, notes.
• Billing info: Stripe handles card numbers; we only store your Stripe customer ID, subscription status, and price ID.
• Operational data: server logs (IP, user agent, request timestamps) for debugging and abuse prevention.

2. How we use it

We use your data to run the Service, keep your account secure, process payments, send transactional email (verification codes, password resets, subscription receipts), and improve the product. We do not sell your data.

3. Third parties

We use these sub-processors to operate:

• Stripe (payments)
• Resend (transactional email)
• Our hosting provider (server infrastructure)

Each is contractually bound to process data only on our behalf.

4. Your rights

You can view and edit most of your data from the profile page. For deletion, or if you're covered by GDPR/CCPA and want to exercise a right (access, portability, erasure), email us via the support portal. We'll respond within 30 days.

5. Cookies

We use a single first-party cookie to keep you signed in (NextAuth session). We don't use third-party advertising or cross-site tracking cookies.

6. Retention

We keep account data until you delete your account. Billing records are kept as long as required by law (generally 7 years). Server logs are rotated after 30 days.

7. Contact

Questions? Submit a ticket via the support portal.