YOUR DATA, CLEARLY EXPLAINED

Privacy policy

Effective September 19, 2026.

Information used to provide the service

We use your email to send sign-in links and purchase messages and to look up purchased access in Stripe. Stripe processes payment details on its hosted checkout; CodeReady does not receive full payment-card numbers. Stripe stores customers, payments, and subscriptions. Resend processes email addresses and transactional email content for delivery.

Account data

For password and Google accounts, we store your email, a salted password hash (not your password), account creation and email verification dates, and your Google subject ID if connected, in Redis. We do not store Google access or refresh tokens. Purchased access is still checked with Stripe. Request account-data deletion at admin@codereadyprep.com.

Optional daily questions and analytics

If you subscribe to daily questions, Resend stores your email as a contact and delivers study emails. Visit /unsubscribe to opt out at any time. We retain the opt-out preference to avoid sending further daily emails; essential sign-in and purchase messages are separate.

When enabled by the operator, Vercel Web Analytics measures site usage without advertising cookies. It provides aggregate page-view and visitor statistics to help improve the site.

Sign-in and essential cookies

A signed, httpOnly session cookie stores your email and access rights for up to seven days. It is sent only over HTTPS in production and is used for authentication, not advertising. Sign-in links contain signed tokens that expire after 15 minutes. Treat them as private; do not share them. Without a server-side token database, a link can be reused during its validity period.

Google sign-in uses an essential cookie for up to 10 minutes. A checkout-email hint may be stored in a signed cookie for one hour to prefill account setup; it does not grant access. Short-lived, hashed email and IP counters in Redis limit account attempts and email sends.

Study progress

When progress sync is enabled, CodeReady stores practice answer history (question IDs, exam, topic, correctness, and timestamps), completed practice-test scores and IDs, and flashcard self-assessments in Upstash Redis. Weak-area statistics are calculated from your answers. Progress is tied to your account email using a lowercase-email SHA-256 key, with update timestamps and revision numbers. This key is pseudonymous, not anonymous. Signing in with the same email restores progress on other devices.

A localStorage backup remains in your browser, partitioned by email. Unfinished practice-test answers and deadlines stay on that device and are not synced. If sync is unavailable, study continues locally. Anyone with access to your browser profile may read that data. Logout removes the session cookie but leaves local study data for your next visit.

Export/import is available on your workbench. “Delete my progress” removes stored answer history, scores, and flashcard assessments from the server and this browser, including unfinished tests here. A minimal revision marker is retained under the email-derived key to stop stale devices from uploading deleted history; other devices clear stale synced history when they reconnect. Browser site-data controls remove local data. Progress is retained until you delete it or request account-data deletion through support; purchased access and billing records are unaffected.

Retake-access extension requests

If you request the monthly-subscriber extension, support uses your purchase email, exam name, date, and redacted evidence of the attempt to assess eligibility. Send no identification numbers. Access-grant dates are stored in Stripe customer metadata; exam documents are not needed in that metadata. Support correspondence is used only to handle your request and required business records.

Infrastructure and logs

Vercel hosts the application and may process IP addresses, request metadata, and operational logs. Stripe and Resend keep their own service records under their policies. Authentication links can contain credentials in the URL; we use no-referrer headers on verification responses and do not intentionally log tokens or email contents in application logs. Provider log handling is configured by the operator.

Use, sharing, and retention

We use information to provide access, process transactions, operate the service, prevent abuse, and answer support requests. We do not sell personal information or use advertising trackers in this version. Data is shared with the service providers needed to perform these functions and where legally required. Payment records may need to be retained for tax, accounting, fraud prevention, or legal obligations.

Your choices

You can stop using the service, cancel a subscription from your workbench, remove local site data, or contact us about access, correction, or deletion requests. We may need to verify your request and retain records required by law. Transactional email is used for sign-in and purchases, not a marketing subscription.

Children and international processing

The service is intended for adults preparing for professional exams, not children under 13. Our providers may process data outside your country. Contact support if you believe a child has provided personal information or have questions about your applicable privacy rights.

Contact

Email admin@codereadyprep.com for privacy requests. This policy may be updated as the service changes; the effective date will be revised.