Skip to content

Privacy policy

Effective October 17, 2026

What this covers

This policy explains what PassCited collects on passcited.com, why, who helps us process it, and the choices you have. Questions or requests: hello@passcited.com. We don't sell or share personal data for advertising.

What we collect

We collect your email when you request diagnostic results, sign in, or purchase. We store your answers to calculate your scores and weak areas. We store the exam date you give us to size your study plan, and we may ask afterward whether you passed. Answering is optional. We report results only in aggregate, and only once at least 30 people have reported for an exam. When you buy, we store the order (plan, amount, date, any discount or referral, the version of our terms shown at checkout, and the Stripe reference). Stripe collects your card details and billing address directly; we never see or store your full card number.

If you leave a review, we publish your rating and words only if you tick the consent box, signed the way you choose (first name and last initial, or anonymous), and we remove them on request. Reviews from people who used a free study-group pass are kept private and never published. If you ask for a group discount code on our partners page, we store the details you give (group, name, email, role and message) and email them to our support inbox so we can reply; we use them only for that request. If you use the help assistant, we store your questions and its answers, with the page you asked from, but not your email or IP address.

How we use it

We use your email to deliver results, sign-in links, receipts, and the study reminders you turn on. We send study tips or offers only if you opt in, and you can unsubscribe anytime. We use your answers to build your scores, study plan and review schedule. To count visits and see which pages and links lead people to the diagnostic, sign-up and purchase, your browser keeps a random visitor ID in local storage, and our own server records those steps with the referring site and any campaign tags. We use no third-party trackers or ad pixels and don't record IP addresses for this. Steps taken while signed in are stored with a scrambled (hashed) form of your email, not the address.

Service providers

These companies process data for us, only to run the parts of PassCited listed here:

  • Stripe: payments, receipts, sales tax and refunds. Gets your email, card and billing details.
  • Supabase: our database host. Stores your account, answers, orders and the other records described here.
  • Vercel: hosts the website and runs our server code. Processes your IP address and browser details to serve pages, and keeps short-lived request logs.
  • Vercel Blob: stores and delivers lesson videos, captions and images, and our encrypted database backups.
  • Resend: sends our emails. Gets your email address and the message.
  • Google: only if you choose “Continue with Google”. Google tells us your email address; we don't get your contacts or other Google data.
  • Anthropic: AI models behind the help assistant and the AI tutor. The help assistant sends the text you type and the page you're on. The tutor sends the question and the answer you picked, never your email or account details.
  • Microsoft Azure: text-to-speech for lesson narration. Gets our lesson scripts only, no personal data.

Cookies and local storage

We use only first-party cookies, set by passcited.com, and no advertising or third-party tracking cookies:

  • pc_sid: a random session ID that keeps your diagnostic and practice progress together. Lasts 1 year.
  • pc_user: keeps you signed in (signed, not readable by page scripts). Lasts 1 year or until you sign out.
  • pc_in: a plain marker so the menu shows “My account” when you're signed in. Lasts as long as pc_user.
  • pc_g: protects Google sign-in from forgery. Lasts 10 minutes.
  • pc_ref: remembers the chapter or group partner link you arrived from, so its discount applies at checkout. Lasts 30 days.
  • pc_rr: remembers a friend's referral link, so the friend discount applies and the friend gets credit. Lasts 30 days.

Your browser's local storage also keeps a random visitor ID (pc_vid) and visit ID (pc_sess) for the visit counts above, and small settings such as lesson playback speed, the tab you last used, practice mode and whether you dismissed the install prompt. Clearing your browser's site data removes all of these. Blocking cookies will sign you out and stop partner and referral discounts from applying automatically.

Do Not Track

We don't track you across other websites and don't let others do so on ours, so we treat every visit the same whether or not your browser sends a Do Not Track signal. Our own visit counts described above run either way.

Download or delete your data

Signed in, your account page has two buttons. Download my data gives you a file with everything we store that is linked to your email address or your browser session: your account, answers, diagnostics, mock exams, study settings, emails we sent you, and orders. Delete my account emails a confirmation link to your address, which works for one hour. Once you confirm, we delete your account, answers, diagnostics, mock exams, review schedule, email history, subscriptions, exam outcomes and reviews. We keep records of payments and refunds, such as the amount, date, plan and Stripe reference, with your email address replaced by a random placeholder, because tax and accounting rules require us to keep them. Stripe keeps its own payment records under its legal obligations. Deleting your account ends any active pass, so if you bought one in the last 7 days, request your refund first. You can also email hello@passcited.com and we will do either for you, or correct anything we hold about you.

How long we keep data

Account data stays until you delete your account. Visit and funnel records are deleted, or stripped of their random IDs, after 12 months. Questions you ask the help assistant are deleted after 90 days. Security and error logs are deleted after 90 days. Sign-in links expire after use and are deleted within 7 days. Encrypted backups are deleted after 90 days. Payment records are kept as long as the law requires.

Security

The site is served only over HTTPS. Passwords don't exist here: you sign in with a one-time email link or Google. To limit abuse we rate-limit requests using a scrambled (hashed) form of your IP address, never the address itself, and we remove email addresses and tokens from our server logs. If a data breach ever affects your personal data, we will tell you by email without undue delay, and within 72 hours of confirming it where the law requires.

Children

PassCited is for adults preparing for professional exams. It isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has given us data, email us and we'll delete it.

Changes to this policy

If we change this policy, we post the new version here with a new effective date. If a change affects how we use data you've already given us in a significant way, we'll email you before it takes effect.