Privacy policy

Information you give us. Your name and email address when you create an account or contact us; and any information you choose to include in a message to support or in an issue report. When you open an issue report, we capture the visible app screen and record the page, capture time, and screen size. You can review or remove the screenshot before sending; it is uploaded only when you send the report. Reports opened during a question also include that question and your answer context.

Information created by your use of the Service. Study activity — the questions served to you, the answers you selected, how long you spent on each, and your resulting scores. This is what produces your score, your pace, and your per-domain breakdown; without it the Service cannot do its job. Also onboarding answers such as whether you have booked an examination and approximately when.

Information collected automatically. Standard technical information such as IP address, browser type and version, device type, and pages visited, together with the date and time of access. We also collect error diagnostics and events such as viewing a question, revealing a hint, selecting and saving an answer, moving between questions, completing a session, or opening checkout. These events include question and session identifiers, interaction timing, navigation, and whether an action succeeded. These help us troubleshoot the Service and understand how its features are used. Signed-in product analytics is associated with your account identifier, name, and email address so we can recognize your account in PostHog. Error diagnostics use only your account identifier. Custom analytics events do not include question text, selected answers, or the messages you write in question reports.

Session replay. Once you sign up or sign in, PostHog can record the pages, clicks, scrolling, and visible content in that browser to help us understand and improve the Service. This includes visible study questions and feedback. Recording can continue on public pages, after signing out, and on later visits from that browser. First-time visitors who have not signed in are not recorded. Form input values are masked; console logs and network request and response bodies are not recorded.

Payment information. Payments are processed by Stripe, Inc. We do not collect, see, or store your payment card number. We store only a record of the purchase and the resulting access entitlement.

Advertising measurement. Unless you turn it off below, Google Ads receives technical information, advertising click identifiers, and events when you finish creating an account, complete your first Quick Practice, or make a purchase. Purchase events include the amount paid and currency. Events include pseudonymous identifiers to avoid counting the same milestone or purchase twice. We do not send Google your name, email, study answers, or exam results, and do not enable enhanced conversions or personalized advertising through this integration.

We use personal information to:

• create and administer your account and authenticate you;
• provide the Service, including scoring, progress, and readiness reporting;
• process payments and manage your access entitlement;
• respond to support requests and app or question issue reports;
• maintain, secure, troubleshoot, and improve the Service, including identifying questions that are wrong or unclear;
• send transactional messages such as receipts, access expiry notices, and important service notices;
• comply with legal obligations and enforce our terms.
• measure which Google ads lead to new accounts, unless you turn measurement off.

We rely on your consent, and on the performance of our contract with you, as the basis for these uses. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice — but withdrawing consent to the processing necessary to run the Service will mean we can no longer provide it.

We do not sell, rent, or trade your personal information. We do not share your study performance with employers, brokerages, regulators, or examination bodies.

We share information only with:

• Service providers who process information on our behalf and only on our instructions: Clerk (authentication), Convex (application database and backend), Stripe (payment processing), Vercel (hosting and content delivery), Sentry (error diagnostics), and PostHog (product analytics and session replay);
• Google, when advertising measurement is enabled, to associate completed signups with our ads. Google may process this information outside Canada. See how Google uses information from sites that use its services;
• Legal and safety recipients, where we are required by law, court order, or lawful request, or where disclosure is necessary to protect our rights, our users, or the public;
• A successor entity, in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy continuing to apply.

We use cookies and similar technologies that are necessary for the Service to function — in particular, to keep you signed in and to maintain your session securely. Google Ads measurement is enabled by default and uses cookies to connect an ad interaction to a completed signup. You can turn it off below. Turning it off has no effect on signing up, studying, or buying access.

Product analytics stores a browser identifier in local storage to connect visits and associate activity with your account when you sign in. Signing out resets that identifier, and you can remove it by clearing this site's browser data. We also store a marker that remembers whether this browser has signed in and is eligible for session replay. Signing out does not remove that marker; clearing this site's browser data does. We do not use analytics cookies.

Most browsers let you refuse or delete cookies. Blocking necessary cookies will prevent you from signing in.

Your opt-out is saved in this browser until you change it or clear browser storage. You can turn measurement off below; we remove Google's first-party advertising cookies and reload the page to stop the measurement library. Withdrawal does not delete events already sent to Google. The Google Ads click attribution window for this campaign is 30 days. A registration marker in the current browser tab is used for up to one hour, and a pseudonymous identifier saved in your browser prevents repeat reporting. Turning measurement off removes these markers too.

Our service providers may store and process information in Canada, the United States, and other countries. Information stored outside Canada may be accessible to courts, law enforcement, and national security authorities of that jurisdiction under its laws.

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain personal information only as long as necessary for the purposes described in this Policy, or as required by law. Study history is retained while your account is active so that your progress remains available to you. Records required for tax and accounting purposes are retained for the period required by law. When information is no longer needed we delete it or render it anonymous.

Subject to applicable law, you may:

• request access to the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete your account and associated personal information;
• withdraw consent to our processing, subject to section 2;
• ask a question or make a complaint about how we handle your information.

Contact onyxexamprep@gmail.com and we will respond within the time required by applicable law, normally within 30 days. Deleting your account permanently removes your study history and cannot be undone.

If you are not satisfied with our response you may contact the Office of the Privacy Commissioner of Canada, or the privacy regulator in your province.

The Service is intended for adults preparing for professional licensing examinations and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.

We may update this Policy from time to time. If a change is material we will update the date at the top of this page and, where reasonable, give additional notice. We encourage you to review this page periodically.

Questions, access requests, and privacy complaints can be directed to our privacy contact at onyxexamprep@gmail.com.