Effective Date: March 10, 2026  |  Last Updated: March 10, 2026

CertStack ("we," "us," or "our") operates the CertStack mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Display name (if provided)
• Authentication credentials (managed securely via Firebase Authentication)

1.2 Usage Data

We automatically collect information about how you interact with the App:

• Study progress, quiz scores, and practice exam results
• Spaced repetition scheduling data (question review intervals and performance)
• Certification selections and study preferences
• Feature usage patterns and session duration
• AI chat interactions (questions asked to the study assistant)

1.3 Device Information

• Device type, operating system, and version
• Unique device identifiers
• App version and build number
• Crash reports and performance data (via Firebase Crashlytics)

1.4 Subscription Information

Payment processing is handled entirely by Google Play and RevenueCat. We do not collect or store credit card numbers, bank account details, or other direct payment information. We receive subscription status, purchase tokens, and transaction identifiers to manage your access.

2. How We Use Your Information

We use the collected information to:

• Provide and maintain the App's study features, including spaced repetition scheduling
• Personalize your study experience across CompTIA Security+, PenTest+, and CySA+ certifications
• Power the AI-assisted study chat with certification-aware context
• Process and manage your subscription
• Track your study progress and generate performance analytics
• Improve App functionality, fix bugs, and optimize performance
• Send important service notifications (e.g., subscription status changes)
• Comply with legal obligations

3. Data Storage and Security

Your data is stored securely using Google Firebase (Cloud Firestore) infrastructure, which provides:

• Encryption in transit (TLS) and at rest
• Firestore Security Rules enforcing per-user data isolation
• SOC 2 and ISO 27001 compliant infrastructure

While we implement commercially reasonable security measures, no method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.

4. Third-Party Services

The App integrates with the following third-party services, each with their own privacy policies:

• Google Firebase (Authentication, Firestore, Crashlytics, Analytics) — Firebase Privacy Policy
• RevenueCat (Subscription management) — RevenueCat Privacy Policy
• Anthropic Claude API (AI chat assistant) — Anthropic Privacy Policy
• Google Play Services (App distribution and payments) — Google Privacy Policy

AI chat messages are processed by Anthropic's Claude API to generate study assistance responses. We do not use your chat content to train AI models. Anthropic's data retention policies apply to API interactions.

5. Data Sharing

We do not sell your personal information. We may share data only in these circumstances:

• Service Providers: With third-party services listed above, solely to operate the App
• Legal Requirements: If required by law, regulation, or valid legal process
• Safety: To protect the rights, property, or safety of our users or the public
• Business Transfer: In connection with a merger, acquisition, or sale of assets (with prior notice)

6. Your Rights and Choices

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information via your account settings
• Deletion: Request deletion of your account and associated data by contacting us
• Export: Request an export of your study data
• Opt-out: Disable analytics collection in the App settings

To exercise these rights, contact us at privacy@certstack.app.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Upon account deletion request:

• Personal data is deleted within 30 days
• Anonymized, aggregated analytics data may be retained indefinitely
• Data required by law may be retained for the legally mandated period

8. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child under 13 has provided us data, please contact us at privacy@certstack.app.

9. International Data Transfers

Your data may be processed and stored in the United States via Google Cloud infrastructure. By using the App, you consent to the transfer of your data to the United States, where data protection laws may differ from those in your jurisdiction.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the App or sending an email. Your continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, contact us at:

CertStack
Email: privacy@certstack.app
Website: certstack.app