Privacy Policy

Last updated: 2026-04-29

DRAFT. Review by counsel required before public launch. Should reflect actual data flows, sub-processors, and retention windows.

What we collect

Account data: email, display name, hashed password.
Settings: theme, default quiz length, timezone.
Study data: quiz attempts, flashcard ratings (SM-2 state), study streaks, enrolled states.
Session data: a signed cookie identifying your active session.

How we use it

To run the service: authenticate you, scope your study content to the right state, track your progress, generate your study plan, and (for paid plans) bill your subscription.

Sharing

We do not sell your data. We share the minimum necessary with sub-processors that run the platform (e.g. our payment processor for subscriptions, our email provider for transactional messages). A current list of sub-processors is available on request.

Your rights

You can download a JSON export of all your data at Settings → Account → Export, and you can permanently delete your account at Settings → Profile → Delete Account. EU/UK residents have additional rights under GDPR — contact us to exercise them.

Retention

We keep your data for as long as your account is active. After deletion the row-level data is removed immediately; backups are rotated within 7 days.

Cookies

We set a single first-party session cookie (HttpOnly, SameSite=Lax, Secure on HTTPS). We do not use third-party advertising cookies. See Cookie Policy for details.

Contact

Privacy questions: privacy@realtorsacademy.org.