Privacy Policy

Effective October 1, 2026. Contact: [email protected].

QuizCram (“we”) provides practice quizzes for US license, certification, and professional exams. This policy explains what we collect, why, who processes it, and the choices you have. By creating an account or using QuizCram, you agree to this policy.

What we collect

Account data. Your email address and, if you set one, an encrypted password record, managed by our authentication provider (Supabase Auth). We use this to sign you in and to tie your progress and purchases to your account. When you buy an exam without an existing account, we create one from the email you used at checkout; you can sign in with an emailed login link until you choose a password.

Quiz activity. The questions you answer, the options you pick, and whether each answer was correct, with timestamps. We use this for mistake review, progress tracking, and improving our question banks. Anonymous practice (no account) stays on your device and is never sent to us.

Purchase records. Which exam(s) you unlocked and when. Payments themselves are processed by Lemon Squeezy — we never see or store your card number, expiry, or CVC.

Checkout and waitlist emails. When you start an unlock, we ask for your email before sending you to checkout and store it with the exam you chose, even if you do not complete the purchase — so we can send your access link and follow up about that exam. If you join a coming-soon waitlist, we store your email and the exam so we can notify you when it launches.

Promotional email. We may send study tips, new-exam announcements and offers to any email we hold — account holders, checkout emails and waitlist signups alike. Every such email carries an unsubscribe link, and you can opt out at any time at quizcram.com/unsubscribe; we honour it immediately. Sign-in links, receipts and account notices are not promotional and continue after you opt out. We never share your email with anyone else for their marketing.

Usage analytics. We use Google Analytics 4 to understand which pages and exams people use, in aggregate. Google receives a pseudonymous identifier, device and browser type, coarse location derived from IP, and the pages you view; we do not send your email, name, or quiz answers. See Google’s privacy policy at policies.google.com/privacy; you can opt out with the Google Analytics browser add-on. We also use Microsoft Clarity to see, in aggregate, how pages are used (clicks, scrolling and anonymized session replays); Clarity masks what you type and we do not send it your email, name, or quiz answers. See Microsoft’s privacy statement at privacy.microsoft.com.

Affiliate links. If you arrive through an affiliate link (a link with ?aff=), we keep the referrer’s code in your browser for 30 days and load Lemon Squeezy’s affiliate script, which stores an anonymous identifier so the referrer can be credited if you buy. Visitors who did not arrive through such a link get neither.

Technical data. Standard server logs (pages requested, timestamps, coarse device info) used for security, abuse prevention, and reliability.

What we do not collect

No payment card details, no government ID numbers, no precise location, and no sale of personal data to anyone — ever. Analytics is aggregate usage measurement, not a profile of you.

Who processes your data

Supabase (database + authentication; stores account, progress, entitlement, checkout-email, and waitlist rows, restricted by row-level security so users can only read their own rows). Lemon Squeezy (one-time checkout as merchant of record; receives the email you enter and your payment details). Brevo (delivers our sign-in, account and promotional emails). Google (Google Analytics, as described above). Microsoft (Clarity, as described above). Netlify (hosting + server logs). Each processes data only to provide its part of the service.

Cookies

Strictly necessary: Supabase auth cookies that keep you signed in. Analytics: Google Analytics cookies (_ga, _ga_*) and Microsoft Clarity cookies (_clck, _clsk) that distinguish visitors and sessions for aggregate usage statistics; blocking them in your browser does not affect the service. Advertising: free study guides may in future carry ads served by Google AdSense, which sets its own cookies; quizzes, results, checkout, and account pages never show ads. We do not use cookies for cross-site tracking of our own.

How long we keep data

Account, progress, and entitlement data is kept while your account exists so your history and purchases persist. Checkout emails that never turned into a purchase are deleted within 90 days; waitlist emails are kept until the exam launches plus 30 days, or until you ask us to delete them. Unsubscribe records are kept indefinitely so we never email an opted-out address again. Google Analytics data is retained for 14 months. Server logs rotate within 90 days.

Your choices

You can sign out anytime from your account page, and stop promotional email at /unsubscribe. To export or permanently delete your account data (email, attempts, entitlements, checkout and waitlist entries), email [email protected] from your account address with the subject “Data request” — we respond within 30 days. Deleting your account also removes access to paid content tied to it, so download anything you need first. Deletion requests cannot remove records we must retain for fraud prevention or legal compliance.

Children

QuizCram is a general study aid not directed at children under 13, and we do not knowingly collect data from them. Teen driver-education users under 18 should have a parent or guardian create the account.

Security

Traffic is encrypted in transit (HTTPS), passwords are hashed by our auth provider and never stored in readable form, and database access is gated by per-user row-level security. No system is perfectly secure; if we discover a breach affecting your data, we will notify you promptly.

Changes

We will post material changes here with a new effective date and, for significant changes, notify account holders by email before they take effect.