Privacy policy

Information we collect

The information depends on how you use Citiz:

• Account information: email address, password hash, email-verification status, preferred language and sign-in security counters. We never store your plain-text password.
• Study information: chapter progress, answers, mock-exam results, scores and the times needed to maintain your progress and access.
• Technical and campaign information: signed session identifiers, IP address, browser user agent, limited server logs and, when you follow a tagged campaign link, its Urchin Tracking Module (UTM) source, medium, campaign, content and term values, initial page and capture time.
• Purchase information: Stripe checkout, payment and event references, the amount and currency paid, paid-access dates and the campaign-attribution snapshot present when Checkout started. Stripe, not Citiz, handles your card details.
• Support information: the email and information you choose to send when asking for help or a refund. Do not send identity or immigration documents.

Why we use it

We use personal information to create and secure accounts, remember study progress, provide mock exams, activate paid access, measure which campaigns lead to registrations and purchases, send verification, reset and receipt emails, answer support requests, prevent abuse, diagnose problems and meet legal obligations. We do not use it for unrelated purposes without notice and any consent required by law.

We do not sell personal information or use it for targeted advertising.

Cookies and measurement

Citiz uses an essential, signed session cookie to keep you signed in and protect account actions. When you follow a tagged campaign link, Citiz also uses a signed first-party campaign cookie for up to 30 days. It contains only the permitted UTM campaign values, the initial page and capture time; it does not contain your email address or the original query string. We use Umami Cloud for aggregate site and campaign measurement without an Umami analytics cookie or cross-site tracking. Citiz sends permitted UTM values to Umami but does not send email addresses, account identifiers, arbitrary query parameters or Stripe references. Stripe applies its own privacy and cookie practices after you choose to open its hosted checkout.

Service providers and disclosure

We use Stripe for payment processing, Resend for email delivery, Have I Been Pwned for password-breach screening, Umami Cloud for cookieless aggregate analytics, and hosting and infrastructure providers to operate Citiz. Stripe Checkout receives the server-owned offer and permitted campaign-attribution snapshot so its signed webhook can return both with the payment confirmation; the snapshot never contains the original query string. The password check sends only the first five characters of a SHA-1 hash with response padding; it does not send the password or full hash. Providers receive only the information needed for their function. We may also disclose information when required by law or to protect the service and its users.

Some providers may process information outside your province or outside Canada. Information in another jurisdiction can be subject to that jurisdiction's laws and lawful access by its authorities.

Retention and deletion

An anonymous campaign attribution expires after 30 days. If you create or sign in to an account during that period, Citiz copies the attribution to the account and to any resulting purchase record so campaign results remain auditable; those copies follow the retention of the related account or transaction. We keep account and study information while your account exists and retain operational or transaction information only as long as reasonably needed for the purposes above or required by law. Retention by Stripe and other providers follows their own policies and legal duties.

You can permanently delete your Citiz account, sessions, recorded answers, progress and local purchase records from your account page. Information already retained by a provider or required by law may remain for the applicable period.

How we protect information

We use password hashing, signed HTTP-only cookies, access controls, encrypted network connections in production, filtered sensitive request parameters and limited staff and provider access. No online service can promise absolute security; contact us promptly if you believe your account or information has been compromised.

Your choices and privacy rights

You may ask what personal information we hold about you, how it has been used or disclosed, and request access or correction subject to applicable law. You may withdraw consent where permitted, although Citiz may be unable to provide features that require that information. You may also challenge our privacy practices.

Send a privacy request or complaint to the person responsible for privacy at [email protected]. We may need to verify that the request concerns your account before disclosing or changing information.

Changes to this policy

We may update this policy when the service or our practices change. We will post the new effective date here and provide additional notice before a material change when required.