Privacy Policy

Scope

This policy applies to the CertFlashCards website, accounts, study features, support communications, and billing features. It does not govern websites reached through vendor learning links or the privacy practices of authentication and payment providers.

Information we collect

• Account information: name, email address, profile image if supplied, authentication provider, provider account identifier, role, registration time, and last sign-in time.
• Learning activity: selected exams, study sessions, answers, timestamps, progress, mastery, streaks, points, achievements, and preferences.
• Billing information: Stripe customer, subscription, invoice, payment status, refund, and entitlement identifiers. CertFlashCards does not store full card numbers or security codes.
• Technical, measurement, and support information: essential session cookies, security and diagnostic events, browser/device information available in server requests, and information you include in a support request. If you accept measurement, we also process page paths, signup and checkout events, a non-identifying Stripe invoice transaction identifier, the product price excluding tax, plan category, campaign parameters, and Google advertising click identifiers when present.

How we use information

We use information to authenticate users, save and personalize study progress, operate subscriptions, provide support, secure and troubleshoot the service, prevent abuse, understand aggregate product performance, comply with legal duties, and communicate material service or policy changes. We do not sell personal information or use it for third-party behavioral advertising.

How information is shared

We share only what is needed with service providers that operate the service, including Microsoft Azure for hosting, Google Analytics and Google Ads when you accept measurement, Google, Microsoft, or Meta when you choose that sign-in provider, GitHub for software delivery, and Stripe for billing. We may also disclose information to comply with law, protect users or the service, investigate fraud, or complete a business transfer subject to appropriate safeguards.

Cookies, browser storage, measurement, and external links

CertFlashCards uses essential cookies for authentication and security, local browser storage for your theme and privacy choices, and an attribution cookie only after you accept measurement. Google Tag Manager and connected Google measurement tags do not load when you select Necessary only. If you accept, Google may set analytics or advertising-measurement cookies and receive consent signals, page paths, campaign data, and the conversion events described above. We do not send Google names, email addresses, payment-card details, access tokens, or URL query strings, and the initial measurement configuration does not create remarketing audiences or enable personalized advertising. You can change your choice at any time using Privacy choices in the footer. Official vendor links open third-party pages whose terms and privacy policies apply separately.

Retention and deletion

We retain account and learning data while your account is active so your progress remains available. We may retain security logs for up to 90 days and financial, audit, dispute, and transaction records for the period required by law or legitimate accounting and fraud-prevention needs. You may request account deletion. We will delete or de-identify eligible information, while preserving records we must retain and data needed to establish or defend legal claims.

Your choices and rights

You may ask to access, correct, export, or delete your personal information, or object to or restrict certain processing where applicable. You may also appeal a denied privacy request by replying to the decision. We will verify requests before acting and respond within the period required by applicable law.

Security and location

We use access controls, encrypted connections, secret management, limited production access, and reviewed deployment practices. No service can guarantee absolute security. CertFlashCards is operated from the United States, and information may be processed in the United States and other locations used by our providers.

Children

The service is intended for people age 18 or older. We do not knowingly collect personal information from children under 13. Contact us if you believe a child provided personal information.

Contact

Email privacy questions or requests to support@certflashcards.com. Include the email address associated with your account and do not send passwords, payment-card details, or identity documents unless we specifically request a secure verification method.

See also our Terms of Service and support process.