Privacy Policy

1. Information We Collect

Account information: Name and email address when you register.

Email capture: If you submit your email address through a form on our site (for example, to receive free practice questions), we store your email and may send you a welcome email and periodic study tips. You can unsubscribe from marketing emails at any time using the link in each email.

Study activity: Your flashcard progress (known/review later status), mini exam results, full exam results, and study streaks. We use this to power your dashboard and metrics.

Payment information: Subscription and payment data is processed by Stripe. We receive a Stripe customer ID and subscription status but never see or store your card number, CVV, or bank details.

Device information: A randomly generated device identifier stored in your browser (used solely to enforce the Lifetime plan single-device restriction).

Usage and analytics data: We use Google Analytics 4 to understand how visitors use our site. This includes pages visited, time on page, browser type, device type, and approximate location. Google Analytics assigns a randomly generated client identifier (stored in a cookie) to distinguish visitors. We may associate this identifier with your account to measure conversions (for example, to understand whether an ad click led to a signup or purchase). Google processes this data under its own privacy policy at policies.google.com/privacy.

Marketing attribution: When you arrive at our site from an advertisement or marketing link, we capture referral parameters (such as UTM tags and Google click identifiers) to measure the effectiveness of our advertising. This data is stored with your account if you sign up and is shared with Google Analytics for conversion measurement.

2. How We Use Your Information

• To provide and improve the Service
• To authenticate your account and enforce subscription access
• To display your study progress and metrics
• To process payments and manage your subscription via Stripe
• To send transactional emails (account creation, password reset) and marketing emails (study tips, promotions) that you can unsubscribe from
• To measure the effectiveness of our advertising through analytics and conversion tracking
• To respond to support requests

3. Information Sharing

We do not sell, rent, or share your personal information with third parties for their own marketing purposes. We share data only with:

• Google Analytics - website analytics and conversion measurement
• Stripe - payment processing
• Neon.tech - database hosting (PostgreSQL)
• Vercel - application hosting
• Resend - transactional and marketing email delivery
• Cloudflare - security and bot protection

Each of these providers processes data under their own privacy policies and applicable data protection agreements.

4. Cookies and Local Storage

Essential cookies: We use cookies for session management (keeping you logged in via NextAuth) and browser localStorage for your device identifier (Lifetime plan restriction).

Analytics cookies: We use Google Analytics, which sets cookies (including the _ga cookie) to distinguish visitors and measure site usage. These cookies are set only after you accept analytics via our cookie consent banner.

Attribution cookies: When you arrive from an advertisement, we store referral information (UTM parameters, Google click identifier) in a cookie for up to 90 days to measure advertising effectiveness.

Your choice: When you first visit, analytics and advertising cookies are blocked by default. You can accept or decline them via the banner at the bottom of the page. Declining does not affect the functionality of the Service. You can also clear cookies at any time through your browser settings.

5. Data Retention

We retain your account and study data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law (e.g., billing records).

6. Your Rights

Depending on your location, you may have rights under GDPR, CCPA, or other privacy laws, including the right to access, correct, export, or delete your personal data. To exercise these rights, email SHRMpracticesupport@gmail.com.

7. Security

We use industry-standard practices including bcrypt password hashing, HTTPS encryption, and Stripe's PCI-compliant payment infrastructure. No security system is perfect; we encourage you to use a strong, unique password.

8. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal information from minors.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by updating the "Last updated" date above. Continued use of the Service after changes constitutes acceptance.

10. Contact

Privacy questions? Email SHRMpracticesupport@gmail.com.