Legal

Privacy Policy

Effective October 4, 2026 · Beta service

The short version: your study data stays in this app's own database, nothing is sold or shared, there are no ad trackers and no third-party analytics. Email delivery runs through Resend; the site is served through Cloudflare.

1. Who we are

This Privacy Policy describes how ClickCert ("we," "us"), operated by Theo Atallah, handles information in connection with clickcert.atallah.link (the "service"). Questions: support@clickcert.atallah.link.

2. Information we collect

Account information: email address, first and last name, password (stored only as a salted hash), and — optionally — how you heard about us and your phone number, if you choose to provide them.
Study data: your practice answers, mock exam attempts, scores, response history, and preferences, tied to your account.
Support artifacts you upload: if you upload an avatar, we store the image to display it back to you.
Operational records: server logs (including IP address and user agent as processed by our hosting and edge providers), security and abuse-prevention records, and email delivery status.

3. What we do not do

We do not sell or rent personal information.
We do not run third-party analytics or advertising trackers.
We do not share your study data with anyone except to operate the service (hosting, email delivery, edge/CDN) or when the law requires it.

4. How we use information

To provide the service: accounts, practice and mock exams, history, and analytics of your own performance shown to you.
To authenticate you and keep your account secure, including rate limiting and account lockout after repeated failed sign-ins.
To send transactional email you request — for example, password reset links and password-change confirmations — through our email provider, Resend. We do not send marketing email.
To detect, investigate, and prevent abuse: scraping, credential sharing, attacks, and other violations of our Terms of Use. This may include reviewing logs and account activity, and preserving evidence of violations.
To comply with law and enforce our Terms.

5. Service providers (subprocessors)

We use a small number of providers to operate the service. They process information on our behalf:

Hosting: the application runs on infrastructure controlled by the operator.
Edge/CDN & security: Cloudflare, Inc. — terminates TLS, serves static assets, and protects against bots and abuse. Cloudflare processes IP addresses and request metadata as part of this.
Email delivery: Resend, Inc. — delivers transactional email such as password resets to the address you give us.
DNS: Porkbun, LLC — domain name services.

6. Cookies; sessions

We use a single session cookie to keep you signed in (HttpOnly; SameSite=Lax; Secure). It contains an opaque token — not personal data — and ends when you sign out or the session expires. We do not use advertising or cross-site tracking cookies.

7. Data retention

Account and study data are kept while your account is active. Sessions expire (currently 30 days). Password reset tokens are stored only as hashes and expire one hour after issuance. Server logs are kept for a limited operational period. If your account is deleted or disabled, we may retain records reasonably needed for security, abuse-prevention, or legal compliance.

8. Your choices and rights

Access, correction, export: you can see your study history and account settings in the app; you may also email us to request a copy or correction of your personal information.
Deletion: you may ask us to delete your account and personal information; we will do so except where retention is required for security, abuse-prevention, or legal reasons.
California: if you are a California resident, you have the right to know what personal information is collected and to request deletion or correction, without discrimination for exercising those rights. We do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA.

9. Security

Passwords are stored only as salted hashes. Sessions are server-side opaque tokens in HttpOnly cookies. Transport is encrypted (HTTPS, TLS terminated at the edge). Reset tokens are single-use and short-lived. No system is perfectly secure; if a breach affecting your information occurs, we will notify you as required by law.

10. Children

ClickCert is intended for adults preparing for a professional licensing exam and is not directed to children under 18. We do not knowingly collect information from anyone under 18.

11. Changes

Material changes to this policy will be posted on this page with an updated effective date.

12. Contact

Privacy questions: support@clickcert.atallah.link.