Privacy Policy

Effective date: June 20, 2026 · Last updated: October 28, 2026

XP Certs ("we," "our," or "us") runs xpcerts.com and the XP Certs apps for iOS and Android, which help you prepare for IT certification exams. This policy explains what we collect, why, who we share it with, and the choices you have.

1. Information We Collect

Account information. Your name, email address and a hashed password. If you sign in with Google, GitHub, Microsoft or Apple, we receive your name and email from that provider instead of a password. We record whether you have confirmed your email address.

Study data. The certification you are studying for, your exam date and weekly study goal, your diagnostic results, practice answers and time taken, mastery per exam objective, XP, level, rank, badges, streaks, and the state of in-app activities such as daily shifts, weekly incidents, breach events and acronym drills.

Usage and diagnostics. When you sign in, start or finish practice, view the subscription screen, report a question or turn on reminders, we record that event with a timestamp and basic details (for example the practice mode or which question you reported). If the app crashes, we record the error message and technical details of where it happened. On the website we record which pages are visited.

Payment information. Subscriptions on xpcerts.com are handled by Stripe and in the apps by Apple or Google. We never see or store your full card number. We receive your subscription status, plan and renewal dates.

Issue reports. If you report a problem or a question, we receive what you write, your name and email, the certification you are studying, and any screenshot you choose to attach.

Technical data. Our servers log IP addresses, browser or device type, and request times for security and to keep the service running. These logs are kept for up to 90 days.

On your device. The apps store your sign-in token, a copy of your progress and your settings (such as reminder time and reduced motion) on your device so the app works quickly and offline. Study reminders are scheduled locally on your device; we do not collect a push notification token.

2. How We Use Your Information

• To create and run your account and keep you signed in
• To build your roadmap, readiness score and daily practice, and to sync your progress across devices
• To process payments and manage your subscription
• To send account emails: email confirmation, password resets and billing receipts
• To fix bugs, improve questions and explanations, and understand which features help people learn
• To detect and prevent fraud, abuse and security problems
• To comply with legal obligations

We do not sell your personal data, share it for cross-context advertising, or show you third-party ads. We do not send marketing emails without your consent.

3. Who We Share It With

We share data only with service providers that help us run XP Certs, and only what each one needs:

• Render — hosts our application server and its logs
• Supabase — hosts our database (account, study and subscription data)
• Google Firebase — hosts the xpcerts.com website
• Stripe — payments and subscriptions on xpcerts.com
• Apple and Google — payments for subscriptions bought in the apps, and sign-in if you choose it
• RevenueCat — verifies App Store and Google Play subscriptions; it receives your account ID and purchase records, not your name or card details
• Resend — delivers account emails
• EmailJS — delivers the issue reports you send us
• GitHub and Microsoft — sign-in, only if you choose it
• OpenAI — may be used to help draft practice questions; no personal data about you is sent

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business (in which case this policy will continue to apply to your data).

4. How Long We Keep It

• Account and study data: while your account exists. When you delete your account, your profile, progress, practice history and settings are deleted from our database right away.
• Usage events and page views: up to 24 months, then deleted automatically. When you delete your account, any events still held are no longer linked to it.
• Server logs: up to 90 days.
• Billing records: kept as long as tax and accounting law requires, typically up to 7 years.
• Issue reports: kept in our support inbox for as long as needed to resolve them, and no longer than 24 months.
• Backups: deleted data can remain in encrypted database backups for a short period until those backups expire.

5. Cookies and Local Storage

We do not use advertising cookies or third-party tracking pixels. The website uses:

• A visitor ID cookie (examprep_vid) — a random identifier that lets us count visits and understand how the site is used. It lasts one year and is not shared with anyone.
• A sign-in session cookie — only while you sign in with Google, GitHub, Microsoft or Apple, to complete that sign-in securely.
• Browser storage — your sign-in token, a copy of your progress and your settings, kept in your browser so you stay signed in.

6. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete or download your data, and to object to or restrict how we use it. You can:

• Delete your account at any time in the app or on xpcerts.com (Settings, then Delete Account). See how to delete your account.
• Change your certification, exam date and reminders in Settings.
• Email support@xpcerts.com for any other request. We respond within 30 days.

If you are in the EEA or UK: we process your data to provide the service you signed up for (contract), to keep it secure and improve it (legitimate interests), and where the law requires (legal obligation). You can complain to your local data protection authority.

If you are in California: we do not sell or share your personal information as those terms are defined under California law, and we will not discriminate against you for exercising your privacy rights.

7. Security

We protect your data with hashed passwords (bcrypt), encrypted connections (HTTPS), signed sign-in tokens that can be revoked ("Sign out of all devices"), rate limits on sign-in, and access controls on our systems. No system is perfectly secure; if you think your account has been compromised, change your password and contact us straight away.

8. International Transfers

XP Certs and our service providers are based in, or store data in, the United States. If you use XP Certs from elsewhere, your data is transferred to and processed in the United States, with safeguards such as standard contractual clauses where the law requires them.

9. Children

XP Certs is not directed at children under 13 (or the higher minimum age where you live), and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to This Policy

We may update this policy as the service changes. For material changes we will update the date above and tell you in the app or by email before they take effect.

11. Contact Us

• Email: support@xpcerts.com
• Website: xpcerts.com