Short version: we collect the minimum needed to run your account, we don't sell anything, and you can delete everything by emailing us.

1. What we collect

  • Account information — your name and email address, provided at sign-up or by your Google account if you use Google sign-in.
  • Training data — your answers, scores, streaks, bookmarks, and study activity. This is the product working as intended.
  • Cookies and measurement — a secure, HTTP-only cookie keeps you signed in. With your measurement choice, Google Analytics, Google Ads, and Microsoft Advertising UET may use cookies or similar identifiers to measure visits, advertising performance, sign-ups, and purchases. You can choose Essential only in the app or block or clear these through your browser settings.

2. How it's stored

Your data lives in a managed PostgreSQL database (Neon, hosted on AWS) with encryption in transit and at rest. Access is enforced at the database layer with row-level security — every request is cryptographically scoped to your account, so no other user can read your records. Passwords are hashed by our managed authentication provider and are never stored in plain text and never visible to us.

3. How we use it

  • To run the product: sync progress across your devices, compute your readiness score, personalise your training.
  • To respond when you contact support.
  • We do not sell or rent your personal information. Limited browsing and conversion data is processed by Google and Microsoft for analytics and advertising measurement as described above.

4. Third-party services

We rely on a small set of providers to operate and measure the service: Railway (hosting), Neon/AWS (database and authentication), Stripe (payments), Google (sign-in, Analytics, and Ads measurement), and Microsoft Advertising (UET measurement). If you use Google sign-in, we receive your name, email, and profile photo. Google and Microsoft may receive device, browsing, and conversion information under their own privacy terms when measurement is allowed.

5. Your rights

You can export your training data anytime from Settings. To correct or permanently delete your account and all associated data, email support@ncsoprep.ca — deletion is completed within 30 days. Canadian users are protected under PIPEDA; Alberta users under PIPA.

6. Changes

If this policy changes materially, we'll note it here with a new date and flag it in the app.