Privacy Policy

Crack the NCLEX ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use the Service.

1. Information We Collect

1.1 Personal Information

We collect the following personal information when you register for an account or use our Service:

• Account Information: Email address, name, and password (stored in encrypted/hashed format)
• Payment Information: Payment details are processed securely by Stripe, our third-party payment processor. We do not store your credit card numbers or banking information on our servers.
• Study Data: Test scores, video watch progress, flashcard progress, AI quiz history, bookmarked questions, and study session data
• Activity Logs: Page visits, IP addresses, timestamps, device information, and user interactions (used for security monitoring and fraud prevention)
• Communications: Messages you send through our contact form or support channels

1.2 Automatically Collected Information

When you access the Service, we automatically collect certain information, including:

• Cookies and Tracking Technologies: Authentication tokens, theme preferences, and session data
• Analytics Data: Usage statistics, page views, and user behavior collected through Google Analytics
• Device Information: Browser type, operating system, device type, and screen resolution

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your payments and manage your subscription
• Track your study progress and provide personalized learning recommendations
• Send you important updates, security alerts, and administrative messages
• Respond to your inquiries and provide customer support
• Monitor and analyze usage patterns to improve the Service
• Detect, prevent, and address security violations, fraud, and unauthorized access
• Defend against chargebacks and disputes (forensic-level activity tracking)
• Comply with legal obligations and enforce our Terms of Service

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information with the following third-party service providers who help us operate the Service:

• Stripe: Payment processing (receives payment information, email, and name)
• Vimeo: Video hosting and streaming (may collect viewing data and IP addresses)
• OpenAI/OpenRouter: AI-powered quiz generation and study assistance (receives your prompts and questions)
• Resend: Email delivery service (receives email addresses and message content)
• Google Analytics: Website analytics and usage tracking
• Upstash (Redis): Data caching and session management

These third-party providers have their own privacy policies and are responsible for their own data practices. We encourage you to review their privacy policies.

We may also disclose your information if required by law, court order, or government regulation, or to protect our rights, property, or safety.

4. Instructor Accounts and Data Access

If you are a student assigned to an instructor account, your instructor may view:

• Your test scores and performance data
• Video watch progress and completion status
• Study activity and engagement metrics
• Answer choices and test results

Instructors can only view data for students they have explicitly assigned to their account. Instructors cannot access your account credentials, payment information, or personal messages.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of passwords using bcrypt hashing
• Secure HTTPS connections for all data transmission
• JWT (JSON Web Token) authentication with token blacklisting
• Rate limiting and IP blocking to prevent unauthorized access
• Automated security monitoring and violation tracking
• Regular security audits and vulnerability scanning

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

6. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy:

• Active Accounts: Data is retained while your account is active
• Deleted Accounts: Personal data is deleted within 30 days of account deletion request
• Payment Records: Retained for 7 years to comply with tax and legal requirements
• Security Logs: Activity logs may be retained longer for fraud prevention and legal compliance

7. Your Privacy Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Opt-Out: Unsubscribe from marketing emails (account-related emails cannot be opted out)
• Data Portability: Request a copy of your data in a portable format

To exercise these rights, please contact us at hi@NCLEXcracker.com. We will respond to your request within 30 days.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

8.1 Right to Know

You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.

8.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention).

8.3 Right to Opt-Out of Sale

We do not sell your personal information. We do not share your information with third parties for monetary or other valuable consideration.

8.4 Right to Non-Discrimination

You have the right to not receive discriminatory treatment for exercising your CCPA/CPRA rights.

8.5 How to Submit a Request

To exercise your California privacy rights, please email us at hi@NCLEXcracker.com with the subject line "California Privacy Rights Request." We will verify your identity before processing your request.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on the Service:

• Essential Cookies: Required for authentication, security, and basic functionality
• Preference Cookies: Remember your settings (e.g., dark mode preference)
• Analytics Cookies: Help us understand how users interact with the Service (Google Analytics)

You can control cookies through your browser settings. However, disabling essential cookies may affect the functionality of the Service.

10. Children's Privacy

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from individuals under 18. If you are under 18, please do not use the Service or provide any personal information.

If we discover that we have collected personal information from a person under 18, we will delete that information immediately. If you believe we have collected information from a minor, please contact us at hi@NCLEXcracker.com.

11. Third-Party Links

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. International Users

The Service is hosted in the United States and is intended for users in the United States and Canada. If you access the Service from outside these regions, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

By using the Service, you consent to the transfer of your information to the United States.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated Privacy Policy on this page
• Updating the "Effective Date" at the top
• Sending you an email notification (for significant changes)

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at hi@NCLEXcracker.com.