Privacy Policy

Public pages — exam guides, prep courses, lessons, glossaries — are served as static files. Visiting them creates no account, sets no tracking cookie and sends nothing about you to a third party.

These are stored in your own browser:

• pg-theme — whether you chose light or dark, so the site does not flash the wrong theme on your next visit. Never sent to us.
• pg-nav — a display-only hint (your name, email and access tier) so a returning signed-in visitor sees their own avatar in the nav on the first paint rather than a Login button. It is never consulted to decide what you are allowed to access; every access check happens on the server against the database.
• pg-sid — this one is worth reading carefully, because it is the only identifier we set that links your activity together. If you answer a practice question without being signed in, we set a signed, randomly generated identifier that lasts a year, so that your streak and progress survive a page reload and can be carried over if you later create an account. It contains no name, email or device information and is not readable by JavaScript, but it is a persistent identifier and it does reach our server with the activity recorded against it. Clearing your cookies removes it.

Your browser also requests the site’s three typefaces from Google Fonts, which receives your IP address as part of that request, as it would for any site using the same service. Nothing else on the page contacts a third party.

An account exists so your progress survives closing the tab. Creating one means we store, in a Supabase-hosted Postgres database:

• Your email address, and a securely hashed password — handled by Supabase Auth. We never see or store your password in a readable form.
• Study progress — which lessons you have read, and a per-concept mastery estimate used to schedule reviews.
• Answer history — the questions you attempted, what you chose, whether it was right, and the mistakes you asked to keep in your mistake journal.
• Mock exam attempts — your answers and score for each full-length attempt, so a results page can be shown again later.
• Your exam target, if you set a date.
• Purchases — which certification or bundle you are entitled to, when it was granted, and the order it came from.
• Activity and rate-limit events — a timestamped log of significant actions, used to show your streak and to stop automated abuse of the question and tutor endpoints.

We do not ask for, and have no field to store, your real name, date of birth, address, phone number, employer or any government identifier.

If you have access to the AI tutor and ask it a question, that request is sent to Anthropic to generate the explanation. What is sent is the question you were working on, its answer options and explanation, the option you selected, and the question you typed. Your email address and account identifier are not sent.

We store a per-day count of your tutor requests so the daily limit can be enforced. We do not store the conversation itself.

When paid access launches it will be processed by a third-party payment provider. Card details will be entered on the provider’s own systems and are never transmitted to or stored by passgenai — we receive only the confirmation that an order succeeded and the identifier we record against your entitlement.

These are the only third parties involved, and each is here because the site cannot function without it:

• Supabase — hosts the database and handles authentication. All account data described above lives here.
• Anthropic — generates AI tutor explanations, and only when you ask for one.
• Google Fonts — serves the site’s typefaces to your browser.
• Our hosting provider — serves the pages and keeps short-lived operational request logs.

We do not sell your data, share it for advertising, or send it to any analytics or marketing service. There is no such service integrated into this site.

Account data is kept while your account exists. If you ask us to delete your account, we delete your progress, answer history, mock attempts and mistake journal, and we sever the link between your account and any anonymous identifier it absorbed.

There is one honest exception we would rather state than gloss over. Significant actions — the ones that decide whether an answer was graded correctly and whether you were entitled to see something — are written to an append-only activity log, which the database physically prevents anyone from editing or deleting, including us. That is a deliberate integrity guarantee: it is what makes a scoring or entitlement dispute resolvable, and a log that could be quietly rewritten would be worth nothing. Those rows hold timestamps and event types rather than anything you wrote, and after a deletion request they are no longer linked to your identity through any other table. But they are not erased, and we will not claim otherwise.

Records of a purchase are the other exception: we retain the minimum needed to evidence a transaction and meet tax and accounting obligations, even after an account is deleted.

• Get a machine-readable copy of what we hold about you, including your full activity history.
• Correct anything that is wrong.
• Delete your account and its study data, subject to the append-only log described above.
• Withdraw consent by closing your account — the whole free corpus remains readable without one.

The first and third of these are built into the site rather than being a promise to act on an email: signed in, you can export your data and request deletion directly. If you would rather ask a person, or you can no longer sign in, email support@passgenai.com from the address on the account and we will act on it within 30 days. You can clear the browser keys described above yourself at any time by clearing site data.

Access to your data is enforced server-side. Correct answers and the question bank are never sent to the browser for content you have not unlocked, and every entitlement check runs on the server against the database rather than in client code.

No system is perfectly secure. If you believe you have found a vulnerability, email support@passgenai.com and please give us a reasonable chance to fix it before disclosing it publicly.

These are professional certification exams and the site is not directed at children. You must be at least 16 to hold an account, and we do not knowingly hold data about anyone younger. If you believe we have, email us and we will delete it.

If this policy changes materially we will update the revision date above. The data controller is the operator of passgenai; the operating legal entity is being formalised and this page will name it once that is complete.

Questions about this policy, or a request about your data, go to support@passgenai.com. See also our Terms of Use and Disclaimer.