This Privacy Policy describes how Passd (“Passd,” “we,” “us,” or “our”) collects, uses, and discloses information about you when you use passd.io (the “Service”). By using the Service, you agree to the practices described below.
1. Information We Collect
Information you provide
- Account information: email address (used for magic-link authentication).
- Profile information: your declared state, exam date, exam history (first attempt or retake), and weekly study hours. Provided during onboarding and editable from your account.
- Practice data: your answers to practice questions, session scores, Passd Score history, topic performance breakdown, and time spent per question and session.
- Feedback and flags: any reports, flags, or feedback you submit about questions or the Service.
- Payment information: processed by Stripe. We do not store your credit card number, bank account, or full payment details on our servers. We store your Stripe customer ID and subscription status.
Information collected automatically
- Usage data: pages visited, features used, session duration, and interaction patterns.
- Device and browser: IP address, browser type, operating system, device type, and screen resolution.
- Cookies: we use a small number of first-party cookies for authentication and basic functionality.
passd-themestores your dark/light mode preference.passd_refstores a referral code (set when you click a/r/<code>link, persists 30 days) so we can credit a referrer if you subscribe. Supabase uses session cookies for authentication. We do not use advertising cookies or third-party tracking pixels.
2. Analytics & Session Replay
We use PostHog as our product-analytics processor. PostHog Cloud (US region) hosts the events; we do not use the EU region. PostHog acts as a data processor under our agreement and does not have rights to use your information for its own purposes.
Session replay is enabled by default with full masking.Every form input, every text node, and every image is masked at the recording layer before any bytes leave your browser — PostHog’s “Total privacy” mode. Free-form input is masked permanently, no exceptions. The replay shows page structure and click positions, not the words you type or the values you enter.
We bound this cost with a self-imposed monthly cap. If we reach 100% of the cap, analytics ingestion is paused automatically until the next billing cycle — no events are recorded during that window.
Opt out at any time. Visit passd.io/settings/privacy and click Delete my analytics data. We pass the request to PostHog within seconds; PostHog completes the deletion asynchronously, typically within 30 days. Your account, payments, study sessions, and Passd Score are not affected by an analytics deletion — that’s a separate flow.
3. How We Use Your Information
- Provide the Service: authenticate you, deliver practice questions matched to your state, calculate your Passd Score, track your progress, and assign the Readiness Score (displayed as “Passd Ready” status when earned).
- Improve the Service: analyze aggregate usage patterns to improve question quality, identify weak content areas, and prioritize features.
- Communicate: send transactional emails (login links, subscription confirmations, payment receipts). We do not send marketing emails unless you opt in.
- Billing: process payments and manage subscriptions via Stripe.
- Security: detect and prevent fraud, abuse, and unauthorized access.
4. How We Share Your Information
We do not sell your personal information. We share information only in these circumstances:
- Subprocessors: we use third-party providers to operate the Service — categories include payment processing, database and authentication, hosting and delivery, AI model inference, text-to-speech synthesis, voice synthesis and speech-to-speech Voice Tutor sessions, transactional email, background job execution, and rate limiting. Each subprocessor receives only the personal data necessary to perform its function. The current list of subprocessors by name is published at passd.io/subprocessors and is updated when it changes.
- Legal requirements: if required by law, subpoena, court order, or to protect the rights, property, or safety of Passd or others.
- Business transfer: in connection with a merger, acquisition, or sale of assets, your information may be transferred. You will be notified by email of any change in ownership.
We do not share individual practice data, scores, Passd Score, or Voice Tutor conversation content with any state licensing authority, employer, brokerage, or third party.
Voice Tutor (Tutor feature)
Voice Tutor sends your chat messages to our AI model provider to produce replies. To make the tutor feel like it knows you specifically, we also send a small set of personalization signals derived from your activity on Passd:
- Profile context: your current Passd Score, weakest and strongest topics, last session score, exam date, display name (if set), and the active Voice Tutor mode (concept, walkthrough, anxiety, deep-dive, or debrief).
- State exam facts: verified facts about your state’s licensing exam (question count, time limit, passing score, testing vendor, governing agency), looked up from our verified state-exam database based on the state you declared during onboarding.
- Recent wrong-answer summary: a short list of your most recent wrong answers (topic and question stem only), capped at the 10 most recent. This is what lets the tutor say “you missed this last week” instead of generic feedback.
- Recent session summaries: brief summaries of your last few completed practice sessions (score and topic breakdown).
What we do not send: your email address, payment information, full transcripts from prior Voice Tutor sessions (each Voice Tutor session is fresh), or any personal data beyond what is listed above.
- Audio: if you speak to the tutor, your audio is sent to OpenAI for transcription, and the tutor’s reply is synthesized to speech via OpenAI and streamed back to your browser. Passd does not retain the audio file after the session. OpenAI may retain audio temporarily per its own policies for abuse prevention and service quality — see the subprocessors page for links. You can avoid all audio processing by typing instead of speaking — every Voice Tutor mode supports text input.
- Retention: Passd does not store Voice Tutor conversation content on our servers. Messages exist in your browser for the duration of a session and are discarded when you close the tab. Our AI and speech providers may retain content temporarily per their own policies for abuse prevention and service quality — see the subprocessors page for links to their terms.
Daily study-plan emails (Tutor feature)
If you enable daily study-plan emails in your account settings, we compute your top three weakest topics each morning from your recent practice sessions and send a short nudge email via our transactional-email provider pointing to your personalized plan in-app. We store a per-send audit log (send timestamp, recipient user ID, subject line, the topic identifiers used to compose that morning’s email, your intensity preference at the time of send, and the delivery status — sent, failed, or skipped) to troubleshoot delivery failures. We do not include test questions, answer history, or personal practice details in the email body itself. Disable at any time in account settings.
5. Data Retention
We retain your account and practice data for as long as your account is active. If you delete your account, we make commercially reasonable efforts to delete your personal information within 30 days, except where retention is required by law (e.g., payment records for tax purposes). Anonymized, aggregate data may be retained indefinitely for Service improvement.
6. Your Rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your account and personal data.
- Export your practice data in a portable format.
- Opt out of non-essential communications.
To exercise any of these rights, email support@passd.io. We respond within 30 days.
California residents (CCPA)
If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.
Self-serve analytics deletion: visit passd.io/settings/privacy and click Delete my analytics data. The request is rate-limited to once per 24 hours and is typically completed within 30 days. If for any reason the self-serve flow doesn’t work, email support@passd.io with the subject line “CCPA Request.” To delete your full account (including study sessions and payment records), email support@passd.io as well.
7. Security
We implement reasonable technical and organizational measures to protect your information, including encryption in transit (TLS), encryption at rest (Supabase), and row-level security policies in our database. No system is perfectly secure — we cannot guarantee absolute security, but we take it seriously.
8. Children
The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact support@passd.io and we will delete it.
9. Third-Party Links
The Service may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 14 days before taking effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
11. Contact
Questions about this Privacy Policy: support@passd.io